17 ms·

Tailscale ate my network (and I love it)

273 points by smackeyacky 4y ago

atonse 4y ago
Huge fan of Tailscale here too. They solved every single complaint I had with using WireGuard (provisioning, key exchange, IP assignment, ACLs, etc.) and did it in a splendid and elegant tool that just disappears. One of the few products I recommend enthusiastically. To be clear, WireGuard seemed to have the right level of abstraction as a tool for others to build on (just like it built on top of the noise framework), and someone like Tailscale ran with it.
- colordrops 4y ago
  The main reason I use wireguard on my personal network is to keep 3rd party clouds out of it. My understanding is that a closed source node that phones home is part of their solution. For my personal case, this is a total no-go.
  - Operyl 4y ago
    It's worth noting that the Tailscale client is, almost entirely, open source. It's just the iOS/macOS/Windows client code that's closed source (just GUI wrapping it), iirc[0]. The DERP code is also open source. Additionally, there's an open source reimplementation of the control plane called headscale, as well. The Tailscale team has complimented it, but of course it's all on your own if you choose to run it.[1] [0] https://github.com/tailscale/tailscale https://github.com/tailscale/tailscale [1] https://github.com/juanfont/headscale https://github.com/juanfont/headscale EDIT: Android code is actually entirely open, oops!
    - ngcc_hk 4y ago
      Wonder why those are closed source if just gui wrapping.
      - sneak 4y ago
        Well, you can't sometimes or halfway be committed to software freedom, so it's because they only open sourced the other parts for marketing.
      - Tostino 4y ago
        To make it harder for a competitor to pop up and offer their own flavor of the binaries and support. It's just to raise the barrier of entry to others monetizing your project
      - danielheath 4y ago
        Maybe because nobody on iOS/macOS/Windows cares if there's closed source code running on their machine.
        rollcat 4y ago
        I do, and wherever all other things are equal, I always choose an open source solution. But if all other things were always equal, I'd be running OpenBSD full time, so...
        cynix 4y ago
        Being open source is not as useful on iOS though, since there’s no way to verify that what they uploaded to the App Store was actually built from the source that you can see.
        rollcat 4y ago
        How often do you rebuild your system and verify all checksums? What's your threat model?
        cynix 4y ago
        The point was that you _could_ verify whether a binary package matches the source if you wanted to on other platforms, not that you _have to_ do it all the time. With iOS you don’t have that ability so you’d have to have complete trust in the developers. The threat model is someone publishing innocent source code but sneaking in something malicious in the version they publish on the App Store, of course.
  - thejosh 4y ago
    Wireguard is absolutely fantastic for a small network, when you know what you're doing. It's dead easy to setup and configure, you forward some ports, and boom you have a shared network. I couldn't believe how easy it is to configure. I set it up for work, do a key rotation on a schedule and it's great. Tailscale I use for home use on my personal laptop + machines and it's fantastic as I don't need to port forward or anything. I changed over from using Wireguard with minimal effort, just changing some IPs over. Probably end up using MagicDNS (their DNS solution), then if I need to change off I'll just change this. Their free tier is very generous for a single user.
    - pkulak 4y ago
      My problem is that Wireguard alone works too well. Years ago I got it all set up, forwarded the one port, and it’s been perfect ever since. I really want an excuse to try Tailscale. Some day. Haha
      - cpuguy83 4y ago
        Excuse is no need to do port forwards.
        oynqr 4y ago
        Having a VPS in the mix removes that hassle.
- deleted 4y ago
  [deleted]
- onelovetwo 4y ago
  Is this a replacement for something like Mullvad?
  - linsomniac 4y ago
    No. Mullvad is VPN to the Internet, Tailscale is a VPN among your own machines.
metadat 4y ago
I love tailscale, too. Also, I read this article before it had any upvotes and learned absolutely nothing new or insightful. Wish the author had kept going.
- smackeyacky 4y ago
  It was news to me that Tailscale allowed DNS lookups for particular domains to hit specific resolvers and those resolvers would serve up the internal VPC address, so you need nothing except a subnet router inside the VPC to be working against your secured AWS resources. It means that you can close all the open ports on your VPC security groups without changing the configuration of how your external systems access the internal AWS services. It was probably obvious to everybody else, but after I worked that out, Tailscale became my network.
  - metadat 4y ago
    Magic DNS is a fucking nightmare behind the scenes, I just use raw dog IPs to KISS. The TS app makes it easy to copy to clipboard. See: https://lobste.rs/s/v4obi8/how_does_tailscale_s_magicdns_work https://lobste.rs/s/v4obi8/how_does_tailscale_s_magicdns_wor... I also set custom hosts file entries for non-mobile devices and kablam, no magic needed (for personal use, anyhow).
    - aidos 4y ago
      Behind the scenes they’ve obviously got a lot of crazy to deal with, but it seems to work well from the outside (just using it for Tailscale lookups, at least). Have you had issues with it otherwise? EDIT actually I do have one gotcha. There’s a switch in the admin panel to override real dns. In theory if you changed that option and your machines were currently using private dns on route53 to find each other you might be in trouble (don’t ask me how I know).
      - metadat 4y ago
        There is no open-source equivalent implementation available for the PITA that is Magic DNS, so I don't use it. This ensures that if Tailscale goes rogue, I can replace it as easily as possible.
tomrod 4y ago
What is tailscale doing, exactly? They bill themselves as a VPN, but honestly I'm really a newb with networking (tend to be more on the data engineer/science side).
- barkingcat 4y ago
  Tailscale provides a virtual private network (VPN) - in the old school definition - the network is private to your own devices/network. You use it to connect your home network for example, on your laptop when you are out and about. Any internet routing is purely done by your own isp provider (if you chose to tunnel internet traffic through tailscale) Behind the scenes, it uses WireGuard which provides the vpn tunnel to your own network. Tailscale also provides an authentication layer (ie username/login/passwords)
  - tomrod 4y ago
    Thanks!
  - thejosh 4y ago
    Wireguard isn't a chatty protocol, and uses very minimal. You can use it on a spotty connection and your internet will go through that.
  - mkl 4y ago
    > Tailscale also provides an authentication layer (ie username/login/passwords) Unless I'm misunderstanding you, I don't think it does (having to use a a third party to sign in is one of the main reasons I haven't tried it yet). From https://tailscale.com/kb/1013/sso-providers/ https://tailscale.com/kb/1013/sso-providers/: "Tailscale never handles authentication itself."
hlieberman 4y ago
