23 ms·

Tailscale Funnel

666 points by soheilpro 4y ago

TaylorAlexander 4y ago
Sounds promising! I recently got gigabit fiber through Sonic, who does not offer static IP addresses. I did read the article but it is pretty deep in to some stuff I am not that familiar with. Can anyone clarify, if I own some domain name, can I host something on my raspberry pi or whatever and use funnel with my domain so that someone can visit my domain and get to that hosted thing? And how would this compare to dynamic DNS approaches? Thanks!
- linsomniac 4y ago
  No, you can't use your own domain, this specifically works with the ts.net subdomains. You could use it to host your service on "node.tailnet.ts.net", if you're ok with that naming. Otherwise, you'll need to set up a VPS with tailscale on it, and your own domain, and have it proxy similar to how Funnel works. I assume there are going to be some egress charges for Funnel. Unlike normal tailscale, Funnel has a high bandwidth component to it for hosting high bandwidth services.
  - TaylorAlexander 4y ago
    Got it. I thought maybe that would be the case but I wanted to check. Thanks!
  - bradfitz 4y ago
    Author here. We might do BYODomain later. It was easier to launch with only *.ts.net. If you're using this for things like webhooks, the URL doesn't matter much.
    - hamishwhc 4y ago
      Anything stopping us from just creating a CNAME to our tailnet domain and registering certs for it instead of whatever.ts.net? This seems like it should work in my head...
      - bradfitz 4y ago
        Our Funnel ingress servers won't proxy any TCP connection that doesn't have a *.ts.net SNI name currently. But BYODomain is something that'd be fun to add.
        pbronez 4y ago
        BYODomain would be great. This would give me a secure & reliable to host public services out of my homelab.
        anderspitman 4y ago
        It would be great if Tailscale adds this, but there are lots of services that provide this functionality if you need it today, including Cloudflare Tunnel.
        xyzzy_plugh 4y ago
        Cloudflare's CNAME flattening with proxy enabled would do the trick. The ingress sees a request to the CNAME target so SNI works as usual.
      - tonyarkles 4y ago
        From how I understood the article, they don't do TLS termination but they do SNI snooping to figure out how to route it? So if they don't have all of the infrastructure in place to map the SNI for your CNAME to your Tailscale network, that wouldn't work?
    - SequoiaHope 4y ago
      That's a good point. I have a super simple status page I have wanted to make that would be externally accessible. I don't care what the URL is for that one. I guess this would be a great use for that! That one is behind a Starlink terminal so again, no static IP available there.
    - the100rabh 4y ago
    - bradknowles 4y ago
      What about supporting UDP protocols?
    - linsomniac 4y ago
      The next step is being able to send a redirect to the client's tailscale with the public key of the destination node, so it can establish an anonymous connection directly with the node running the service, using some sort of Funnel ACL (default deny).
  - yurymik 4y ago
    I wonder why that's the case. If you own a DNS name, you can set NS record to point to magic-blah.tailscale.net, so they'll have a chance to geo-locate you and return IP address of the closest VM.
  - linsomniac 4y ago
    Also, I've been told that it's currently bandwidth limited, with the future holding maybe variable bandwidth limits and bandwidth charges. So a dynamic DNS pointing at your gigabit home connection is likely going to be a better solution than funnel.
ftufek 4y ago
Looks like a nice competition for cloudflare tunnels and ngrok.
biotinker 4y ago
Tailscale is really, really doing a good job of taking all of the different secure remote networking tasks that have always been possible but self-managed and tedious, and wrapping it all in an automated, friendly interface. Every time they come out with a new product, I read about it and think "Wow, that's really useful. That would be such a pain for me to roll by hand." Everything they do was already possible with open source tooling, but they make it accessible. It reminds me of when Dropbox first came out.
jchw 4y ago
It's very nice that it doesn't do TLS termination, but it seems to rely on SNI. That's cool, but it probably precludes SNI encryption in the future. Is there a plan around this? Maybe in the IPv6 world, it becomes a non-issue... But I wonder what comes first: the push for ESNI everywhere, or actually substantial IPv6 adoption. (Edit; though come to think of it, in practice, if the IP address each host resolved to was unique, it wouldn't really matter very much from a security/privacy standpoint, so I guess it's probably not important...)
- bradfitz 4y ago
  Author here. This shouldn't preclude doing us Encrypted ClientHello in the future. We control the DNS for *.ts.net so we can publish our public key for browsers/etc to encrypt the ClientHello to, if I'm remembering the latest encrypted SNI spec(s)?
  - jchw 4y ago
    Ahh, yeah; disregard me, totally can. Cool!
anderspitman 4y ago
This is huge. One of the last major missing features from Tailscale IMO. I maintain a list of tunneling solutions[0]. Personally, I think the future of p2p networking and selfhosting may be through tunneled, SNI-routed TLS connections (exactly what Tailscale just announced). It solves IP exhaustion, NAT, and IP privacy at the cost of an extra hop and no UDP. The big question is going to be pricing. The current top player in this space is Cloudflare Tunnel, which is a loss-leader product that technically forbids selfhosting anything other than HTML sites. Selfhosting media can use tons of bandwidth. Any service that doesn't charge per GB is incentivized to limit your speeds. [0]: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling
- api 4y ago
  So basically that would mean a cloudflare for P2P, though maintaining data privacy at least. It’s better than no P2P but IPv6 solves exhaustion and NAT without the performance hit or protocol limitations and with no extra third party intermediary in the way. BTW this maintains data privacy but you can still tell a whole whole lot from metadata. On the flip side it would prevent the kind of “griefing” with DDOS that happens every once in a while with self hosted and P2P things. It’s not that common unless you are engaging with certain communities but it is an inherent Internet architectural flaw that this kind of works around (at a cost).
  - anderspitman 4y ago
    I envision something more decentralized than Cloudflare[0]. I think you could have local companies in every major city that would own a block of IP addresses and provide tunneling services with SNI routing for people in the same region. They can also provide more expensive services like DDoS protection and caching for popular sites or even on-demand when your mom blog goes viral. > It’s better than no P2P but IPv6 solves exhaustion and NAT without the performance hit or protocol limitations and with no extra third party intermediary in the way. I just don't see ISPs ever implementing IPv6 without governments forcing them to. It enables p2p which increases upload bandwidth requirements and cuts into their bottom line. And even if we get IPv6 you still need the ability to open firewall ports in a way the average user can understand. Not hard technically but that's another standard that everyone is going to have to agree on and implement. [0]: Which I know you can appreciate. "Decentralize until it hurts; centralize until it works" is still one of my mottoes.
deafpiano 4y ago
I was making a service that's half public hosted, and half on tsnet https://tailscale.com/blog/tsnet-virtual-private-services/ https://tailscale.com/blog/tsnet-virtual-private-services/ server the other day, and this is exactly what I was looking for. Having an app that can setup its own completely secure networking no matter where it's run is game changing, as soon as I get into the alpha, the Cloudflare tunnel it's on right now is going down!
thisisthenewme 4y ago
