4 ms·

> [only for..] requests coming in over the tailnet Well, that's certainly different from "all TCP port 22 packets" - I suppose some emphasis should be on "afte

by e12e 4y ago

> [only for..] requests coming in over the tailnet Well, that's certainly different from "all TCP port 22 packets" - I suppose some emphasis should be on "after the WireGuard decryption" (ie: over the wireguard interface). It's not entirely clear from the comment (but probably clear to engineers working on the tailscale code). I read it as if tailscale snapped up packets before the kernel from (all) network interfaces...

tptacek 4y ago
How could it possibly work otherwise? Tailscale owns the WireGuard connection, so it gets raw packets from WireGuard before the kernel.
- e12e 4y ago
  It could work like a full userspace network stack, getting the packets on the wire before (instead of) the kernel (network stack)?
  - tptacek 4y ago
    How? (I can think of ways, and they're all horrible).
    - e12e 4y ago
      The fact that all the ways are horrible is indeed why I was so surprised to (mis)read tailscale as having such capabilities... I'm happy I misunderstood.