I've never used Tailscale, but I want to highlight specifically for working with AWS, you could consider using AWS Systems Manager to access machines that are in private VPCs[1][2]. This has the advantage of reusing the same credentials used already for AWS, as well as being able to further restrict exactly what can be done with them. [1]: https://aws.amazon.com/premiumsupport/knowledge-center/systems-manager-ssh-vpc-resources/ https://aws.amazon.com/premiumsupport/knowledge-center/syste... [2]: https://medium.com/hackernoon/ditch-your-ssh-keys-and-enable-aws-ssm-ec1c2b27350c https://medium.com/hackernoon/ditch-your-ssh-keys-and-enable...
- danenania 4y ago
  You can also use AWS Client VPN. It’s not as user-friendly as tailscale, and probably more expensive(?), but it works well enough. It’s also pretty easy to provision with IaC—not sure if that’s the case for tailscale?
  - thedougd 4y ago
    I'm currently evaluating Tailscale and other VPN solutions as AWS Client VPN doesn't look like it's going to work for us. AWS Client VPN does not offer any means of unattended configuration or mass distribution. All they offer is a self service portal from which you can download the installable, the profile, and directions. Each use has to manually import the profile into their client. I'm stunned they're missing this as it would prevent any sizable organization from adopting it.
    - danenania 4y ago
      Yeah it’s not ideal. It’s nice not to have to run any kind of agent, and to use IAM for access control (not that IAM is so wonderful, but it plugs in easily). I agree though it could be much smoother.
- Hawxy 4y ago
  There's also a new port forwarding parameter on session manager so you can easily connect to a private RDS via a bastion host. https://aws.amazon.com/about-aws/whats-new/2022/05/aws-systems-manager-support-port-forwarding-remote-hosts-using-session-manager/ https://aws.amazon.com/about-aws/whats-new/2022/05/aws-syste... https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-sessions-start.html#sessions-remote-port-forwarding https://docs.aws.amazon.com/systems-manager/latest/userguide...
polishdude20 4y ago
What's the difference between using tailscale vs the AWS VPN?
- LilBytes 4y ago
  The AWS VPN, client and site to site is tedious to set up. Taildcale on the other hand couldn't be easier.
- tonyarkles 4y ago
  I’ve never used the AWS VPN, but the Tailscale VPN but the two things they’ve gotten right for me are: - it has been unnoticeably reliable. We were early-ish adopters right as COVID hit; we’re a hardware company and have it on a handful of very remote devices/sporadic power and LTE devices as well as our development machines. The ARM binary _just worked_ on the embedded kit and I often remote in even while the payload is being flown. Automatically picks up right away when in network range, and I don’t ever wonder if I’m going to be able to connect to something - it’s wonderfully simple to set up. Download the client, sign in using your org’s SSO (or personal email, but that’s for _only you_ and you can’t share with other users), and your machine just magically joins the network, gets assigned a fixed IP, and you’re on the network with everyone else.
  - barkingcat 4y ago
    yes to the unnoticeably reliable part. during the covid shutdown I had to spend long periods of time away from my apartment (I decided to lock down with my family 3000km away from where I lived alone) I had only a small window of time to set up some kind of tunnel back to my apt/set up some kind of remote access. I just installed tailscale on an old mac mini, connected a dinky spare usb webcam, and started photobooth just as I had to leave to catch one of the few flights that hadn't been cancelled due to lockdowns and restrictions. It worked awesome. I could remote in, use the mac to access my backup hard drive, and watch the photobooth camera. The only thing I didn't forsee was the webcam was useless during the night cause I didn't leave a light on so photobooth would just show me a black screen. During the day though, the camera showed me my worldly possessions and helped me monitor my apartment so in case anything happened I could call the superintendant of my apartment. It worked really well, and worked for 3 months until the connection died. I only had 1 month left so I left it alone. 4 months after leaving my apartment, I went back and found out the mac mini suffered from hardware failure (would no longer power on), so the tailscale vpn worked and was more reliable/more solid than the hardware it was running on. After that experience, I am sold on tailscale. They're awesome.
aborsy 4y ago
How about the old solution of devices connecting to an access VPN running on a nearby AWS VPS? I have my private network right now. As a plus, devices can make direct connection when they are in restrictive corporate networks (allowing only 443/tcp). Less third parties involved. Seems more secure for personal use. Sure, it’s not a mesh network, but that doesn’t matter if VPS and devices are in the same region. But I get that mesh VPN products can be valuable to small businesses: ease of use, ACLs, SSO, central management.
- smackeyacky 4y ago
  There is nothing wrong with a direct VPN, but Tailscale makes them look hard to configure and you don't get the magical DNS stuff they provide.
- dvzk 4y ago
  Custom peer to peer networks over Wireguard are theoretically more secure. A list of additional potential adversaries who can remotely access your Tailscale network without client manipulation: - Tailscale’s coordination server - Tailscale’s cloud provider - anyone who compromises the coordination server - SSO provider you have chosen - SSO’s cloud provider - anyone who compromises the SSO provider
skybrian 4y ago
It seems like any code running in your browser or on your local machine has access to your home network, which was always true, but now your "home network" includes machines in multiple locations, including AWS.
- xlii 4y ago
  That’s a very interesting perspective and I wonder if that will change attack vector. One reason to have gateways etc. was to ensure that gateway couldn’t be taken over by software installs etc. Access was inconvenient but it was somewhat by design. Maybe due to this attack vector shifted from directed access to automatic scanning of ever expanding vulnerabilities. Now, as services stops being accessible from external networks once again they can be accessed in convenient ways thus bringing the old vectors back. Sometimes even giving false sense of security.
- wmf 4y ago
  Tailscale has ACLs and then beyond VPNs there's zero trust and BeyondCorp.
mfrw 4y ago
I organically grew my tailscale network and with the recent `tailscale ssh`[0] it has turned my life around. I have no open ports to anything & be it my personal machine in the depths of my closet or stuff on the cloud; everything is seamless connected. [0]: https://tailscale.com/tailscale-ssh/ https://tailscale.com/tailscale-ssh/
- dawson 4y ago
  For those still using SSH as normal, you can setup Tailscale to accept connections only from Tailscale, and ignore any public internet traffic i.e., restrict ssh access to be only over Tailscale. For example, with UFW you could delete every rule except for the “Anywhere on tailscale0” and “41641/udp” rules.
  - mfrw 4y ago
    Exactly how it `turned my life around`. I can now go to sleep without having to worry about random bots trying to mine crypto on my machines. To add to the goodness, one does not have to worry about either SSH-keys or remember cryptic passwords.
    - withinboredom 4y ago
      This seems like a ... strange ... comment. Do you usually worry about your ssh keys getting stolen? How do you use git? FWIW, setting up something like tailscale is remarkably simple (I'm using PHP here to keep it simple): In sshd_config: AuthorizedKeysCommand /auth_ssh %u AuthorizedKeysCommandUser nobody And in auth_ssh, verify that the user is allowed to connect to that server, then look it up on github (my public keys: https://github.com/withinboredom.keys https://github.com/withinboredom.keys). If you want to allow any github user you allow to connect various permissions, check out libnss-ato. These are all 1 or 2 lines of configuration and are not hard. You just have to know they exist.
