3 ms·

Is https://tailscale.com/ https://tailscale.com/ not "usermode WireGuard"? I've been playing with it for a while now (it has a fairly generous free tier) and am

Is https://tailscale.com/ https://tailscale.com/ not "usermode WireGuard"? I've been playing with it for a while now (it has a fairly generous free tier) and am quite impressed. I can access any of my LAN machines (my servers, my NAS, etc.) from anywhere that is also connected to the same network, and the names work for DNS as well.

tptacek 5y ago
1. Tailscale is amazing. I hate them so much. (We use Tailscale and are very happy with it.) 2. Tailscale is user-mode WireGuard. 3. "User-mode WireGuard" in the sense this post uses the term is a misnomer and refers to the fact that we run TCP/IP itself in userland (Tailscale normally runs through a tunnel device and uses your native TCP/IP stack). 4. But Tailscale also has code to do user-mode TCP/IP (they've got it running in a browser with wasm).
- pmarreck 5y ago
  Fascinating!
- anderspitman 5y ago
  Last I heard[0] they were experimenting but hadn't shipped it. AFAIK their client still requires root, no? Running on wasm sounds awesome. This[1] looks like it. Do you know how they're doing the actual networking? WebRTC tunnel? [0]: https://news.ycombinator.com/item?id=24483173 https://news.ycombinator.com/item?id=24483173 [1]: https://twitter.com/bradfitz/status/1451423386777751561?lang=en https://twitter.com/bradfitz/status/1451423386777751561?lang...
  - tptacek 5y ago
    Yeah, their client is always going to require privileges, because it needs to enable every other program on the system to interact directly with remote hosts transparently. User-mode TCP/IP works for us because we own the client-side program that our users run to talk to stuff on Fly.io.
  - bradfitz 5y ago
    > Last I heard[0] they were experimenting but hadn't shipped it. AFAIK their client still requires root, no? Tailscale's gvisor/netstack-based userspace networking mode has been supported and in wide use for quite some time. It's the default on Synology DSM7, for instance. You don't need root when you run tailscaled with `--tun=userspace-networking`. Peers can still connect inbound to the non-root tailscaled, but to connect _out_ to other peers, you need to use tailscaled's HTTP or SOCKS5 proxy, which are also flags to tailscaled, to specify what port they listen on.
    - anderspitman 5y ago
      Thanks for the update! Do you have any links that talk more about how the wasm stuff works? I'd love to read more about that.
- amscanne 5y ago
  I think Tailscale uses user-mode TCP/IP (also gVisor netstack) for some client devices, like iOS? But could be wrong here.
  - bradfitz 5y ago
    We use it on all platforms _except_ iOS, for binary size/memory reasons. (iOS 15 bumped the Network Extension memory limit to 50 MB, but we still need to be super trim for iOS 14's 15 MB limit)
    - amscanne 5y ago
      LOL, I was precisely wrong. Is there actually a preference for user-mode networking? I assume that’s primarily about control and flexibility? Either way, I hope that the PacketBuffer changes can help reduce footprint after issues are shaken out.
anderspitman 5y ago
It depends on what sort of tunneling you're doing. If you just want a general-purpose private VPN, Tailscale is amazing. That list is more focused on the use case where you want to host a public server on a machine that isn't accessible to the internet (NAT, corporate firewall, etc). Think a shared Jellyfin server for your friends and family. You can use Tailscale here but you'll need to separately run a reverse-proxy on a public machine. There are more moving pieces but if you're using Tailscale already then it's a good option.
- pmarreck 5y ago
  I wish I could run two separate Tailscale networks on a single device, one for business and one for personal (for example). Would make it tremendously more useful.
  - vineyardmike 5y ago
    Is this different from sharing one device with other accounts?
  - LilBytes 5y ago
    There's an existing GitHub ask for this to be implemented. It's not terrible jumping between work and personal and work environments but it would be nice if I didn't have to.
chaxor 5y ago
Headscale seems even better! They've taken what tailscale has done and improved it even more by allowing it to be a completely self hosted and private solution.

tptacek 5y ago

1. Tailscale is amazing. I hate them so much. (We use Tailscale and are very happy with it.) 2. Tailscale is user-mode WireGuard. 3. "User-mode WireGuard" in the sense this post uses the term is a misnomer and refers to the fact that we run TCP/IP itself in userland (Tailscale normally runs through a tunnel device and uses your native TCP/IP stack). 4. But Tailscale also has code to do user-mode TCP/IP (they've got it running in a browser with wasm).

pmarreck 5y ago
Fascinating!
anderspitman 5y ago
Last I heard[0] they were experimenting but hadn't shipped it. AFAIK their client still requires root, no? Running on wasm sounds awesome. This[1] looks like it. Do you know how they're doing the actual networking? WebRTC tunnel? [0]: https://news.ycombinator.com/item?id=24483173 https://news.ycombinator.com/item?id=24483173 [1]: https://twitter.com/bradfitz/status/1451423386777751561?lang=en https://twitter.com/bradfitz/status/1451423386777751561?lang...
- tptacek 5y ago
  Yeah, their client is always going to require privileges, because it needs to enable every other program on the system to interact directly with remote hosts transparently. User-mode TCP/IP works for us because we own the client-side program that our users run to talk to stuff on Fly.io.
- bradfitz 5y ago
  > Last I heard[0] they were experimenting but hadn't shipped it. AFAIK their client still requires root, no? Tailscale's gvisor/netstack-based userspace networking mode has been supported and in wide use for quite some time. It's the default on Synology DSM7, for instance. You don't need root when you run tailscaled with `--tun=userspace-networking`. Peers can still connect inbound to the non-root tailscaled, but to connect _out_ to other peers, you need to use tailscaled's HTTP or SOCKS5 proxy, which are also flags to tailscaled, to specify what port they listen on.
  - anderspitman 5y ago
    Thanks for the update! Do you have any links that talk more about how the wasm stuff works? I'd love to read more about that.
amscanne 5y ago
I think Tailscale uses user-mode TCP/IP (also gVisor netstack) for some client devices, like iOS? But could be wrong here.
- bradfitz 5y ago
  We use it on all platforms _except_ iOS, for binary size/memory reasons. (iOS 15 bumped the Network Extension memory limit to 50 MB, but we still need to be super trim for iOS 14's 15 MB limit)
  - amscanne 5y ago
    LOL, I was precisely wrong. Is there actually a preference for user-mode networking? I assume that’s primarily about control and flexibility? Either way, I hope that the PacketBuffer changes can help reduce footprint after issues are shaken out.

anderspitman 5y ago

It depends on what sort of tunneling you're doing. If you just want a general-purpose private VPN, Tailscale is amazing. That list is more focused on the use case where you want to host a public server on a machine that isn't accessible to the internet (NAT, corporate firewall, etc). Think a shared Jellyfin server for your friends and family. You can use Tailscale here but you'll need to separately run a reverse-proxy on a public machine. There are more moving pieces but if you're using Tailscale already then it's a good option.

pmarreck 5y ago
I wish I could run two separate Tailscale networks on a single device, one for business and one for personal (for example). Would make it tremendously more useful.
- vineyardmike 5y ago
  Is this different from sharing one device with other accounts?
- LilBytes 5y ago
  There's an existing GitHub ask for this to be implemented. It's not terrible jumping between work and personal and work environments but it would be nice if I didn't have to.

chaxor 5y ago

Headscale seems even better! They've taken what tailscale has done and improved it even more by allowing it to be a completely self hosted and private solution.