3 ms·

i do it even easier. i have zerotier running and everyone is on the same "network". you do need to look for an ISP that gives you a static ip which isnt even p

i do it even easier. i have zerotier running and everyone is on the same "network". you do need to look for an ISP that gives you a static ip which isnt even possible where i live

KSPAtlas 5y ago
My ISP only offers static in the business packages, which requires an actual business and it very expensive.
- nyolfen 5y ago
  i just cron a curl to update my A records once an hour
- xyzzy_plugh 5y ago
  I have a business package but I can't get a static IP because the managed switch is unavailable for the foreseeable future due to components shortage. I was told I'd be lucky if I get one before my contract expires.
discardedrefuse 5y ago
I recently did a deep dive into network overlays (like zerotier); mostly because I have a few self hosted services, and overlays seem to be the hot topic in the self-hosting community. I've come away with the feeling that most people using overlay networks at home are doing it completely wrong and opening themselves up to a world of hurt. First, network overlays are not easier to setup than VPNs. Installing and configuring a network overlay client on every device is much more work than setting up a single VPN tunnel for every network you want to access. Overlay networks are just easier to plan because there is no planning. But they're not easier to implement. Second, and far more important, meshing all your devices into a single flat network is dangerous. There is a reason why networks are designed with isolation strategies. Introducing an overlay into your networks breaks down these barriers for you, but also for an attacker. The only overlay network that has built in firewall capabilities is Nebula. When I started configuring its firewall rules I found myself just recreating my existing segmented networks, but in a much more obtuse way. Instead of configuring a central firewall, I was configuring firewall rules on each device. After all my research, I'm still running the same segmented network I was running before my overlay experiments. But I would like to give some praise to both Nebula and Yggdrasil. IMHO, these are the two most existing projects coming out of this space right now.
- ElectricalUnion 5y ago
  > Second, and far more important, meshing all your devices into a single flat network is dangerous. There is a reason why networks are designed with isolation strategies. Introducing an overlay into your networks breaks down these barriers for you, but also for an attacker. What prevents you from meshing the individual services on a per-need basis? The fact that they're overlays makes them even more convenient for such isolation. > The only overlay network that has built in firewall capabilities is Nebula. Are those built in firewall capabilities really missing from the other networks? As far as I know, ZeroTier is more of a SDN that an simple overlay (That's what made me interested in ZeroTier in the first place). If conventional "L4 transport-layer" firewall/routing capabilites are enough for real networks, then ZeroTier SDN capabilities are probably enough for it's virtual networks. Granted, it doesn't have some nice built-in high-level generic "L7 application-level" firewall capabilities, but I don't trust those in the first place.
  - discardedrefuse 5y ago
    I'm not suggesting overlay networks are useless (Slack uses it to connect thousands of machines around the world!). My comment is aimed at the self-hosting community using them as a VPN replacement for remote management / access. I don't see how they are any better than VPNs for this. They're probably worse once you start connecting all the devices you aim to remotely manage into a flat network (mixing internet facing devices that should be DMZ'd with internal devices).

i do it even easier. i have zerotier running and everyone is on the same "network". you do need to look for an ISP that gives you a static ip which isnt even possible where i live

KSPAtlas 5y ago

My ISP only offers static in the business packages, which requires an actual business and it very expensive.

nyolfen 5y ago
i just cron a curl to update my A records once an hour
xyzzy_plugh 5y ago
I have a business package but I can't get a static IP because the managed switch is unavailable for the foreseeable future due to components shortage. I was told I'd be lucky if I get one before my contract expires.

discardedrefuse 5y ago

I recently did a deep dive into network overlays (like zerotier); mostly because I have a few self hosted services, and overlays seem to be the hot topic in the self-hosting community. I've come away with the feeling that most people using overlay networks at home are doing it completely wrong and opening themselves up to a world of hurt. First, network overlays are not easier to setup than VPNs. Installing and configuring a network overlay client on every device is much more work than setting up a single VPN tunnel for every network you want to access. Overlay networks are just easier to plan because there is no planning. But they're not easier to implement. Second, and far more important, meshing all your devices into a single flat network is dangerous. There is a reason why networks are designed with isolation strategies. Introducing an overlay into your networks breaks down these barriers for you, but also for an attacker. The only overlay network that has built in firewall capabilities is Nebula. When I started configuring its firewall rules I found myself just recreating my existing segmented networks, but in a much more obtuse way. Instead of configuring a central firewall, I was configuring firewall rules on each device. After all my research, I'm still running the same segmented network I was running before my overlay experiments. But I would like to give some praise to both Nebula and Yggdrasil. IMHO, these are the two most existing projects coming out of this space right now.

ElectricalUnion 5y ago
> Second, and far more important, meshing all your devices into a single flat network is dangerous. There is a reason why networks are designed with isolation strategies. Introducing an overlay into your networks breaks down these barriers for you, but also for an attacker. What prevents you from meshing the individual services on a per-need basis? The fact that they're overlays makes them even more convenient for such isolation. > The only overlay network that has built in firewall capabilities is Nebula. Are those built in firewall capabilities really missing from the other networks? As far as I know, ZeroTier is more of a SDN that an simple overlay (That's what made me interested in ZeroTier in the first place). If conventional "L4 transport-layer" firewall/routing capabilites are enough for real networks, then ZeroTier SDN capabilities are probably enough for it's virtual networks. Granted, it doesn't have some nice built-in high-level generic "L7 application-level" firewall capabilities, but I don't trust those in the first place.
- discardedrefuse 5y ago
  I'm not suggesting overlay networks are useless (Slack uses it to connect thousands of machines around the world!). My comment is aimed at the self-hosting community using them as a VPN replacement for remote management / access. I don't see how they are any better than VPNs for this. They're probably worse once you start connecting all the devices you aim to remotely manage into a flat network (mixing internet facing devices that should be DMZ'd with internal devices).