I've been using tailscale in my home setup for a while and really appreciate the simplicity. It has just worked in my experience. Before taking the leap for tailscale I was semi-struggling with a vault + wireguard + consul-template approach which was pretty cool and fun to setup but a bit unnerving to be unsure if I got anything wrong and the chances of me being exposed. This looks like yet another feature that fits my use case and reduces my security burden. Though learning a few things from this post the first being that I should have replaced my use of haproxy with rinetd ages ago. The other about Certificate Transparency logging. Still going through the wiki pages to understand how that works, but would it really log an event such as Tailscale terminating the request, dumping the data, and re-encrypting them before sending us the request? Or is it possible for a bad actor to hide the logging?
- detaro 4y ago
  > Tailscale terminating the request, dumping ... For that they need a certificate. They have two options of obtaining that: a) They request one from a CA. This will be logged in Certificate Transparency logs, and thus you could detect it by comparing the certs logged with the ones your local machine generated b) they could have their software upload the certificate from your machine. That would need effort to detect (deeply inspecting the software and/or its traffic), but if a whiff of such a "feature" were to be found by anyone it couldn't really be explained away. (and aren't their clients app open-source? then at least it'd be reduced to source inspection and compiling yourself, which makes hiding stuff harder)
  - notpushkin 4y ago
    > and aren't their clients app open-source? Only for Linux. (On macOS I think the core CLI part is open source as well, but that's not what most people use I think.)
    - dblohm7 4y ago
      (Tailscalar here) Most of the Tailscale client’s functionality is implemented as a daemon called tailscaled which is in the OSS repo. It’s the GUI front ends for Windows, MacOS and iOS that are not.
matthewaveryusa 4y ago
If I CNAME my domain to my assigned ts.net then I'm guessing funnel won't work because of the SNI lookup will it? Is that on the radar? Right now I'm using cloudflared but if I can get rid of it in favor of this that would be one less daemon to worry about. Wouldn't be able to do esni though. sooo, how about a vanity .ts.net I get to choose?
8K832d7tNmiQ 4y ago
if there's anyone from tailscale is currently lurking this post: 1. How much traffic cost would you expect to get into your DERP instances when this service will be available globally? 2. How much bandwidth would you prepare just for proxying these nodes into public network? 3. How do you think some users might abuse this service in the future?
- kevmo314 4y ago
  It looks like they're bracing for a lot of traffic or abuse: > Limitations > - DNS names are restricted to that of your tailnet’s domain name. > - The ports you can specify to expose your servers on are currently to 443, 8443 and 10000. > - Traffic over Funnel is subject to bandwidth limits. They are not currently configurable. I was thinking this would be cool to run some live video stuff on, but maybe that's too much bandwidth for now :)
  - 2bluesc 4y ago
    I'd love to learn what the bandwidth limits are.
- anonymouse008 4y ago
  This is the 'logistics' level questioning. "Amateurs talk strategy; professionals talk logistics"
deleted 4y ago
[deleted]
aquaticsunset 4y ago
Tailscale and the people building it continue to blow me away. The ingenuity, reliability, polish, and speed of feature delivery are unparalleled in software. I'm eager to get rid of needing DDNS and open ports just for web hooks. And I can "flatten" my stack by cutting out a reverse proxy / weird port forwarding stuff.
- slondr 4y ago
  Though, strictly speaking, all of that was already possible with ip6
  - Rebelgecko 4y ago
    Sure. I don't think tailscale does anything that's impossible through other means (cue comments about how anyone can recreate Dropbox with an FTP server, svn, and a fuse file system). IMO whats great about it is that it's easy to set up and is incredibly low maintenance (at least they way I use it).
    - parhamn 4y ago
      Further, and to their credit theres a lot of great tech in there. Just the other day I stumbled on DERP [1] their wireguard-over-tcp (over their node network) implementation which they fall back to if NAT traversal fails. While sure, this is partly ipv4 problem, it recently helped me connect with friends behind government firewalls, presumably because the packets aren't recognized yet. But that sort of automated connectivity during nat traversal failure through a global network of edges isn't something you can easily setup yourself (if you care). [1] github.com/tailscale/tailscale/tree/main/derp
  - anderspitman 4y ago
    It's about 40% possible with IPv6: https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html
    - 4y ago
yewenjie 4y ago
This means selfhosters don't need anything other than a domain name and a local machine, right? Technically is it very different from Cloudflare Tunnels?
- anderspitman 4y ago
  You actually can't use your own domain yet, but looks like there's a good chance they add that based on @bradfitz's comments.
jsd1982 4y ago
I really want to like Tailscale but I couldn't easily find a way for it to work on a jumpbox running Ubuntu 14.04 that I don't have root access to. Anyone have a way to install the client on a non-rooted box? I couldn't find anything in the docs about the assumption that it requires root or not, other than it being implied by their install steps using system package managers.
- dave_universetf 4y ago
  You can grab static binary tarballs on https://pkgs.tailscale.com https://pkgs.tailscale.com and then run tailscale in userspace mode: https://tailscale.com/kb/1112/userspace-networking/ https://tailscale.com/kb/1112/userspace-networking/.
  - jsd1982 4y ago
    Nice, thank you! I got it to work.
gz5 4y ago
>Maybe you need to receive a webhook from GitHub There are also free options, e.g. ngrok [0] And open source options, e.g. openziti [1] Doing webhooks and dark webhooks for quite some time. Always good to have more options - what does Funnel do differently than those? [0] https://blog.ngrok.com/posts/getting-started-with-webhooks https://blog.ngrok.com/posts/getting-started-with-webhooks [1] https://openziti.io/my-intern-assignment-call-a-dark-webhook-from-aws-lambda https://openziti.io/my-intern-assignment-call-a-dark-webhook...
- tasn 4y ago
  What's a "dark webhook"? Also, funny they should mention Github, as they literally just added webhook tunneling to the Github CLI a few days ago.
  - dovholuknf 4y ago
    A "dark webhook" in this case just means sending data from a public server/service like a GitHub action (or even an AWS Lambda) to a server that doesn't have a port open on the internet. For example, I get a message to my Mattermost client everytime someone pushes/commits/etc. All those messages are sent to the Mattermost server over a webhook that is configured on an overlay network (in our case, using OpenZiti). There's no firewall rule allowing the traffic to the Mattermost server, it's "dark" to the internet.
    - tasn 4y ago
      I assumed it would be something about the "dark web", never heard the term used for services that are behind a firewall. TIL.
- Komodai 4y ago
n42 4y ago
genuine question -- why would I use this?
- nelsonenzo 4y ago
  you could self host a website. Or more realistically, if you are in web dev and wanted to show your work on your local machine - say when the CEO wants to 'check in and see how its going', you can just send them a link on slack and they can play with what your developing on.
  - n42 4y ago
    why do I need a tailnet to self host? can't the CEO just use the Tailscale network to access it privately? I just don't personally see a use case -- if I need someone to access the content, the box it is on is already easy to publicly access. if it's not, the only people who need to see it are on the Tailscale network edit: I think I'm starting to see it. it's not for long term installations. I just feel like, why not just open the box to the internet at that point. it makes more sense for the edge case(s) that might address friction with adoption. interim solutions, or temporary connections edit2: I can also see how this might be useful for people living under an oppressive government
    - bradwood 4y ago