      - mfrw 4y ago
        Thank you for the pointers. Honestly, I had no idea about what you pointed out. Regarding the strangeness; yes I was lazy and had password based ssh and was in constant fear that someone might pop my box.
simongray 4y ago
I recently set up Tailscale, but unfortunately the phone app leaves a lot to be desired battery-wise (it takes up 30% of my total battery usage) so I think I'll be looking elsewhere. Initially, I had tried setting up Nebula, but I am unable to get a static IP address for the beacon (a requirement for any of these mesh VPNs), hence why I went with Tailscale which acts as a beacon for you. I think I'll try ZeroTier next.
- yoru-sulfur 4y ago
  30% seems way _way_ higher than I would expect. I've been running Tailscale on all my devices for a couple months now, and I haven't noticed any impact on battery life. I just checked my phone (Android) and it's reporting 1% usage. I would report an issue if you're seeing numbers that high.
  - metadat 4y ago
    I only activate it when I actually need to use it. I don't like running any phone apps in the background, they always suck juice.
  - simongray 4y ago
    I use an iPhone. If you google it, you will notice that lots of people have this issue and have had for a long time. - https://www.reddit.com/r/Tailscale/comments/pm49t9/tailscale_using_too_much_batter_on_ios_ipados/ https://www.reddit.com/r/Tailscale/comments/pm49t9/tailscale... - https://forum.tailscale.com/t/high-battery-usage-in-ios/1152 https://forum.tailscale.com/t/high-battery-usage-in-ios/1152 - https://github.com/tailscale/tailscale/issues/3363 https://github.com/tailscale/tailscale/issues/3363
    - sph 4y ago
      Weird, 4% on my iPhone. It's always on, though I don't make a lot of connections through it
      - MaxLeiter 4y ago
ListenLinda 4y ago
It does seem like a great solution but we've shied away from it because the price. For an enterprise you need the business license. Something like OpenVPN Cloud I think is 1/3 the price.
- metadat 4y ago
  That's reasonable, and OpenVPN is ~1/10th the performance.
gigatexal 4y ago
But since it’s user space aren’t you leaving a ton of performance on the table?
- senorsmile 4y ago
  This is one of the sell ng points of netmaker, besides three fact that it's all open source.
  - gigatexal 4y ago
    Very cool! I’ve found my new weekend project. Thank you!
jalino23 4y ago
is tailscale like forticlient vpn ? so I can ssh into my instance that is not exposed into the world? so my instances can talk to each other without going through the public internet?
- jgeralnik 4y ago
  Tailscale can punch through NAT but requires outgoing internet access
unnouinceput 4y ago
Quote: "In the "before tailscale" times, if I needed to test against the production AWS resources or connect dBeaver for database maintenance, I would edit the security group to add my IP address, do my testing, edit the security group to remove myself. This is as error prone as it sounds. I quite often forgot to remove my IP address from the allowed addresses, a major potential security risk when you are travelling." My takeaway from this is that the author was either lazy or lacked the knowledge to create an automation script that could've done that automatically (the add/remove) based on location. If that's the whole reason for this tailscale praise, kinda of takes away the tailscail actual usefulness and why it exists in first place.
- smackeyacky 4y ago
  Author here. Yep, I'm lazy and a cheapskate, so using the built-in AWS solution I thought was too expensive for something I only did occasionally. 99% of the time I'm hooked up to my test system rather than production (as it should be).
tandav 4y ago
I my experience for purpose of home server which should be accessible for everyone, cloudflare tunnels are better, because tailscale solutions require every client to install their app to use the network. It is not convenient if you want to share some webserver with your friend and just send him a link.
- moontear 4y ago
  True, but that is also not what Tailscale is for - tailscale would be me comparable to Cloudflare Access instead of their tunnels.
- dahnhiller 4y ago
  Tailscale has this in beta at the moment https://tailscale.com/kb/1084/sharing/ https://tailscale.com/kb/1084/sharing/
sschueller 4y ago
Can someone comment on how safe/secure tailscale is? I am not talking about the wireguard part but the closed source part and the company.
- danielheath 4y ago
  > the closed source part P2P client: On iOS/windows/macos it doesn't make sense to complain about closed source code running on your machine; on linux/bsd/android the client is open source. Control plane: A compatible open source server is available & you can self host; the tailscale-hosted control plane is closed source and could, in theory, instruct your devices to connect to additional peers. > and the company The company has several high-profile employees with excellent reputations, which is typically a good sign of legitimacy.
  - bigiain 4y ago
    > The company has several high-profile employees with excellent reputations, which is typically a good sign of legitimacy. I’m sure people said that about Larry and Sergey back in the day…
    - dewey 4y ago
      People don't talk about Google not being a legitimate or unsafe company. Issues with customer support? Sure. Issues with shutting down some products HN loves? Sure. Getting hacked or being insecure? No, in fact they probably have one of the leading security teams (Project Zero) in the industry.
    - danielheath 4y ago
      Nothing lasts forever, but very little changes overnight either. If you're paying attention, you can watch the arc of growth and decay in many places.
- ratg13 4y ago
  Don't connect your GitHub account to it. I made the mistake of doing this, it seemed to be working fine, and then all of a sudden to add a new node it needed access to my company's GitHub repositories in order to continue. (no way to continue without accepting) So I could either give them access to sensitive company information, or remove my github account from my company, neither of which I wanted to do. I just stopped using TailScale, I've been meaning to set it up again with a different login, but the experience left a bad taste in my mouth.
YarickR2 4y ago
Why does this read like a thinly veiled native ad ?
- dncornholio 4y ago
  So do most of the comments!
moontear 4y ago
Shoutout to ZeroTier, Nebula which essentially do the same thing. Or Netmaker if you wanna go complete open source/self hosted.
- jbverschoor 4y ago
  Zerotier works at a lower level. This means you can do other protocols than tcp/ip
  - anotherhue 4y ago
    I don't think that's correct, they both expose TUN/TAP devices so should be equivalent in their encapsulation abilities. I use both regularly. https://en.wikipedia.org/wiki/TUN/TAP https://en.wikipedia.org/wiki/TUN/TAP
    - FL410 4y ago
      It is correct because a TUN interface is not the same as a TAP interface. The latter is layer 2.
  - akvadrako 4y ago
    Tailscale can do UDP also.
    - linsomniac 4y ago
      "TCP/IP" means TCP, IP, and UDP. ZeroTier can do other protocols like NetBIOS, so you can use it to run LAN games that don't use TCP/IP.
      - deleted 4y ago
        [deleted]
- rcarmo 4y ago
  I tried ZeroTier in the past, and it was great, but didn't have an iOS app. Do any of those do?
spapas82 4y ago
