3 ms·

It sounds like we could have a generic userspace tool that proxies any connection to a WireGuard server. Similar to ssh -L, it would listen on a TCP/UDP port lo

by remram 5y ago

It sounds like we could have a generic userspace tool that proxies any connection to a WireGuard server. Similar to ssh -L, it would listen on a TCP/UDP port locally (or talk the SOCKS protocol) and convert that to IP packets over the WireGuard connection (using a userspace TCP or UDP implementation for that side). It looks like Fly.io has all the bits, they just need to be packaged as a stand-alone tool rather than built into flyctl and only talk SSH.

mrkurt 5y ago
Tailscale will do this! tailscaled --tun=userspace-networking --socks5-server=localhost:1081
- sa1 5y ago
  Sadly, on the only machine that I would have wanted this on, where I didn't have root access, this has never worked for me. I should try to recreate the logs and issue for the tailscale folks.
  - godtoldmetodoit 5y ago
    I had issues with it as well, was following the Tailscale guide for getting userspace running in Azure App Service and I could not get it to work.
  - anurag 5y ago
    Our customers at Render run Tailscale in user mode every day. Here's the repo they use: https://github.com/render-examples/tailscale https://github.com/render-examples/tailscale. An example of using Tailscale to access VSCode in the cloud: https://render.com/blog/host-a-dev-environment-on-render-with-vs-code-and-tailscale https://render.com/blog/host-a-dev-environment-on-render-wit...
- remram 5y ago
  With any WireGuard server or a custom tailscale server/service?
rkeene2 5y ago
SSH can do this without any WireGuard: https://rkeene.org/viewer/tmp/ssh-ip-tunnel.txt.htm https://rkeene.org/viewer/tmp/ssh-ip-tunnel.txt.htm
- remram 5y ago
  There's nothing userspace about this, you are using a tun device with the actual kernel IP stack.
- anderspitman 5y ago
  One thing to watch out for with that setup is using SSH for TUN devices can suffer from TCP-over-TCP performance issues, aka "TCP meltdown", when there's packet loss. You can avoid this by using normal SSH tunnels, a la ssh -L or -R, which unpack the individual TCP streams and multiplex them over a single connection. Or if you need a more traditional VPN setup use WireGuard.

by remram 5y ago

mrkurt 5y ago

Tailscale will do this! tailscaled --tun=userspace-networking --socks5-server=localhost:1081

sa1 5y ago
Sadly, on the only machine that I would have wanted this on, where I didn't have root access, this has never worked for me. I should try to recreate the logs and issue for the tailscale folks.
- godtoldmetodoit 5y ago
  I had issues with it as well, was following the Tailscale guide for getting userspace running in Azure App Service and I could not get it to work.
- anurag 5y ago
  Our customers at Render run Tailscale in user mode every day. Here's the repo they use: https://github.com/render-examples/tailscale https://github.com/render-examples/tailscale. An example of using Tailscale to access VSCode in the cloud: https://render.com/blog/host-a-dev-environment-on-render-with-vs-code-and-tailscale https://render.com/blog/host-a-dev-environment-on-render-wit...
remram 5y ago
With any WireGuard server or a custom tailscale server/service?

rkeene2 5y ago

SSH can do this without any WireGuard: https://rkeene.org/viewer/tmp/ssh-ip-tunnel.txt.htm https://rkeene.org/viewer/tmp/ssh-ip-tunnel.txt.htm

remram 5y ago
There's nothing userspace about this, you are using a tun device with the actual kernel IP stack.
anderspitman 5y ago
One thing to watch out for with that setup is using SSH for TUN devices can suffer from TCP-over-TCP performance issues, aka "TCP meltdown", when there's packet loss. You can avoid this by using normal SSH tunnels, a la ssh -L or -R, which unpack the individual TCP streams and multiplex them over a single connection. Or if you need a more traditional VPN setup use WireGuard.