      > can't the CEO just use the Tailscale network to access it privately How many CEOs you know gonna install a VPN client on their workstation to see your stuff?
    - anderspitman 4y ago
      IMO it will be much more useful when they add custom domains so you can host things like public websites.
      - n42 4y ago
        the more I sit with it the more I can see different ways it might be valuable. even if it's just to simplify setup. the use cases just didn't really jump out to me this time, even as a happy Tailscale user
RL_Quine 4y ago
I'd still love for them to support some other form of auth, Google or Microsoft auth is an incredible drag as a gatekeeper to their product.
- anderspitman 4y ago
  They had an interesting conversation about this: https://twitter.com/bradfitz/status/1248458084705431555 https://twitter.com/bradfitz/status/1248458084705431555
- bradfitz 4y ago
  We want other forms too. More will come.
- pomatic 4y ago
  We left them because of this. Long overdue move away from Gmail Gsuite resulted in TS costs for our dozen user team at least doubling; the overhead involved in managing the overlay network acls was also getting out of hand too.
nelsonenzo 4y ago
this is cool and all, love me Tailscale for sure. For this particular feature I like my own home rolled solution where I automated the process of spinning up a tiny ec2 server with an nginx proxy to a reverse ssh tunnel that goes back to my local machine. It gets a letsencrypt cert and modifies the route53 dns. All managed with a cli command and config file. The other benefit is that it is completely unthrottled, which is particularly useful if your debugging some stupidly large react/vue website. Im working on a feature that will enable basic-auth in front of it also, so at least a password would be required to send traffic to your local machine, if you wanted. Good for the "share your work" sort of scenarios. tl;dr if you want any-subdomain.your-domain.com -> localhost:port, and you use AWS, try https://github.com/nelsonenzo/tolocal https://github.com/nelsonenzo/tolocal
- anderspitman 4y ago
  If you're having fun, don't let me stop you, but there are tons of open source projects to simplify this process: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling
  - nelsonenzo 4y ago
    Cool list, thanks for sharing. Unfortunately none of those solutions are self hosted AND automated. They all seem to either use their own ifra, which will be slow & throttled, or require setting up a server and manually editing DNS. I may try to get my own project added to that list though, so thanks for sharing!
    - alexellisuk 4y ago
      We've done a lot of work on "self-hosted AND automated" inletsctl - automates a VM with the inlets tunnel server preinstalled, including with HTTPS termination with Let's Encrypt, or pure TCP pass-through inlets-operator - the same for Kubernetes Load Balancer services Feel free to take a look at https://inlets.dev/ https://inlets.dev/ We talk a lot about the community adoption here in the first half -https://inlets.dev/blog/2022/11/16/service-provider-uplinks.html https://inlets.dev/blog/2022/11/16/service-provider-uplinks.... (I'm the original founder of inlets)
inquirer39243 4y ago
Is there any updates on being able to use the IOS app for self hosted tailscale? Also what is the status of fully self hosted tailscale in general? I just don't trust my VPN to be managed by a 3rd party like this. I'm willing to pay money even (though I don't have much) for hobby use - but I don't like the possibility of exposing network devices like this. To be honest I'm a bit surprised seemingly everyone else is.
- anderspitman 4y ago
  All depends on your threat model.
- deleted 4y ago
  [deleted]
- 5e92cb50239222b 4y ago
  Not everyone, we just don't talk about it much. headscale is plenty popular — that's not "everyone" already. https://github.com/juanfont/headscale https://github.com/juanfont/headscale In addition to your points, we over here also have our own reasons for self-hosting everything (for example, to protect ourselves from being cancelled at any moment for being forced into a citizenship you didn't ask for by being born at the wrong place).
jacooper 4y ago
This looks like cloudflare tunnel without the MITM attack!. I'm interested to see the limits they put on this, I dont think its going to be as limitless as Cloudflared.
- anderspitman 4y ago
  Also without the CDN (which I'm not sure how you'd do without MITM), but this is definitely comparable to Cloudflare Tunnel.
  - jacooper 4y ago
    Yup, not everyone needs a CDN.
tsujamin 4y ago
Something else interesting they're doing is their tsnet package, which lets you join your process to the tailnet and bind tcp listeners/connect to TCP services via their tailnet IP or subnet. I'm writing some stuff using this at the moment, but I also just saw https://github.com/tailscale/golink https://github.com/tailscale/golink which does the same thing: a single binary that runs a link shortener that joins itself to your tailnet. tl;dr: don't run your service on a machine then join that to tailnet, directly bind your service to an in-memory tailnet client
- anderspitman 4y ago
  I wasn't aware of tsnet. That's super cool.
  - tsujamin 4y ago
    Its very cool, some thoughts: * They have support in there to get an API client that auths using your nodekey - not sure what endpoints it can hit but makes for some interesting cases like updating ACLs maybe * You can use it as an exit node/subnet router too, but it requires some hacking * Equally there UDP support lurking in their library you can wire up too
syntaxing 4y ago
Does this mean I can expose home assistant online without worrying too much about security?
- hamandcheese 4y ago
  Are you trying to share home assistant with everyone on the internet? If yes, then yes. You probably don't want that, though, so vanilla Tailscale would let only you securely access your home assistant server from anywhere, as long as you install the Tailscale VPN app.
  - sumitgt 4y ago
    This. You can anyways access Jome Assistant over tailscale without all this. I think there is even a Tailscale addon for HA.
2bluesc 4y ago
I'm surprised they don't allow exit nodes to function as funnel servers. Seems to me this would save them the hassle of dealing with the bandwidth.
- apenwarr 4y ago
  Exit nodes are usually still behind your firewall and have no open incoming ports. If you're willing to reconfigure your firewall to open incoming ports, you probably didn’t need Funnel in the first place.
otar 4y ago
Tailscale is on fire. I am watching it very closely and considering to set it up for my small team.
aborsy 4y ago
As soon as Tailscale provides option for Wireguard preshared keys, I will use it. I need Tailscale out of my network. Any plan? Self hosting Tailscale will then not be needed, since users don’t need to trust Tailscale anymore.
- rollcat 4y ago
  What do you mean by "trust", what's your threat model? Tailscale does way, way more than just facilitate key exchange. If tailscale.com goes down or rogue, you're still in a pickle even with PSKs; just because there's a Wireguard under the hood, doesn't mean you can swap an API endpoint and continue as if nothing happened. Even with self-provided PSKs, you're going for an (IMHO) pretty poor trade-off; keys, certificates, etc should be regularly rotated, that's a chore that's best left automated. At that point, why not just set up Wireguard yourself? If you have legitimate concerns, you should be using Headscale[1] (or even plain Wireguard) from day 1. Otherwise - personally I find the current threat model very reasonable, it's in no way worse than trusting any other VPN provider, and they're keeping a pretty big chunk of their code base open for auditing. [1]: https://github.com/juanfont/headscale https://github.com/juanfont/headscale
sixhobbits 4y ago
Maybe I have a fundamental misunderstanding of how Tailscale works, but I always feel like there is a disconnect in how it is received on HN. Usually people are pretty critical/cynical of sending sensitive data to a closed source third party server, no matter how strong their claims of 'being the good guys' are (eg see Telegram). But somehow we're all meant to be happy giving full control of our entire network to a commercial company running a closed source command and control server?
- ocimbote 4y ago