Tailscale seems to dominate the hn front page. I've written an ask hn about that and I'd like some honest opinions: https://news.ycombinator.com/item?id=31957059 https://news.ycombinator.com/item?id=31957059
deanc 4y ago
I consider myself relatively technical as a software engineer, but networking isn't my forte. I still don't understand the documentation about bringing in my other devices that don't have clients. I'd like to be able to have access to homekit while out and about on 5g for example - via tailscale.
- smackeyacky 4y ago
  Set up a tailscale subnet router on your home network, it can share access to clients not running tailscale. I've used that to access a bluetooth router that I didn't install tailscale on.
  - deanc 4y ago
    Yes I'm aware [1]. I would not describe these steps as user-friendly. [1] https://tailscale.com/kb/1019/subnets/ https://tailscale.com/kb/1019/subnets/
    - smackeyacky 4y ago
      Those instructions are a bit over-egged. All you need is sudo tailscale up --advertise-routes=10.0.0.0/24,10.0.1.0/24 Then you can get to anything via it's internal IP address. I have a bluetooth router on my network that I don't want to install Tailscale on. It's on a permanent address of 192.168.1.13 I do this on the router inside my office subnet: sudo tailscale up --advertise-routes=192.168.1.0/24 I do this on my home debian machine (lets say it's on 10.1.1.13): sudo tailscale up --accept-routes From my home network I can now open the web management page on 192.168.1.13. You can go further with DNS stuff but you don't have to.
rcarmo 4y ago
I use Tailscale as well for my personal stuff (services in various clouds, remote gateway when I'm away from home, etc.) but as someone who defines best practices for enterprise cloud deployments I have a nagging worry about other people using it in work environments as a way to circumvent security guardrails. That said, I love it and use it extensively from my iPad to work on a personal Gnome desktop via RDP.
janci 4y ago
Tailscale seems like a great product however I do not want 3rd party to be able to add a key to my ACL. Running a custom control plane server is possible, but then there is little benefit for me compared to direct wireguard with a central peer on a VPS. If it would be possible to use just the NAT traversal without key management, that would be it! Curretly I am running a tiny VPS as a wireguard server, but I do not trust it to be part of my network. Therfore I run one wireguard tunnel to be able to access my router (has no public ip) and second tunnel inside the first to connect through the router to my home network. Theoretically, it should be possi le with single wireguard tunnel if I set a route to home router via wireguard gateway - but I never managed to make wireguard encrypt a packet if it came from the same wg interface. Can anybody help?
- imdsm 4y ago
  I think Tailscale have the right approach by knowing their customer — someone who is happy to have a trusted 3rd party administer parts of their VPN in return for time and cost saving. There are a few here who can't have that, so they instead invest their time into a custom setup with WireGuard which is fine, but for those of us who don't require that level of assurance (there are bigger attack vectors to worry about), Tailscale is fantastic. Quick, easy, and mostly works out of the box.
Kab1r 4y ago
I use both tailscale and cloudflare access and found tailscale is easier to deploy however cloudflare access also has tunneling which is pretty useful.
- ratg13 4y ago
  Do you not consider a VPN a tunnel?
  - Kab1r 4y ago
    I mean Cloudflare's public facing tunnel solution. Of course VPNs are also a form of tunneling, but as far as I am aware tailscale doesn't have a public facing solution.
madjam002 4y ago
To add to the OP’s article, Tailscale can map IPv4 to IPv6 addresses when using subnet routers. Imo this is incredibly handy, as if I want to expose a device to my Tailscale network, I don’t want to have to think about finding an IP address range that won’t conflict with the various local network ranges that my Tailscale devices are on. Especially if you’re using Tailscale in various corporate environments where 10.0.0.0/8 is used a lot. Now I can just expose e.g 192.168.122.0/24 to my Tailscale network but it’s exposed as a unique IPv6 /120 prefix. https://tailscale.com/kb/1201/4via6-subnets/ https://tailscale.com/kb/1201/4via6-subnets/
truth_seeker 4y ago
why not just use ssh tunnels with compression ON when you connect to RDS?
pvsukale3 4y ago
I wish I had Tailscale when I was playing LAN games in college. Spent a lot of time debugging around network issues.
- Tsiklon 4y ago
  I hadn’t even considered this, this can be used as a modern replacement for hamachi in this particular scenario!
majodev 4y ago
I really love tailscale for my private network. Nevertheless, I still hope they will revisit support for proper linux kernel wireguard sometime in the near future. This would allow to ditch separate meshing technologies for connecting server nodes (and routing into separate subnets via a tailscale subrouter node). Best of both worlds - ease of use and performance. I really only started to have a look at other tools (like netmaker, netbird, innernet, wesher) because of these performance caveats (wireguard-go). https://github.com/tailscale/tailscale/issues/426 https://github.com/tailscale/tailscale/issues/426
- 5e92cb50239222b 4y ago
  netbird is a good alternative that has significantly better NAT punching (at least on my network), going through 2-3 layers of NAT just fine. The problem with it is although it does support kernel WireGuard, it works only if both nodes are on the same subnet, or if one of them has a public IP (port forwarding doesn't work, it needs a public IP). Otherwise, it creates a tunnel through NAT (using WebRTC's ICE) and then routes data from the WireGuard interface through that tunnel. This involves copying data multiple times (application → kernel → wireguard → netbird client (userspace) → kernel → network). So unless you're fine with that limitation, look elsewhere for now.
  - majodev 4y ago
    I really tried to like netbird, but their current hard dependency on auth0 (also when selfhosting) unfortuantly put me off. Your statements regarding NAT punching are on the other hand very interesting. I'm currently trying out innernet, mostly for the interconnected server nodes (k8s, not for actual real users). Seems to work fine (double NAT + single public coordination server). Unrelated to Wireguard: I really liked Nebulas certificate-based client setup and its reduntant lighthouses (public coordination servers). May be an alternative if you want something at least a little faster than wireguard-go based implementations.
fancyfish 4y ago
Tailscale has been a godsend for my team, saving us quite a bit of effort with VPN/firewall administration. There are very few rough edges, and it tends to just work (at least at our scale of a few thousand nodes). We moved over about 8 months ago and have had no issues since. I’ve also moved my home network (RPis, NAS, etc) to their free tier so I can access it remotely. Some features that are basically effortless and made me choose it over WireGuard and other VPN solutions: easy provisioning, key exchange, IP assignment, ACLs
riekus 4y ago
Have setup tailscale and pretty happy with it, yesterday enabled TLS so my host have https pretty easy with caddy and reverse oroxy, problem is you can't use subdomains, so every host can only forward one https connection. My main server host several selfhosted services and want them all over https. Have googled an question open at caddy and tailscale forum, anyone here know what route to take?
balaa 4y ago

