7 ms·
FireZone – Open-source VPN server and firewall
- yewenjie 4y agoThere is an install script for this which is imperative. I wish there was something for NixOS (which would be declarative).
- deleted 4y ago[deleted]
- simongray 4y agoThis doesn't really seem to do what Tailscale is doing, which is to create a mesh network with a central beacon node for facilitating handshakes. I am currently researching this area and have found the following solutions in the mesh VPN space. In order of how locked down the source code is—which also seems to correlate with ease of use—there is Tailscale, ZeroTier, Netmaker, Nebula, and also Innernet (this last one is only mac/linux).
- igorhvr 4y agoThanks! Yggdrasil ( https://yggdrasil-network.github.io/ https://yggdrasil-network.github.io/ ) should probably in this list too, except that it doesn't need a central beacon node.
- simongray 4y agoVery interesting. I will add it to my list.
- joshbaptiste 4y agoaaaaaand Netbird ..
- smilliken 4y agoZeroTier doesn't use WireGuard, but is a mature option that fills the same niche.
- temp8964 4y agoWould any of those can be used against China's GFW? Tailscale could be blocked by the GFW [1]. I guess that's because it uses a central beacon node? Also they are built on WireGuard, which is not obfuscated, so they can be detected by DPI? [1] https://forum.tailscale.com/t/does-tailscale-work-in-mainland-china/615/2 https://forum.tailscale.com/t/does-tailscale-work-in-mainlan...
- gz5 4y agofully self-hosted is usually best, e.g.wireguard. zerotier is close. openziti, especially in cases in which app-specific VPNs help (each session looks like different encrypted apps, and you choose what apps).
- simongray 4y agoI have actually lived in China for 2 years and travelled there for maybe 6 months in total in addition to that. I've always just used a traditional, commercial VPN service such as ExpressVPN. In theory, those can also easily be blocked, but in my experience it rarely happens in practice. The main issue with living in China is the fact that the connections to the outside world are so clogged that using something like Youtube is often so slow that it's not even worth trying; that was the case in the Beijing area between 2016-2018 at least.
- temp8964 4y agoThere is a "conspiracy" theory that those VPN works in China because they have a connection to the CCP. It would be amazing if Tailscale can use ExpressVPN kind of services for handshaking so that it can work inside the GFW.
- simongray 4y agoI think self-hosting is the better solution if you're worried about someone blocking a VPN's IP address. I've heard those conspiracy theories, but to be honest I just accepted that everything was monitored when I was in China anyway. Installing something like Wechat/微信 basically gives tencent permission to everything that's on your (Android) phone anyway. To me, the VPN was solely about granting access to what was otherwise blocked, not about privacy.
- lapser 4y agoWorth noting, the biggest closed source thing from Tailscale is the server side, which has an open source re-implementation call Headscale[0]. [0] https://github.com/juanfont/headscale https://github.com/juanfont/headscale
- alistairjevans 4y agoYou can probably add https://enclave.io https://enclave.io to that list; creates mesh VPN networks based on tags + policy.
- pid-1 4y agoFortinet has a (cloud controlled, IPSec based) mesh VPN solution. Maybe other networking equipment vendors also have their own offerings.
- DyslexicAtheist 4y agowhy would anyone want to have IPSec in 2022 ? It means remaining stuck with a mid-90ies committee-driven-crypto protocol (and the design is far from best practice in modern security). I really like the design principles[1] of Wireguard. It does away with all the key-negotiation nonsense and eliminates a whole cluster of potential flaws right out of the gate. Also Jason Donenfeld's software development cycle is a skill level that can only be described as a 10000x-developer. [1] https://securitycryptographywhatever.buzzsprout.com/1822302/9667632-wireguard-feat-jason-donenfeld https://securitycryptographywhatever.buzzsprout.com/1822302/...
- pid-1 4y agoI think your average enterprise sysadmin/networking person doesn't really care about IPSec vs Wireguard.