  I think that by the sheer nature of Wireguard, it doesn't matter much. We don't send any readable data to Tailscale, they, for the greater part, handle plumbing between nodes. What goes in the pipes remains unnoticed and unknown to them. Their MagicDNS feature may raise different concerns though, but I'll let others comment on it.
  - edf13 4y ago
    This new service allows them (or if they’re hacked - anyone)… to MitM your connections - they state themselves they could ssl terminate the connections as they own the ts.net level, they say they don’t but that’s now…
    - ignoramous 4y ago
      > This new service allows them (or if they’re hacked - anyone)… to MitM your connections... TFA mentions that the immutable certificate logs reveal if something spooky is going on. Not enough of a guarantee since the tailscale client may siphon off certs from a local device to its servers anyway. But that's us being extremely paranoid about tailscale (in which case, why use it?). Second, most services are run behind reverse-proxying load balancers which invariably are setup to "MiTM" aka terminate TLS. The providers running those load balancers control IPs + DNS records too, for good measure. I guess, supporting a dizzying array of functionality makes Tailscale a decentralised cloud service provider themselves.
- deleted 4y ago
  [deleted]
shepherdjerred 4y ago
Another great feature from Tailscale! Ever since I started using Tailscale a year or two ago, I haven't had to think much about networking for my self-hosted servers at home. It all _just works_. Tailscale is a great example of software solving a real problem in a user friendly way.
kybernetyk 4y ago
So this is just a Wireguard wrapper with a shiny UI? Why is this so hyped?
- Operyl 4y ago
  Because it’s not the basic Wireguard part itself that’s hard, it’s the synchronized keys, NAT busting, ACLs, and other things on top of it that are. Tailscale has made it incredibly easy to deploy and use confidently and that’s why people are happy.
  - kybernetyk 4y ago
    So offloading a critical part of your infrastructure to a $5/mo service is a good idea now?
    - rs_rs_rs_rs_rs 4y ago
      ...yes? You're already offloading critical parts of your infrastructure anyway.
    - biorach 4y ago
      welcome to 2010
    - Operyl 4y ago
      Given the immense trust I have for the names behind Tailscale, sure. I don’t run my own data centers, either, so it is a sound business decision to offload this too.
    - lijogdfljk 4y ago
      To a novice, how else would you do it? Ie i can self host most of this, but wouldn't i be hosting it on literally a $5mo VPS with a static IP to work around my homes dynamic IP?
- sph 4y ago
  Your comment has strong "what does Dropbox do that curlftpfs doesn't?" energy.
m1ckey 4y ago
Related product from Cloudflare: https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/ https://developers.cloudflare.com/cloudflare-one/connections...
asim 4y ago
Now I'm like. OK tailscale, give me custom domains and I'm sold. Where are you @bradfitz!
School-Cotton 4y ago
If I understand correctly, this still won’t let me achieve my dream of hosting my personal email on my home computer, because smtp connections typically start out as plaintext and then negotiate up to TLS within the protocol itself.
jbverschoor 4y ago
I love tailscale, but never understood why zerotier wasn't more popular
- rollcat 4y ago
  As someone who's currently using ZT (both personally and at work), and evaluating switching over to TS... ZT is absolutely brilliant, but it lacks polish in a few places, that sometimes turn out to be critical. I could probably do a side-by-side comparison table, and ZT would still win in roughly 50% of the cases, but the places where it's losing are causing tiny bits of friction. ZT flow rules are approximately just as powerful as TS ACLs, but TS has an integrated editor that does formatting, validation, inserts hints and snippets for you, etc. TS ACLs also have test rules that allow you to create assertions, about what must (or must not) have access to what, increasing my confidence when making bigger changes. TS allows you to tag assets, making complex ACLs easier to reason about. TS has MagicDNS; with ZT we had to hack something together using their API and a bit of Terraform, and it needs to be rerun every time a node joins/leaves. I could probably write a tiny custom authoritative DNS resolver that talks to ZT API, but TS has it out of the box. We've effectively soft-bricked a ZT node behind an NAT during a routine dist-upgrade, because dpkg stopped to ask a question, in between the old ZT client version going down, and the new one coming back up. That costed us having to go on site in person to service the device (luckily just that one, and not the whole fleet - but we should've picked a canary node with secondary means of access, lessons learned). And to be fair, TS is also far from perfect: it's currently allowing one node to participate in only one tailnet, and switching tailnets requires re-authentication in the web browser. This is incredibly annoying in any BYOD scenario, if you want to have separate personal and work tailnets. ZT is infinitely more flexible here: any device can just join or leave networks at will, and it's up to the network admin to authorize it (once). The list goes on, I really like both tools but the small differences keep adding up in TS' favor.
  - generalizations 4y ago
    Isn't the performance also a difference? From what I understand, Tailscale uses wireguard, and ZT uses some other L2 tech. I haven't had the chance to personally compare, but it seems like that could be an order of magnitude difference in bandwidth between the two options.
AviationAtom 4y ago
I try to escape Tailscale, but they keep trying to suck me back in. Tailscale crew: I know y'all read HN, so I say to you: keep up the good work and innovation!
keepquestioning 4y ago
This speaks like greek to me and I'm a software engineer. Don't get why this incredibly niche company is boosted like crazy on HN.
hoyd 4y ago
I love all the comments in the parenthesis.
Arif18691 4y ago
https://youtube.com/channel/UCjEFU_JKD2MRVNHFIk2HXHg https://youtube.com/channel/UCjEFU_JKD2MRVNHFIk2HXHg
Arif18691 4y ago
https://youtube.com/channel/UCjEFU_JKD2MRVNHFIk2HXHg https://youtube.com/channel/UCjEFU_JKD2MRVNHFIk2HXHg I need viral my YouTube channel subscriber
chaz6 4y ago
One nice way this could be improved is to add support for a wildcard dns record (e.g. *.host.tailnet.ts.net) so you are not limited to a single domain per host.
alwaysanon 4y ago
This is yet another amazing cherry-on-top of an amazing product. I switched Internet providers a couple months ago and was horrified to find that I was now behind a CGNAT. I went looking for a solution to reach my home lab on the go and found Tailscale. Tailscale solved that issue - and I actually had the epiphany that if I couldn't reach my home network without it then nobody else could either. So, maybe the CGNAT is actually a big security benefit in that way - but I digress. I originally was thinking of it like a network-level VPN but realised if I installed it on everything individually it would give me DNS and HTTPS certs for all the machines in my home lab - that work from anywhere as long as my laptop was connected to Tailscale. That is something I always wanted to do with let's encrypt but never got around to. And now this! It has really inspired my imagination. I've been running labs teaching 5-15 people k8s and k8s security out of AWS but this means I might be able to just run a bunch of VMs in my home lab all with Tailscale loaded and point people easily at them all. Maybe with code-server (VS code in a browser) on them to give them a browser-based terminal. And that is just one possible usecase... Thank you Tailscale people - it is such a great product that has exceeded all my expectations!
mikestaub 4y ago
I'm fine with companies making profit off of protocols, as long as their code is open source like https://github.com/firezone/firezone https://github.com/firezone/firezone or https://github.com/zerotier/ZeroTierOne https://github.com/zerotier/ZeroTierOne Tailscale seems great now, but its risky to trust their closed source for this type of service.
- jacooper 4y ago
  That's why headscale exist, its even sponsored by Tailscale!