273 points by smackeyacky 4y ago

Huge fan of Tailscale here too. They solved every single complaint I had with using WireGuard (provisioning, key exchange, IP assignment, ACLs, etc.) and did it in a splendid and elegant tool that just disappears. One of the few products I recommend enthusiastically. To be clear, WireGuard seemed to have the right level of abstraction as a tool for others to build on (just like it built on top of the noise framework), and someone like Tailscale ran with it.

colordrops 4y ago
The main reason I use wireguard on my personal network is to keep 3rd party clouds out of it. My understanding is that a closed source node that phones home is part of their solution. For my personal case, this is a total no-go.
- Operyl 4y ago
  It's worth noting that the Tailscale client is, almost entirely, open source. It's just the iOS/macOS/Windows client code that's closed source (just GUI wrapping it), iirc[0]. The DERP code is also open source. Additionally, there's an open source reimplementation of the control plane called headscale, as well. The Tailscale team has complimented it, but of course it's all on your own if you choose to run it.[1] [0] https://github.com/tailscale/tailscale https://github.com/tailscale/tailscale [1] https://github.com/juanfont/headscale https://github.com/juanfont/headscale EDIT: Android code is actually entirely open, oops!
  - ngcc_hk 4y ago
    Wonder why those are closed source if just gui wrapping.
    - sneak 4y ago
      Well, you can't sometimes or halfway be committed to software freedom, so it's because they only open sourced the other parts for marketing.
    - Tostino 4y ago
      To make it harder for a competitor to pop up and offer their own flavor of the binaries and support. It's just to raise the barrier of entry to others monetizing your project
    - danielheath 4y ago
      Maybe because nobody on iOS/macOS/Windows cares if there's closed source code running on their machine.
      - rollcat 4y ago
        I do, and wherever all other things are equal, I always choose an open source solution. But if all other things were always equal, I'd be running OpenBSD full time, so...
        cynix 4y ago
        Being open source is not as useful on iOS though, since there’s no way to verify that what they uploaded to the App Store was actually built from the source that you can see.
        rollcat 4y ago
        How often do you rebuild your system and verify all checksums? What's your threat model?
        cynix 4y ago
        The point was that you _could_ verify whether a binary package matches the source if you wanted to on other platforms, not that you _have to_ do it all the time. With iOS you don’t have that ability so you’d have to have complete trust in the developers. The threat model is someone publishing innocent source code but sneaking in something malicious in the version they publish on the App Store, of course.
- thejosh 4y ago
  Wireguard is absolutely fantastic for a small network, when you know what you're doing. It's dead easy to setup and configure, you forward some ports, and boom you have a shared network. I couldn't believe how easy it is to configure. I set it up for work, do a key rotation on a schedule and it's great. Tailscale I use for home use on my personal laptop + machines and it's fantastic as I don't need to port forward or anything. I changed over from using Wireguard with minimal effort, just changing some IPs over. Probably end up using MagicDNS (their DNS solution), then if I need to change off I'll just change this. Their free tier is very generous for a single user.
  - pkulak 4y ago
    My problem is that Wireguard alone works too well. Years ago I got it all set up, forwarded the one port, and it’s been perfect ever since. I really want an excuse to try Tailscale. Some day. Haha
    - cpuguy83 4y ago
      Excuse is no need to do port forwards.
      - oynqr 4y ago
        Having a VPS in the mix removes that hassle.
deleted 4y ago
[deleted]
onelovetwo 4y ago
Is this a replacement for something like Mullvad?
- linsomniac 4y ago
  No. Mullvad is VPN to the Internet, Tailscale is a VPN among your own machines.

metadat 4y ago

I love tailscale, too. Also, I read this article before it had any upvotes and learned absolutely nothing new or insightful. Wish the author had kept going.

smackeyacky 4y ago
It was news to me that Tailscale allowed DNS lookups for particular domains to hit specific resolvers and those resolvers would serve up the internal VPC address, so you need nothing except a subnet router inside the VPC to be working against your secured AWS resources. It means that you can close all the open ports on your VPC security groups without changing the configuration of how your external systems access the internal AWS services. It was probably obvious to everybody else, but after I worked that out, Tailscale became my network.
- metadat 4y ago
  Magic DNS is a fucking nightmare behind the scenes, I just use raw dog IPs to KISS. The TS app makes it easy to copy to clipboard. See: https://lobste.rs/s/v4obi8/how_does_tailscale_s_magicdns_work https://lobste.rs/s/v4obi8/how_does_tailscale_s_magicdns_wor... I also set custom hosts file entries for non-mobile devices and kablam, no magic needed (for personal use, anyhow).
  - aidos 4y ago
    Behind the scenes they’ve obviously got a lot of crazy to deal with, but it seems to work well from the outside (just using it for Tailscale lookups, at least). Have you had issues with it otherwise? EDIT actually I do have one gotcha. There’s a switch in the admin panel to override real dns. In theory if you changed that option and your machines were currently using private dns on route53 to find each other you might be in trouble (don’t ask me how I know).
    - metadat 4y ago
      There is no open-source equivalent implementation available for the PITA that is Magic DNS, so I don't use it. This ensures that if Tailscale goes rogue, I can replace it as easily as possible.

tomrod 4y ago

What is tailscale doing, exactly? They bill themselves as a VPN, but honestly I'm really a newb with networking (tend to be more on the data engineer/science side).

barkingcat 4y ago
Tailscale provides a virtual private network (VPN) - in the old school definition - the network is private to your own devices/network. You use it to connect your home network for example, on your laptop when you are out and about. Any internet routing is purely done by your own isp provider (if you chose to tunnel internet traffic through tailscale) Behind the scenes, it uses WireGuard which provides the vpn tunnel to your own network. Tailscale also provides an authentication layer (ie username/login/passwords)
- tomrod 4y ago
  Thanks!
- thejosh 4y ago
  Wireguard isn't a chatty protocol, and uses very minimal. You can use it on a spotty connection and your internet will go through that.
- mkl 4y ago
  > Tailscale also provides an authentication layer (ie username/login/passwords) Unless I'm misunderstanding you, I don't think it does (having to use a a third party to sign in is one of the main reasons I haven't tried it yet). From https://tailscale.com/kb/1013/sso-providers/ https://tailscale.com/kb/1013/sso-providers/: "Tailscale never handles authentication itself."

