4 ms·

> To make this possible, we ported the following to WebAssembly: the Tailscale client, WireGuard®, a complete userspace network stack (from gVisor), and an SSH

> To make this possible, we ported the following to WebAssembly: the Tailscale client, WireGuard®, a complete userspace network stack (from gVisor), and an SSH client. Would it be possible to bundle the same into a portable application allowing you to use Tailscale without installing it? My understanding is that currently if you can't install Tailscale on a client you need to use Subnet Router. https://tailscale.com/kb/1109/devices-without-tailscale/ https://tailscale.com/kb/1109/devices-without-tailscale/

lxgr 4y ago
You‘d have to redirect all network usage (i.e. the sockets API or your platform‘s equivalent) through the custom stack, which is possible if you can rebuild the source or by using something like LD_PRELOAD for binaries, but can get very tricky in the general case. There‘s an utility called SSHuttle that does something similar for SSH instead of Tailscale/Wireguard: It redirects all sockets usage to go through an SSH connection, to allow usage of SSH port forwarding without explicit SOCKS support on the app‘s side.
- Serow225 4y ago
  SSHuttle was created by the CEO/co-founder of Tailscale :)
  - lxgr 4y ago
    Indeed, both the name and the very clever combination of existing components sounded familiar when I first heard about Tailscale :)
  - jillesvangurp 4y ago
    Interesting. Sshuttle is great. I've used that a couple of times to create a simple vpn without having to deal with openvpn. Simple and effective.
  - blibble 4y ago
    that's a bit worrying there's a rather large misunderstanding on its github page: > You can't use openssh's PermitTunnel feature because it's disabled by default on openssh servers; plus it does TCP-over-TCP, which has terrible performance. it doesn't do TCP over TCP, it's a bytestream over TCP (exactly the same as shuttle) something like OpenVPN running in TCP mode would be TCP over TCP
    - lxgr 4y ago
      Are you sure you are not misunderstading PermitTunnel yourself? That SSH feature is indeed used for packet forwarding over SSH using TUN/TAP, i.e. packet-over-TCP, and by extension TCP-over-TCP.
- ithkuil 4y ago
  . You can use tools like proxychains to leverage LD_PRELOAD to redirect all network traffic via a socks5 proxy. Tailscaled comes with a socks5 proxy

lxgr 4y ago

You‘d have to redirect all network usage (i.e. the sockets API or your platform‘s equivalent) through the custom stack, which is possible if you can rebuild the source or by using something like LD_PRELOAD for binaries, but can get very tricky in the general case. There‘s an utility called SSHuttle that does something similar for SSH instead of Tailscale/Wireguard: It redirects all sockets usage to go through an SSH connection, to allow usage of SSH port forwarding without explicit SOCKS support on the app‘s side.

Serow225 4y ago
SSHuttle was created by the CEO/co-founder of Tailscale :)
- lxgr 4y ago
  Indeed, both the name and the very clever combination of existing components sounded familiar when I first heard about Tailscale :)
- jillesvangurp 4y ago
  Interesting. Sshuttle is great. I've used that a couple of times to create a simple vpn without having to deal with openvpn. Simple and effective.
- blibble 4y ago
  that's a bit worrying there's a rather large misunderstanding on its github page: > You can't use openssh's PermitTunnel feature because it's disabled by default on openssh servers; plus it does TCP-over-TCP, which has terrible performance. it doesn't do TCP over TCP, it's a bytestream over TCP (exactly the same as shuttle) something like OpenVPN running in TCP mode would be TCP over TCP
  - lxgr 4y ago
    Are you sure you are not misunderstading PermitTunnel yourself? That SSH feature is indeed used for packet forwarding over SSH using TUN/TAP, i.e. packet-over-TCP, and by extension TCP-over-TCP.
ithkuil 4y ago
. You can use tools like proxychains to leverage LD_PRELOAD to redirect all network traffic via a socks5 proxy. Tailscaled comes with a socks5 proxy