666 points by soheilpro 4y ago

Sounds promising! I recently got gigabit fiber through Sonic, who does not offer static IP addresses. I did read the article but it is pretty deep in to some stuff I am not that familiar with. Can anyone clarify, if I own some domain name, can I host something on my raspberry pi or whatever and use funnel with my domain so that someone can visit my domain and get to that hosted thing? And how would this compare to dynamic DNS approaches? Thanks!

linsomniac 4y ago
No, you can't use your own domain, this specifically works with the ts.net subdomains. You could use it to host your service on "node.tailnet.ts.net", if you're ok with that naming. Otherwise, you'll need to set up a VPS with tailscale on it, and your own domain, and have it proxy similar to how Funnel works. I assume there are going to be some egress charges for Funnel. Unlike normal tailscale, Funnel has a high bandwidth component to it for hosting high bandwidth services.
- TaylorAlexander 4y ago
  Got it. I thought maybe that would be the case but I wanted to check. Thanks!
- bradfitz 4y ago
  Author here. We might do BYODomain later. It was easier to launch with only *.ts.net. If you're using this for things like webhooks, the URL doesn't matter much.
  - hamishwhc 4y ago
    Anything stopping us from just creating a CNAME to our tailnet domain and registering certs for it instead of whatever.ts.net? This seems like it should work in my head...
    - bradfitz 4y ago
      Our Funnel ingress servers won't proxy any TCP connection that doesn't have a *.ts.net SNI name currently. But BYODomain is something that'd be fun to add.
      - pbronez 4y ago
        BYODomain would be great. This would give me a secure & reliable to host public services out of my homelab.
        anderspitman 4y ago
        It would be great if Tailscale adds this, but there are lots of services that provide this functionality if you need it today, including Cloudflare Tunnel.
      - xyzzy_plugh 4y ago
        Cloudflare's CNAME flattening with proxy enabled would do the trick. The ingress sees a request to the CNAME target so SNI works as usual.
    - tonyarkles 4y ago
      From how I understood the article, they don't do TLS termination but they do SNI snooping to figure out how to route it? So if they don't have all of the infrastructure in place to map the SNI for your CNAME to your Tailscale network, that wouldn't work?
  - SequoiaHope 4y ago
    That's a good point. I have a super simple status page I have wanted to make that would be externally accessible. I don't care what the URL is for that one. I guess this would be a great use for that! That one is behind a Starlink terminal so again, no static IP available there.
  - the100rabh 4y ago
  - bradknowles 4y ago
    What about supporting UDP protocols?
  - linsomniac 4y ago
    The next step is being able to send a redirect to the client's tailscale with the public key of the destination node, so it can establish an anonymous connection directly with the node running the service, using some sort of Funnel ACL (default deny).
- yurymik 4y ago
  I wonder why that's the case. If you own a DNS name, you can set NS record to point to magic-blah.tailscale.net, so they'll have a chance to geo-locate you and return IP address of the closest VM.
- linsomniac 4y ago
  Also, I've been told that it's currently bandwidth limited, with the future holding maybe variable bandwidth limits and bandwidth charges. So a dynamic DNS pointing at your gigabit home connection is likely going to be a better solution than funnel.

ftufek 4y ago

Looks like a nice competition for cloudflare tunnels and ngrok.

biotinker 4y ago

Tailscale is really, really doing a good job of taking all of the different secure remote networking tasks that have always been possible but self-managed and tedious, and wrapping it all in an automated, friendly interface. Every time they come out with a new product, I read about it and think "Wow, that's really useful. That would be such a pain for me to roll by hand." Everything they do was already possible with open source tooling, but they make it accessible. It reminds me of when Dropbox first came out.