hlieberman 4y ago

I've never used Tailscale, but I want to highlight specifically for working with AWS, you could consider using AWS Systems Manager to access machines that are in private VPCs[1][2]. This has the advantage of reusing the same credentials used already for AWS, as well as being able to further restrict exactly what can be done with them. [1]: https://aws.amazon.com/premiumsupport/knowledge-center/systems-manager-ssh-vpc-resources/ https://aws.amazon.com/premiumsupport/knowledge-center/syste... [2]: https://medium.com/hackernoon/ditch-your-ssh-keys-and-enable-aws-ssm-ec1c2b27350c https://medium.com/hackernoon/ditch-your-ssh-keys-and-enable...

danenania 4y ago
You can also use AWS Client VPN. It’s not as user-friendly as tailscale, and probably more expensive(?), but it works well enough. It’s also pretty easy to provision with IaC—not sure if that’s the case for tailscale?
- thedougd 4y ago
  I'm currently evaluating Tailscale and other VPN solutions as AWS Client VPN doesn't look like it's going to work for us. AWS Client VPN does not offer any means of unattended configuration or mass distribution. All they offer is a self service portal from which you can download the installable, the profile, and directions. Each use has to manually import the profile into their client. I'm stunned they're missing this as it would prevent any sizable organization from adopting it.
  - danenania 4y ago
    Yeah it’s not ideal. It’s nice not to have to run any kind of agent, and to use IAM for access control (not that IAM is so wonderful, but it plugs in easily). I agree though it could be much smoother.
Hawxy 4y ago
There's also a new port forwarding parameter on session manager so you can easily connect to a private RDS via a bastion host. https://aws.amazon.com/about-aws/whats-new/2022/05/aws-systems-manager-support-port-forwarding-remote-hosts-using-session-manager/ https://aws.amazon.com/about-aws/whats-new/2022/05/aws-syste... https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-sessions-start.html#sessions-remote-port-forwarding https://docs.aws.amazon.com/systems-manager/latest/userguide...

polishdude20 4y ago

What's the difference between using tailscale vs the AWS VPN?

LilBytes 4y ago
The AWS VPN, client and site to site is tedious to set up. Taildcale on the other hand couldn't be easier.
tonyarkles 4y ago
I’ve never used the AWS VPN, but the Tailscale VPN but the two things they’ve gotten right for me are: - it has been unnoticeably reliable. We were early-ish adopters right as COVID hit; we’re a hardware company and have it on a handful of very remote devices/sporadic power and LTE devices as well as our development machines. The ARM binary _just worked_ on the embedded kit and I often remote in even while the payload is being flown. Automatically picks up right away when in network range, and I don’t ever wonder if I’m going to be able to connect to something - it’s wonderfully simple to set up. Download the client, sign in using your org’s SSO (or personal email, but that’s for _only you_ and you can’t share with other users), and your machine just magically joins the network, gets assigned a fixed IP, and you’re on the network with everyone else.
- barkingcat 4y ago
  yes to the unnoticeably reliable part. during the covid shutdown I had to spend long periods of time away from my apartment (I decided to lock down with my family 3000km away from where I lived alone) I had only a small window of time to set up some kind of tunnel back to my apt/set up some kind of remote access. I just installed tailscale on an old mac mini, connected a dinky spare usb webcam, and started photobooth just as I had to leave to catch one of the few flights that hadn't been cancelled due to lockdowns and restrictions. It worked awesome. I could remote in, use the mac to access my backup hard drive, and watch the photobooth camera. The only thing I didn't forsee was the webcam was useless during the night cause I didn't leave a light on so photobooth would just show me a black screen. During the day though, the camera showed me my worldly possessions and helped me monitor my apartment so in case anything happened I could call the superintendant of my apartment. It worked really well, and worked for 3 months until the connection died. I only had 1 month left so I left it alone. 4 months after leaving my apartment, I went back and found out the mac mini suffered from hardware failure (would no longer power on), so the tailscale vpn worked and was more reliable/more solid than the hardware it was running on. After that experience, I am sold on tailscale. They're awesome.

aborsy 4y ago

How about the old solution of devices connecting to an access VPN running on a nearby AWS VPS? I have my private network right now. As a plus, devices can make direct connection when they are in restrictive corporate networks (allowing only 443/tcp). Less third parties involved. Seems more secure for personal use. Sure, it’s not a mesh network, but that doesn’t matter if VPS and devices are in the same region. But I get that mesh VPN products can be valuable to small businesses: ease of use, ACLs, SSO, central management.

smackeyacky 4y ago
There is nothing wrong with a direct VPN, but Tailscale makes them look hard to configure and you don't get the magical DNS stuff they provide.
dvzk 4y ago
Custom peer to peer networks over Wireguard are theoretically more secure. A list of additional potential adversaries who can remotely access your Tailscale network without client manipulation: - Tailscale’s coordination server - Tailscale’s cloud provider - anyone who compromises the coordination server - SSO provider you have chosen - SSO’s cloud provider - anyone who compromises the SSO provider

skybrian 4y ago

It seems like any code running in your browser or on your local machine has access to your home network, which was always true, but now your "home network" includes machines in multiple locations, including AWS.

xlii 4y ago
That’s a very interesting perspective and I wonder if that will change attack vector. One reason to have gateways etc. was to ensure that gateway couldn’t be taken over by software installs etc. Access was inconvenient but it was somewhat by design. Maybe due to this attack vector shifted from directed access to automatic scanning of ever expanding vulnerabilities. Now, as services stops being accessible from external networks once again they can be accessed in convenient ways thus bringing the old vectors back. Sometimes even giving false sense of security.
wmf 4y ago
Tailscale has ACLs and then beyond VPNs there's zero trust and BeyondCorp.

mfrw 4y ago

I organically grew my tailscale network and with the recent `tailscale ssh`[0] it has turned my life around. I have no open ports to anything & be it my personal machine in the depths of my closet or stuff on the cloud; everything is seamless connected. [0]: https://tailscale.com/tailscale-ssh/ https://tailscale.com/tailscale-ssh/

dawson 4y ago
For those still using SSH as normal, you can setup Tailscale to accept connections only from Tailscale, and ignore any public internet traffic i.e., restrict ssh access to be only over Tailscale. For example, with UFW you could delete every rule except for the “Anywhere on tailscale0” and “41641/udp” rules.
- mfrw 4y ago
  Exactly how it `turned my life around`. I can now go to sleep without having to worry about random bots trying to mine crypto on my machines. To add to the goodness, one does not have to worry about either SSH-keys or remember cryptic passwords.
  - withinboredom 4y ago
    This seems like a ... strange ... comment. Do you usually worry about your ssh keys getting stolen? How do you use git? FWIW, setting up something like tailscale is remarkably simple (I'm using PHP here to keep it simple): In sshd_config: AuthorizedKeysCommand /auth_ssh %u AuthorizedKeysCommandUser nobody And in auth_ssh, verify that the user is allowed to connect to that server, then look it up on github (my public keys: https://github.com/withinboredom.keys https://github.com/withinboredom.keys). If you want to allow any github user you allow to connect various permissions, check out libnss-ato. These are all 1 or 2 lines of configuration and are not hard. You just have to know they exist.
    - mfrw 4y ago
      Thank you for the pointers. Honestly, I had no idea about what you pointed out. Regarding the strangeness; yes I was lazy and had password based ssh and was in constant fear that someone might pop my box.