- dstanbro 4y agoYeah you can't really use FZ for Tailscale use cases, though maybe OP is just referring to how it uses WireGuard. Netmaker and Innernet are the two Tailscale alternatives which are using WireGuard. And in fact, both are much faster than Tailscale because they use Kernel WireGuard. So they'd probably be the best options for "Tailscale Alternative."
- deleted 4y ago[deleted]
- gz5 4y agoanother well vetted one is OpenZiti (NetFoundry SaaS products are built on top of OpenZiti). full mesh, although default-closed model instead of default-open model: https://openziti.github.io/ziti/overview.html https://openziti.github.io/ziti/overview.html
- qbasic_forever 4y agoTinc is another mesh option. Doesn't use wireguard but is still highly regarded and liked: https://www.tinc-vpn.org/ https://www.tinc-vpn.org/
- dang 4y agoThe originally submitted title said "Tailscale Alternative" but this appears to have been an error and we've taken it out now. More at https://news.ycombinator.com/item?id=31542122 https://news.ycombinator.com/item?id=31542122.
- matthewmacleod 4y agoThis is very nice and looks like a useful tool. It's also very much not a "Tailscale Alternative" – it explicitly describes itself as not being "a tool for creating mesh networks", which is the exact thing that Tailscale is all about. Nebula (https://github.com/slackhq/nebula https://github.com/slackhq/nebula) is much closer to actually being a fully open-source and self-hostable Tailscale alternative as I understand it, though I've never used it myself.
- Zizizizz 4y agoI've been trying netmaker and it's been very easy to set up. Would recommend giving it a go
- 8organicbits 4y agoHow are end user devices supposed to join the mesh in Nebula? Is it really add this collection of files to /etc and run a nebula command on the command line?
- dddw 4y agoWith keys that are signed with a CA cert. And they connect to a server that basically checks the validation, but then they can connect in between. I've set it up a couple of months ago, I like thr implementation, but it seems a bit too slow somehow.
- RealStickman_ 4y agoYes, you just need those certificate files and a config. All of that could probably be automated for easier deployment.
- LoveGracePeace 4y agoNot going to knock these solutions but at least for Tailscale, if I understand what I read on their web site correctly, I think it's built on Wireguard. I found Wireguard to be easy enough to configure and get working and I'm lazy and cheap. Since then, I run my web and email servers on an old laptop in my home and the Internet POP is a $3.50 VM plus $1 for a static IP, at AWS Lightsail. This works for me but if I needed to connect a disparate office and devices together I might look at Tailscale or one of these packaged solutions, or maybe not.
- dstanbro 4y agoyou can run netmaker in a lightsail VPS. Similar functionality / UI experience to tailscale but self-hosted
- LoveGracePeace 4y agoIt looks impressive.
- razemio 4y agoSadly not open source and their change notes are not yet production ready. Every release something breaks. I switched back to pure wireguard because of this. I also wouldn't call tailscale and netmakers ui comparable. Netmaker has far more options. Tailscale tries an apple approach by hiding almost everything but DNS.
- cassianoleal 4y ago> Sadly not open source Just to clarify this take, the source is available on Github [0] but licensed under the highly controversial Server Side Public License [1][2]. This license was originally written by MongoDB. They applied to get it recognised as an open source license with the OSI but later withdrew the application as it became clear it wouldn't have been approved. OSI explained in 2019 [3] why it didn't consider the license to be open source. [0] https://github.com/gravitl/netmaker https://github.com/gravitl/netmaker [1] https://github.com/gravitl/netmaker/blob/master/LICENSE.txt https://github.com/gravitl/netmaker/blob/master/LICENSE.txt [2] https://en.wikipedia.org/wiki/Server_Side_Public_License https://en.wikipedia.org/wiki/Server_Side_Public_License [3] https://opensource.org/node/1099 https://opensource.org/node/1099
- miyuru 4y agoThis is great, I was just thinking of a similar setup for the wireguard VPN I had created for work. We use multiple WG interfaces with its own IPv6 subnet for access control so will be keeping an eye on the following issue. https://github.com/firezone/firezone/issues/549 https://github.com/firezone/firezone/issues/549
- jamilbk 4y agoWe're actively working on this and expect to have it done for 0.4.0. You can track progress here: https://github.com/firezone/firezone/pull/653 https://github.com/firezone/firezone/pull/653
- goodguyamercunt 4y agoOn that note, Anyone got a way to get wireguard to work like speedify on a Linux client?