jchw 4y ago

It's very nice that it doesn't do TLS termination, but it seems to rely on SNI. That's cool, but it probably precludes SNI encryption in the future. Is there a plan around this? Maybe in the IPv6 world, it becomes a non-issue... But I wonder what comes first: the push for ESNI everywhere, or actually substantial IPv6 adoption. (Edit; though come to think of it, in practice, if the IP address each host resolved to was unique, it wouldn't really matter very much from a security/privacy standpoint, so I guess it's probably not important...)

bradfitz 4y ago
Author here. This shouldn't preclude doing us Encrypted ClientHello in the future. We control the DNS for *.ts.net so we can publish our public key for browsers/etc to encrypt the ClientHello to, if I'm remembering the latest encrypted SNI spec(s)?
- jchw 4y ago
  Ahh, yeah; disregard me, totally can. Cool!

anderspitman 4y ago

This is huge. One of the last major missing features from Tailscale IMO. I maintain a list of tunneling solutions[0]. Personally, I think the future of p2p networking and selfhosting may be through tunneled, SNI-routed TLS connections (exactly what Tailscale just announced). It solves IP exhaustion, NAT, and IP privacy at the cost of an extra hop and no UDP. The big question is going to be pricing. The current top player in this space is Cloudflare Tunnel, which is a loss-leader product that technically forbids selfhosting anything other than HTML sites. Selfhosting media can use tons of bandwidth. Any service that doesn't charge per GB is incentivized to limit your speeds. [0]: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling

api 4y ago
So basically that would mean a cloudflare for P2P, though maintaining data privacy at least. It’s better than no P2P but IPv6 solves exhaustion and NAT without the performance hit or protocol limitations and with no extra third party intermediary in the way. BTW this maintains data privacy but you can still tell a whole whole lot from metadata. On the flip side it would prevent the kind of “griefing” with DDOS that happens every once in a while with self hosted and P2P things. It’s not that common unless you are engaging with certain communities but it is an inherent Internet architectural flaw that this kind of works around (at a cost).
- anderspitman 4y ago
  I envision something more decentralized than Cloudflare[0]. I think you could have local companies in every major city that would own a block of IP addresses and provide tunneling services with SNI routing for people in the same region. They can also provide more expensive services like DDoS protection and caching for popular sites or even on-demand when your mom blog goes viral. > It’s better than no P2P but IPv6 solves exhaustion and NAT without the performance hit or protocol limitations and with no extra third party intermediary in the way. I just don't see ISPs ever implementing IPv6 without governments forcing them to. It enables p2p which increases upload bandwidth requirements and cuts into their bottom line. And even if we get IPv6 you still need the ability to open firewall ports in a way the average user can understand. Not hard technically but that's another standard that everyone is going to have to agree on and implement. [0]: Which I know you can appreciate. "Decentralize until it hurts; centralize until it works" is still one of my mottoes.

deafpiano 4y ago

I was making a service that's half public hosted, and half on tsnet https://tailscale.com/blog/tsnet-virtual-private-services/ https://tailscale.com/blog/tsnet-virtual-private-services/ server the other day, and this is exactly what I was looking for. Having an app that can setup its own completely secure networking no matter where it's run is game changing, as soon as I get into the alpha, the Cloudflare tunnel it's on right now is going down!

thisisthenewme 4y ago

I've been using tailscale in my home setup for a while and really appreciate the simplicity. It has just worked in my experience. Before taking the leap for tailscale I was semi-struggling with a vault + wireguard + consul-template approach which was pretty cool and fun to setup but a bit unnerving to be unsure if I got anything wrong and the chances of me being exposed. This looks like yet another feature that fits my use case and reduces my security burden. Though learning a few things from this post the first being that I should have replaced my use of haproxy with rinetd ages ago. The other about Certificate Transparency logging. Still going through the wiki pages to understand how that works, but would it really log an event such as Tailscale terminating the request, dumping the data, and re-encrypting them before sending us the request? Or is it possible for a bad actor to hide the logging?

detaro 4y ago
> Tailscale terminating the request, dumping ... For that they need a certificate. They have two options of obtaining that: a) They request one from a CA. This will be logged in Certificate Transparency logs, and thus you could detect it by comparing the certs logged with the ones your local machine generated b) they could have their software upload the certificate from your machine. That would need effort to detect (deeply inspecting the software and/or its traffic), but if a whiff of such a "feature" were to be found by anyone it couldn't really be explained away. (and aren't their clients app open-source? then at least it'd be reduced to source inspection and compiling yourself, which makes hiding stuff harder)
- notpushkin 4y ago
  > and aren't their clients app open-source? Only for Linux. (On macOS I think the core CLI part is open source as well, but that's not what most people use I think.)
  - dblohm7 4y ago
    (Tailscalar here) Most of the Tailscale client’s functionality is implemented as a daemon called tailscaled which is in the OSS repo. It’s the GUI front ends for Windows, MacOS and iOS that are not.

matthewaveryusa 4y ago

If I CNAME my domain to my assigned ts.net then I'm guessing funnel won't work because of the SNI lookup will it? Is that on the radar? Right now I'm using cloudflared but if I can get rid of it in favor of this that would be one less daemon to worry about. Wouldn't be able to do esni though. sooo, how about a vanity .ts.net I get to choose?

8K832d7tNmiQ 4y ago

if there's anyone from tailscale is currently lurking this post: 1. How much traffic cost would you expect to get into your DERP instances when this service will be available globally? 2. How much bandwidth would you prepare just for proxying these nodes into public network? 3. How do you think some users might abuse this service in the future?

kevmo314 4y ago
It looks like they're bracing for a lot of traffic or abuse: > Limitations > - DNS names are restricted to that of your tailnet’s domain name. > - The ports you can specify to expose your servers on are currently to 443, 8443 and 10000. > - Traffic over Funnel is subject to bandwidth limits. They are not currently configurable. I was thinking this would be cool to run some live video stuff on, but maybe that's too much bandwidth for now :)
- 2bluesc 4y ago
  I'd love to learn what the bandwidth limits are.
anonymouse008 4y ago
This is the 'logistics' level questioning. "Amateurs talk strategy; professionals talk logistics"

deleted 4y ago

[deleted]

aquaticsunset 4y ago

Tailscale and the people building it continue to blow me away. The ingenuity, reliability, polish, and speed of feature delivery are unparalleled in software. I'm eager to get rid of needing DDNS and open ports just for web hooks. And I can "flatten" my stack by cutting out a reverse proxy / weird port forwarding stuff.

