4 ms·
Easier cloud networking. I don’t use Tailscale, I use a competing and currently arguably better product (Netmaker). Imagine you’re a business building XYZ sof
by SOLAR_FIELDS 5y ago
Easier cloud networking.
I don’t use Tailscale, I use a competing and currently arguably better product (Netmaker).
Imagine you’re a business building XYZ software product. You build a k8s cluster in one region, but now you need your system also to exist simultaneously in another region for failover reasons. Now you need region A to be able to have replicas in region B in real-time amongst many other requirements and those two networks from each region need to be able to understand and talk to each other with minimal setup and headache. Perhaps network A is set up on DigitalOcean and network B is on AWS or GKE for financial or technical reasons. Example: it’s cheaper to have surplus machine needs on AWS/GKE but you don’t want machines running there all the time because it’s expensive.
Enter Wireguard mesh networking. Ever since kernel Wireguard made it into Linux this is where the endgame has been for cloud deployments. It’s a huge improvement over the previous solutions. Netmaker and Tailscale are two offerings of that solution.
Note that I’m not affiliated with Netmaker at all. Just a quite happy customer.
- cassianoleal 5y agoTailscale uses wireguard-go which is a Wireguard in userspace implementation, not the kernel driver.
- bogomipz 5y agoInteresting. How hard would it t build you own Tailscale implementation then? Does Tailscale just mostly provide a nice UX and provisioning on top of wireguard-go?
- randomblock1 5y agoYes, basically. How to create your own Tailscale-like WireGuard tunnel: 1. Put WireGuard on a Pi. Create a server config. 2. Open the WireGuard port to the Internet (don't worry, it's invisible) 3. Install WireGuard elsewhere, and generate a client config. All devices can now talk to each other. Tailscale has a "magic DNS" feature, which is nice, but WireGuard also supports custom DNS in the config.
- bogomipz 5y ago>"Open the WireGuard port to the Internet (don't worry, it's invisible)" Thanks. Can you elaborate on how it's invisible? I was looking at the docs and it looks like it defaults to UDP port 51820. Certainly that's visible no?
- MajesticHobo2 5y agoSince a WireGuard peer only responds to cryptographically authenticated packets and UDP is connectionless — you don't get confirmation at the transport layer by way of a handshake or anything — WireGuard ports are invisible to you unless you own a private key whose corresponding public key is already approved by the peer.
- detaro 5y agoWireguard does not reply to invalid connection attempts that don't have an authorized key, so it depends on what your system does for closed ports. If it (as often default) responds with an ICMP message, then the lack of such response will reveal that there is something there, whereas if your default is to silently drop packets to closed UDP ports it can't really be detected.
- cassianoleal 5y ago> 2. Open the WireGuard port to the Internet (don't worry, it's invisible) Not quite the same. Opening a Wireguard port to the Internet doesn't help if the port is unreachable due to weird NATting. My home ISP puts me on CGNAT so I have no IPv4 access to my network. If I'm out and on a v4-only network, I can't connect to that Wireguard instance without going through other hoops (like a "bastion" Wireguard peer on a dual-stack host, for instance). With Tailscale, it Just Works.
- adamcstephens 5y agoYou're likely going through a Tailscale relay when you're out of your house too. It's still an extra hop through their servers, but yes it "just works".