simongray 4y ago

I recently set up Tailscale, but unfortunately the phone app leaves a lot to be desired battery-wise (it takes up 30% of my total battery usage) so I think I'll be looking elsewhere. Initially, I had tried setting up Nebula, but I am unable to get a static IP address for the beacon (a requirement for any of these mesh VPNs), hence why I went with Tailscale which acts as a beacon for you. I think I'll try ZeroTier next.

yoru-sulfur 4y ago
30% seems way _way_ higher than I would expect. I've been running Tailscale on all my devices for a couple months now, and I haven't noticed any impact on battery life. I just checked my phone (Android) and it's reporting 1% usage. I would report an issue if you're seeing numbers that high.
- metadat 4y ago
  I only activate it when I actually need to use it. I don't like running any phone apps in the background, they always suck juice.
- simongray 4y ago
  I use an iPhone. If you google it, you will notice that lots of people have this issue and have had for a long time. - https://www.reddit.com/r/Tailscale/comments/pm49t9/tailscale_using_too_much_batter_on_ios_ipados/ https://www.reddit.com/r/Tailscale/comments/pm49t9/tailscale... - https://forum.tailscale.com/t/high-battery-usage-in-ios/1152 https://forum.tailscale.com/t/high-battery-usage-in-ios/1152 - https://github.com/tailscale/tailscale/issues/3363 https://github.com/tailscale/tailscale/issues/3363
  - sph 4y ago
    Weird, 4% on my iPhone. It's always on, though I don't make a lot of connections through it
    - MaxLeiter 4y ago

ListenLinda 4y ago

It does seem like a great solution but we've shied away from it because the price. For an enterprise you need the business license. Something like OpenVPN Cloud I think is 1/3 the price.

metadat 4y ago
That's reasonable, and OpenVPN is ~1/10th the performance.

gigatexal 4y ago

But since it’s user space aren’t you leaving a ton of performance on the table?

senorsmile 4y ago
This is one of the sell ng points of netmaker, besides three fact that it's all open source.
- gigatexal 4y ago
  Very cool! I’ve found my new weekend project. Thank you!

jalino23 4y ago

is tailscale like forticlient vpn ? so I can ssh into my instance that is not exposed into the world? so my instances can talk to each other without going through the public internet?

jgeralnik 4y ago
Tailscale can punch through NAT but requires outgoing internet access

unnouinceput 4y ago

Quote: "In the "before tailscale" times, if I needed to test against the production AWS resources or connect dBeaver for database maintenance, I would edit the security group to add my IP address, do my testing, edit the security group to remove myself. This is as error prone as it sounds. I quite often forgot to remove my IP address from the allowed addresses, a major potential security risk when you are travelling." My takeaway from this is that the author was either lazy or lacked the knowledge to create an automation script that could've done that automatically (the add/remove) based on location. If that's the whole reason for this tailscale praise, kinda of takes away the tailscail actual usefulness and why it exists in first place.

smackeyacky 4y ago
Author here. Yep, I'm lazy and a cheapskate, so using the built-in AWS solution I thought was too expensive for something I only did occasionally. 99% of the time I'm hooked up to my test system rather than production (as it should be).

tandav 4y ago

I my experience for purpose of home server which should be accessible for everyone, cloudflare tunnels are better, because tailscale solutions require every client to install their app to use the network. It is not convenient if you want to share some webserver with your friend and just send him a link.

moontear 4y ago
True, but that is also not what Tailscale is for - tailscale would be me comparable to Cloudflare Access instead of their tunnels.
dahnhiller 4y ago
Tailscale has this in beta at the moment https://tailscale.com/kb/1084/sharing/ https://tailscale.com/kb/1084/sharing/

sschueller 4y ago

Can someone comment on how safe/secure tailscale is? I am not talking about the wireguard part but the closed source part and the company.

danielheath 4y ago
> the closed source part P2P client: On iOS/windows/macos it doesn't make sense to complain about closed source code running on your machine; on linux/bsd/android the client is open source. Control plane: A compatible open source server is available & you can self host; the tailscale-hosted control plane is closed source and could, in theory, instruct your devices to connect to additional peers. > and the company The company has several high-profile employees with excellent reputations, which is typically a good sign of legitimacy.
- bigiain 4y ago
  > The company has several high-profile employees with excellent reputations, which is typically a good sign of legitimacy. I’m sure people said that about Larry and Sergey back in the day…
  - dewey 4y ago
    People don't talk about Google not being a legitimate or unsafe company. Issues with customer support? Sure. Issues with shutting down some products HN loves? Sure. Getting hacked or being insecure? No, in fact they probably have one of the leading security teams (Project Zero) in the industry.
  - danielheath 4y ago
    Nothing lasts forever, but very little changes overnight either. If you're paying attention, you can watch the arc of growth and decay in many places.
ratg13 4y ago
Don't connect your GitHub account to it. I made the mistake of doing this, it seemed to be working fine, and then all of a sudden to add a new node it needed access to my company's GitHub repositories in order to continue. (no way to continue without accepting) So I could either give them access to sensitive company information, or remove my github account from my company, neither of which I wanted to do. I just stopped using TailScale, I've been meaning to set it up again with a different login, but the experience left a bad taste in my mouth.

YarickR2 4y ago

Why does this read like a thinly veiled native ad ?

dncornholio 4y ago
So do most of the comments!

moontear 4y ago

Shoutout to ZeroTier, Nebula which essentially do the same thing. Or Netmaker if you wanna go complete open source/self hosted.

jbverschoor 4y ago
Zerotier works at a lower level. This means you can do other protocols than tcp/ip
- anotherhue 4y ago
  I don't think that's correct, they both expose TUN/TAP devices so should be equivalent in their encapsulation abilities. I use both regularly. https://en.wikipedia.org/wiki/TUN/TAP https://en.wikipedia.org/wiki/TUN/TAP
  - FL410 4y ago
    It is correct because a TUN interface is not the same as a TAP interface. The latter is layer 2.
- akvadrako 4y ago
  Tailscale can do UDP also.
  - linsomniac 4y ago
    "TCP/IP" means TCP, IP, and UDP. ZeroTier can do other protocols like NetBIOS, so you can use it to run LAN games that don't use TCP/IP.
    - deleted 4y ago
      [deleted]
rcarmo 4y ago
I tried ZeroTier in the past, and it was great, but didn't have an iOS app. Do any of those do?