slondr 4y ago
Though, strictly speaking, all of that was already possible with ip6
- Rebelgecko 4y ago
  Sure. I don't think tailscale does anything that's impossible through other means (cue comments about how anyone can recreate Dropbox with an FTP server, svn, and a fuse file system). IMO whats great about it is that it's easy to set up and is incredibly low maintenance (at least they way I use it).
  - parhamn 4y ago
    Further, and to their credit theres a lot of great tech in there. Just the other day I stumbled on DERP [1] their wireguard-over-tcp (over their node network) implementation which they fall back to if NAT traversal fails. While sure, this is partly ipv4 problem, it recently helped me connect with friends behind government firewalls, presumably because the packets aren't recognized yet. But that sort of automated connectivity during nat traversal failure through a global network of edges isn't something you can easily setup yourself (if you care). [1] github.com/tailscale/tailscale/tree/main/derp
- anderspitman 4y ago
  It's about 40% possible with IPv6: https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html
  - 4y ago

yewenjie 4y ago

This means selfhosters don't need anything other than a domain name and a local machine, right? Technically is it very different from Cloudflare Tunnels?

anderspitman 4y ago
You actually can't use your own domain yet, but looks like there's a good chance they add that based on @bradfitz's comments.

jsd1982 4y ago

I really want to like Tailscale but I couldn't easily find a way for it to work on a jumpbox running Ubuntu 14.04 that I don't have root access to. Anyone have a way to install the client on a non-rooted box? I couldn't find anything in the docs about the assumption that it requires root or not, other than it being implied by their install steps using system package managers.

dave_universetf 4y ago
You can grab static binary tarballs on https://pkgs.tailscale.com https://pkgs.tailscale.com and then run tailscale in userspace mode: https://tailscale.com/kb/1112/userspace-networking/ https://tailscale.com/kb/1112/userspace-networking/.
- jsd1982 4y ago
  Nice, thank you! I got it to work.

gz5 4y ago

>Maybe you need to receive a webhook from GitHub There are also free options, e.g. ngrok [0] And open source options, e.g. openziti [1] Doing webhooks and dark webhooks for quite some time. Always good to have more options - what does Funnel do differently than those? [0] https://blog.ngrok.com/posts/getting-started-with-webhooks https://blog.ngrok.com/posts/getting-started-with-webhooks [1] https://openziti.io/my-intern-assignment-call-a-dark-webhook-from-aws-lambda https://openziti.io/my-intern-assignment-call-a-dark-webhook...

tasn 4y ago
What's a "dark webhook"? Also, funny they should mention Github, as they literally just added webhook tunneling to the Github CLI a few days ago.
- dovholuknf 4y ago
  A "dark webhook" in this case just means sending data from a public server/service like a GitHub action (or even an AWS Lambda) to a server that doesn't have a port open on the internet. For example, I get a message to my Mattermost client everytime someone pushes/commits/etc. All those messages are sent to the Mattermost server over a webhook that is configured on an overlay network (in our case, using OpenZiti). There's no firewall rule allowing the traffic to the Mattermost server, it's "dark" to the internet.
  - tasn 4y ago
    I assumed it would be something about the "dark web", never heard the term used for services that are behind a firewall. TIL.
Komodai 4y ago

n42 4y ago

genuine question -- why would I use this?

nelsonenzo 4y ago
you could self host a website. Or more realistically, if you are in web dev and wanted to show your work on your local machine - say when the CEO wants to 'check in and see how its going', you can just send them a link on slack and they can play with what your developing on.
- n42 4y ago
  why do I need a tailnet to self host? can't the CEO just use the Tailscale network to access it privately? I just don't personally see a use case -- if I need someone to access the content, the box it is on is already easy to publicly access. if it's not, the only people who need to see it are on the Tailscale network edit: I think I'm starting to see it. it's not for long term installations. I just feel like, why not just open the box to the internet at that point. it makes more sense for the edge case(s) that might address friction with adoption. interim solutions, or temporary connections edit2: I can also see how this might be useful for people living under an oppressive government
  - bradwood 4y ago
    > can't the CEO just use the Tailscale network to access it privately How many CEOs you know gonna install a VPN client on their workstation to see your stuff?
  - anderspitman 4y ago
    IMO it will be much more useful when they add custom domains so you can host things like public websites.
    - n42 4y ago
      the more I sit with it the more I can see different ways it might be valuable. even if it's just to simplify setup. the use cases just didn't really jump out to me this time, even as a happy Tailscale user

RL_Quine 4y ago

I'd still love for them to support some other form of auth, Google or Microsoft auth is an incredible drag as a gatekeeper to their product.

anderspitman 4y ago
They had an interesting conversation about this: https://twitter.com/bradfitz/status/1248458084705431555 https://twitter.com/bradfitz/status/1248458084705431555
bradfitz 4y ago
We want other forms too. More will come.
pomatic 4y ago
We left them because of this. Long overdue move away from Gmail Gsuite resulted in TS costs for our dozen user team at least doubling; the overhead involved in managing the overlay network acls was also getting out of hand too.

nelsonenzo 4y ago

this is cool and all, love me Tailscale for sure. For this particular feature I like my own home rolled solution where I automated the process of spinning up a tiny ec2 server with an nginx proxy to a reverse ssh tunnel that goes back to my local machine. It gets a letsencrypt cert and modifies the route53 dns. All managed with a cli command and config file. The other benefit is that it is completely unthrottled, which is particularly useful if your debugging some stupidly large react/vue website. Im working on a feature that will enable basic-auth in front of it also, so at least a password would be required to send traffic to your local machine, if you wanted. Good for the "share your work" sort of scenarios. tl;dr if you want any-subdomain.your-domain.com -> localhost:port, and you use AWS, try https://github.com/nelsonenzo/tolocal https://github.com/nelsonenzo/tolocal

anderspitman 4y ago
If you're having fun, don't let me stop you, but there are tons of open source projects to simplify this process: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling
- nelsonenzo 4y ago
  Cool list, thanks for sharing. Unfortunately none of those solutions are self hosted AND automated. They all seem to either use their own ifra, which will be slow & throttled, or require setting up a server and manually editing DNS. I may try to get my own project added to that list though, so thanks for sharing!
  - alexellisuk 4y ago
    We've done a lot of work on "self-hosted AND automated" inletsctl - automates a VM with the inlets tunnel server preinstalled, including with HTTPS termination with Let's Encrypt, or pure TCP pass-through inlets-operator - the same for Kubernetes Load Balancer services Feel free to take a look at https://inlets.dev/ https://inlets.dev/ We talk a lot about the community adoption here in the first half -https://inlets.dev/blog/2022/11/16/service-provider-uplinks.html https://inlets.dev/blog/2022/11/16/service-provider-uplinks.... (I'm the original founder of inlets)

inquirer39243 4y ago

Is there any updates on being able to use the IOS app for self hosted tailscale? Also what is the status of fully self hosted tailscale in general? I just don't trust my VPN to be managed by a 3rd party like this. I'm willing to pay money even (though I don't have much) for hobby use - but I don't like the possibility of exposing network devices like this. To be honest I'm a bit surprised seemingly everyone else is.

