8 ms·

I wish there was something like tailscale but without a central server.

josephcsible 5y ago
Isn't that just vanilla WireGuard then?
bradfitz 5y ago
Tailscale without a central server is raw Wireguard, basically. You can do that but then you lose Tailscale's automatic NAT traversal and packet relay fallbacks for when UDP is blocked or NAT traversal fails. Or you can self-host Tailscale with https://github.com/juanfont/headscale https://github.com/juanfont/headscale if you want.
- deleted 5y ago
  [deleted]
- nitsky 5y ago
  Really impressive to see Tailscale employees recommending free alternatives to their own service!
  - bradfitz 5y ago
    Not much to lose. Very few interested in self hosting are probably the type who are going to pay anyway! :) So worst case they help with the open source code or bug reports or they get sick of self hosting and pay (or use our hosted one for free).
    - stavros 5y ago
      Can I self-host but still pay you an enterprise contract for when things go wrong? Or is that not supported?
      - crawshaw 5y ago
        Happy to discuss, send us an email! It is possible for enterprises, though we encourage users to first see if the hosted version will work for them because support is difficult, and thus significantly more expensive, for self-hosting.
        stavros 5y ago
        I will if we end up trying it out, though I think we'll just go with your version anyway. It's between you guys and Cloudflare, AFAIK, as Cloudflare's VPN does authentication to services easier too.
  - kondro 5y ago
    At $5/user/month (as a small company) it's MUCH easier to pay Tailscale than run something myself.
    - stavros 5y ago
      I wouldn't run it myself out of price sensitivity, but more because of trust. Then again, I imagine the keys are generated on the device and the code can be audited to never share them, plus it's WG under the hood.
ignoramous 5y ago
tailscale is p2p. IIRC, centralization is mostly for the control-plane (dns configuration, network configuration, flow logs, authn) and to route around unyielding NATs (without compromising on WireGuard's crypto-key routing).
1MachineElf 5y ago
You might want to consider innernet. It's still got a central server, but it's self-hosted and similarly easy to deploy. Check it out here: https://github.com/tonarino/innernet https://github.com/tonarino/innernet
api 5y ago
You can self-host ZeroTier controllers. Also gives you unlimited devices that way.
sockaddr 5y ago
As others have noted, just self-host a Zerotier controller. It's what I do.
Anunayj 5y ago
Also their blog post [1] explains issues around a truly mesh network, and how a centralized coordination point solves this issue with little disadvantages. [1] https://tailscale.com/blog/how-tailscale-works/ https://tailscale.com/blog/how-tailscale-works/

Isn't that just vanilla WireGuard then?

Tailscale without a central server is raw Wireguard, basically. You can do that but then you lose Tailscale's automatic NAT traversal and packet relay fallbacks for when UDP is blocked or NAT traversal fails. Or you can self-host Tailscale with https://github.com/juanfont/headscale https://github.com/juanfont/headscale if you want.

deleted 5y ago
[deleted]
nitsky 5y ago
Really impressive to see Tailscale employees recommending free alternatives to their own service!
- bradfitz 5y ago
  Not much to lose. Very few interested in self hosting are probably the type who are going to pay anyway! :) So worst case they help with the open source code or bug reports or they get sick of self hosting and pay (or use our hosted one for free).
  - stavros 5y ago
    Can I self-host but still pay you an enterprise contract for when things go wrong? Or is that not supported?
    - crawshaw 5y ago
      Happy to discuss, send us an email! It is possible for enterprises, though we encourage users to first see if the hosted version will work for them because support is difficult, and thus significantly more expensive, for self-hosting.
      - stavros 5y ago
        I will if we end up trying it out, though I think we'll just go with your version anyway. It's between you guys and Cloudflare, AFAIK, as Cloudflare's VPN does authentication to services easier too.
- kondro 5y ago
  At $5/user/month (as a small company) it's MUCH easier to pay Tailscale than run something myself.
  - stavros 5y ago
    I wouldn't run it myself out of price sensitivity, but more because of trust. Then again, I imagine the keys are generated on the device and the code can be audited to never share them, plus it's WG under the hood.

ignoramous 5y ago

tailscale is p2p. IIRC, centralization is mostly for the control-plane (dns configuration, network configuration, flow logs, authn) and to route around unyielding NATs (without compromising on WireGuard's crypto-key routing).

1MachineElf 5y ago

You might want to consider innernet. It's still got a central server, but it's self-hosted and similarly easy to deploy. Check it out here: https://github.com/tonarino/innernet https://github.com/tonarino/innernet

api 5y ago

You can self-host ZeroTier controllers. Also gives you unlimited devices that way.

sockaddr 5y ago

As others have noted, just self-host a Zerotier controller. It's what I do.

Anunayj 5y ago

Also their blog post [1] explains issues around a truly mesh network, and how a centralized coordination point solves this issue with little disadvantages. [1] https://tailscale.com/blog/how-tailscale-works/ https://tailscale.com/blog/how-tailscale-works/