- dementik 4y agoI haven't but I have almost tried Zerotier multipath: https://docs.zerotier.com/zerotier/multipath/ https://docs.zerotier.com/zerotier/multipath/ If I understand correctly, it should do something what speedify does.
- evulhotdog 4y agoDepending on the use case you may be able to do something like ECMP. An example use case is here: https://blog.muthuraj.in/2020/06/high-throughput-site-to-site-vpn-using.html https://blog.muthuraj.in/2020/06/high-throughput-site-to-sit...
- jamilbk 4y agoHi everyone! Firezone CEO here. Someone just clued me into this thread. Unfortunately I’m in and out of Internet service today but I’ll do my best to answer questions. As noted by others, Firezone isn’t really aiming to be a mesh networking tool like Tailscale, but more of a classic east-west VPN similar to OpenVPN Access Server. We also expose simple controls for managing egress firewall rules. We have a big release planned next week to bring OIDC auth and the ability to manage multiple WireGuard networks, plus Docker support and more firewall + multisite features in the pipeline for later this summer. We have a one-line install script for Linux at our repo if you’d like to give it a whirl! Grateful for any and all feedback. https://github.com/firezone/firezone https://github.com/firezone/firezone
- loudthing 4y agoThanks for posting. What are the use cases for Firezone exactly? Is the intention to simplify networking configuration in data centers? (as opposed to the zero config nature of Tailscale devices that could be anywhere on the internet?)
- KennyBlanken 4y ago> We also expose simple controls for managing egress firewall rules. Unless user-tracking telemetry is blocked, in which case, apparently your CLI tools stop working? https://news.ycombinator.com/item?id=31542047 https://news.ycombinator.com/item?id=31542047 Edit: dunno if that comment was deleted because the author was wrong about their PiHole blocking telemetry causing commands to fail, if they were harassed into deleting it, or what. I guess I'll give you the benefit of the doubt that there was something else going on with their network that caused commands to fail, but you're still getting side-eye for engaging in telemetry/usage tracking.
- SadTrombone 4y agoThe post you're linking to seems to have been deleted.
- xanaxagoras 4y agoHi, I deleted that post because it had something in it I didn't want forever recorded on the internet. Nobody harassed me and I wasn't wrong. One of my pihole blocklists includes telemetry.* which matches some network call made by the command you run to update the Firezone config. Pihole returns "0.0.0.0" for hostnames it blocks and the error that's raised ends up coming form openssl. Later I discovered there are 2 options at the bottom of the /etc/firezone/firezone.rb config file, commented out, that allow you to disable the telemetry. With these options turned on the error no longer occurs.
- loeg 4y ago@dang Seems like the headline is somewhat editorialized -- can we get "Tailscale Alternative" removed?
- deleted 4y ago[deleted]
- dang 4y agoAll: the submitted title ("FireZone – Tailscale Alternative – The Open Source VPN Server and Firewall") broke the site guidelines by editorializing. "Please use the original title, unless it is misleading or linkbait; don't editorialize." - https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html As complaining commenters and the project creator agree, this is not a Tailscale alternative. Please don't do that! This was a case study on how small title perturbations end up dominating entire threads.
- squarefoot 4y agoHow does it compare to BSD based firewalls such as OpnSense and pfSense? They're both great products, but support for ARM and 802.11ac doesn't seem ready yet.
- blangk 4y agopfSense is still a great product in 2022? I had heard otherwise.
- squarefoot 4y agoAfter reading around a bit it appears you're right; thanks for the correction. I used pfSense some years ago to full satisfaction and always thought the reasons for the fork leading to OpnSense were motivated only by licensing issues, but apparently there are also technical reasons for choosing OpnSense over pfSense.