spapas82 4y ago

Tailscale seems to dominate the hn front page. I've written an ask hn about that and I'd like some honest opinions: https://news.ycombinator.com/item?id=31957059 https://news.ycombinator.com/item?id=31957059

deanc 4y ago

I consider myself relatively technical as a software engineer, but networking isn't my forte. I still don't understand the documentation about bringing in my other devices that don't have clients. I'd like to be able to have access to homekit while out and about on 5g for example - via tailscale.

smackeyacky 4y ago
Set up a tailscale subnet router on your home network, it can share access to clients not running tailscale. I've used that to access a bluetooth router that I didn't install tailscale on.
- deanc 4y ago
  Yes I'm aware [1]. I would not describe these steps as user-friendly. [1] https://tailscale.com/kb/1019/subnets/ https://tailscale.com/kb/1019/subnets/
  - smackeyacky 4y ago
    Those instructions are a bit over-egged. All you need is sudo tailscale up --advertise-routes=10.0.0.0/24,10.0.1.0/24 Then you can get to anything via it's internal IP address. I have a bluetooth router on my network that I don't want to install Tailscale on. It's on a permanent address of 192.168.1.13 I do this on the router inside my office subnet: sudo tailscale up --advertise-routes=192.168.1.0/24 I do this on my home debian machine (lets say it's on 10.1.1.13): sudo tailscale up --accept-routes From my home network I can now open the web management page on 192.168.1.13. You can go further with DNS stuff but you don't have to.

rcarmo 4y ago

I use Tailscale as well for my personal stuff (services in various clouds, remote gateway when I'm away from home, etc.) but as someone who defines best practices for enterprise cloud deployments I have a nagging worry about other people using it in work environments as a way to circumvent security guardrails. That said, I love it and use it extensively from my iPad to work on a personal Gnome desktop via RDP.

janci 4y ago

Tailscale seems like a great product however I do not want 3rd party to be able to add a key to my ACL. Running a custom control plane server is possible, but then there is little benefit for me compared to direct wireguard with a central peer on a VPS. If it would be possible to use just the NAT traversal without key management, that would be it! Curretly I am running a tiny VPS as a wireguard server, but I do not trust it to be part of my network. Therfore I run one wireguard tunnel to be able to access my router (has no public ip) and second tunnel inside the first to connect through the router to my home network. Theoretically, it should be possi le with single wireguard tunnel if I set a route to home router via wireguard gateway - but I never managed to make wireguard encrypt a packet if it came from the same wg interface. Can anybody help?

imdsm 4y ago
I think Tailscale have the right approach by knowing their customer — someone who is happy to have a trusted 3rd party administer parts of their VPN in return for time and cost saving. There are a few here who can't have that, so they instead invest their time into a custom setup with WireGuard which is fine, but for those of us who don't require that level of assurance (there are bigger attack vectors to worry about), Tailscale is fantastic. Quick, easy, and mostly works out of the box.

Kab1r 4y ago

I use both tailscale and cloudflare access and found tailscale is easier to deploy however cloudflare access also has tunneling which is pretty useful.

ratg13 4y ago
Do you not consider a VPN a tunnel?
- Kab1r 4y ago
  I mean Cloudflare's public facing tunnel solution. Of course VPNs are also a form of tunneling, but as far as I am aware tailscale doesn't have a public facing solution.

madjam002 4y ago

To add to the OP’s article, Tailscale can map IPv4 to IPv6 addresses when using subnet routers. Imo this is incredibly handy, as if I want to expose a device to my Tailscale network, I don’t want to have to think about finding an IP address range that won’t conflict with the various local network ranges that my Tailscale devices are on. Especially if you’re using Tailscale in various corporate environments where 10.0.0.0/8 is used a lot. Now I can just expose e.g 192.168.122.0/24 to my Tailscale network but it’s exposed as a unique IPv6 /120 prefix. https://tailscale.com/kb/1201/4via6-subnets/ https://tailscale.com/kb/1201/4via6-subnets/

truth_seeker 4y ago

why not just use ssh tunnels with compression ON when you connect to RDS?

pvsukale3 4y ago

I wish I had Tailscale when I was playing LAN games in college. Spent a lot of time debugging around network issues.

Tsiklon 4y ago
I hadn’t even considered this, this can be used as a modern replacement for hamachi in this particular scenario!

majodev 4y ago

I really love tailscale for my private network. Nevertheless, I still hope they will revisit support for proper linux kernel wireguard sometime in the near future. This would allow to ditch separate meshing technologies for connecting server nodes (and routing into separate subnets via a tailscale subrouter node). Best of both worlds - ease of use and performance. I really only started to have a look at other tools (like netmaker, netbird, innernet, wesher) because of these performance caveats (wireguard-go). https://github.com/tailscale/tailscale/issues/426 https://github.com/tailscale/tailscale/issues/426

5e92cb50239222b 4y ago
netbird is a good alternative that has significantly better NAT punching (at least on my network), going through 2-3 layers of NAT just fine. The problem with it is although it does support kernel WireGuard, it works only if both nodes are on the same subnet, or if one of them has a public IP (port forwarding doesn't work, it needs a public IP). Otherwise, it creates a tunnel through NAT (using WebRTC's ICE) and then routes data from the WireGuard interface through that tunnel. This involves copying data multiple times (application → kernel → wireguard → netbird client (userspace) → kernel → network). So unless you're fine with that limitation, look elsewhere for now.
- majodev 4y ago
  I really tried to like netbird, but their current hard dependency on auth0 (also when selfhosting) unfortuantly put me off. Your statements regarding NAT punching are on the other hand very interesting. I'm currently trying out innernet, mostly for the interconnected server nodes (k8s, not for actual real users). Seems to work fine (double NAT + single public coordination server). Unrelated to Wireguard: I really liked Nebulas certificate-based client setup and its reduntant lighthouses (public coordination servers). May be an alternative if you want something at least a little faster than wireguard-go based implementations.

fancyfish 4y ago

Tailscale has been a godsend for my team, saving us quite a bit of effort with VPN/firewall administration. There are very few rough edges, and it tends to just work (at least at our scale of a few thousand nodes). We moved over about 8 months ago and have had no issues since. I’ve also moved my home network (RPis, NAS, etc) to their free tier so I can access it remotely. Some features that are basically effortless and made me choose it over WireGuard and other VPN solutions: easy provisioning, key exchange, IP assignment, ACLs

riekus 4y ago

Have setup tailscale and pretty happy with it, yesterday enabled TLS so my host have https pretty easy with caddy and reverse oroxy, problem is you can't use subdomains, so every host can only forward one https connection. My main server host several selfhosted services and want them all over https. Have googled an question open at caddy and tailscale forum, anyone here know what route to take?

balaa 4y ago