anderspitman 4y ago
All depends on your threat model.
deleted 4y ago
[deleted]
5e92cb50239222b 4y ago
Not everyone, we just don't talk about it much. headscale is plenty popular — that's not "everyone" already. https://github.com/juanfont/headscale https://github.com/juanfont/headscale In addition to your points, we over here also have our own reasons for self-hosting everything (for example, to protect ourselves from being cancelled at any moment for being forced into a citizenship you didn't ask for by being born at the wrong place).

jacooper 4y ago

This looks like cloudflare tunnel without the MITM attack!. I'm interested to see the limits they put on this, I dont think its going to be as limitless as Cloudflared.

anderspitman 4y ago
Also without the CDN (which I'm not sure how you'd do without MITM), but this is definitely comparable to Cloudflare Tunnel.
- jacooper 4y ago
  Yup, not everyone needs a CDN.

tsujamin 4y ago

Something else interesting they're doing is their tsnet package, which lets you join your process to the tailnet and bind tcp listeners/connect to TCP services via their tailnet IP or subnet. I'm writing some stuff using this at the moment, but I also just saw https://github.com/tailscale/golink https://github.com/tailscale/golink which does the same thing: a single binary that runs a link shortener that joins itself to your tailnet. tl;dr: don't run your service on a machine then join that to tailnet, directly bind your service to an in-memory tailnet client

anderspitman 4y ago
I wasn't aware of tsnet. That's super cool.
- tsujamin 4y ago
  Its very cool, some thoughts: * They have support in there to get an API client that auths using your nodekey - not sure what endpoints it can hit but makes for some interesting cases like updating ACLs maybe * You can use it as an exit node/subnet router too, but it requires some hacking * Equally there UDP support lurking in their library you can wire up too

syntaxing 4y ago

Does this mean I can expose home assistant online without worrying too much about security?

hamandcheese 4y ago
Are you trying to share home assistant with everyone on the internet? If yes, then yes. You probably don't want that, though, so vanilla Tailscale would let only you securely access your home assistant server from anywhere, as long as you install the Tailscale VPN app.
- sumitgt 4y ago
  This. You can anyways access Jome Assistant over tailscale without all this. I think there is even a Tailscale addon for HA.

2bluesc 4y ago

I'm surprised they don't allow exit nodes to function as funnel servers. Seems to me this would save them the hassle of dealing with the bandwidth.

apenwarr 4y ago
Exit nodes are usually still behind your firewall and have no open incoming ports. If you're willing to reconfigure your firewall to open incoming ports, you probably didn’t need Funnel in the first place.

otar 4y ago

Tailscale is on fire. I am watching it very closely and considering to set it up for my small team.

aborsy 4y ago

As soon as Tailscale provides option for Wireguard preshared keys, I will use it. I need Tailscale out of my network. Any plan? Self hosting Tailscale will then not be needed, since users don’t need to trust Tailscale anymore.

rollcat 4y ago
What do you mean by "trust", what's your threat model? Tailscale does way, way more than just facilitate key exchange. If tailscale.com goes down or rogue, you're still in a pickle even with PSKs; just because there's a Wireguard under the hood, doesn't mean you can swap an API endpoint and continue as if nothing happened. Even with self-provided PSKs, you're going for an (IMHO) pretty poor trade-off; keys, certificates, etc should be regularly rotated, that's a chore that's best left automated. At that point, why not just set up Wireguard yourself? If you have legitimate concerns, you should be using Headscale[1] (or even plain Wireguard) from day 1. Otherwise - personally I find the current threat model very reasonable, it's in no way worse than trusting any other VPN provider, and they're keeping a pretty big chunk of their code base open for auditing. [1]: https://github.com/juanfont/headscale https://github.com/juanfont/headscale

sixhobbits 4y ago

Maybe I have a fundamental misunderstanding of how Tailscale works, but I always feel like there is a disconnect in how it is received on HN. Usually people are pretty critical/cynical of sending sensitive data to a closed source third party server, no matter how strong their claims of 'being the good guys' are (eg see Telegram). But somehow we're all meant to be happy giving full control of our entire network to a commercial company running a closed source command and control server?

ocimbote 4y ago
I think that by the sheer nature of Wireguard, it doesn't matter much. We don't send any readable data to Tailscale, they, for the greater part, handle plumbing between nodes. What goes in the pipes remains unnoticed and unknown to them. Their MagicDNS feature may raise different concerns though, but I'll let others comment on it.
- edf13 4y ago
  This new service allows them (or if they’re hacked - anyone)… to MitM your connections - they state themselves they could ssl terminate the connections as they own the ts.net level, they say they don’t but that’s now…
  - ignoramous 4y ago
    > This new service allows them (or if they’re hacked - anyone)… to MitM your connections... TFA mentions that the immutable certificate logs reveal if something spooky is going on. Not enough of a guarantee since the tailscale client may siphon off certs from a local device to its servers anyway. But that's us being extremely paranoid about tailscale (in which case, why use it?). Second, most services are run behind reverse-proxying load balancers which invariably are setup to "MiTM" aka terminate TLS. The providers running those load balancers control IPs + DNS records too, for good measure. I guess, supporting a dizzying array of functionality makes Tailscale a decentralised cloud service provider themselves.
deleted 4y ago
[deleted]

shepherdjerred 4y ago

Another great feature from Tailscale! Ever since I started using Tailscale a year or two ago, I haven't had to think much about networking for my self-hosted servers at home. It all _just works_. Tailscale is a great example of software solving a real problem in a user friendly way.

kybernetyk 4y ago

So this is just a Wireguard wrapper with a shiny UI? Why is this so hyped?

Operyl 4y ago
Because it’s not the basic Wireguard part itself that’s hard, it’s the synchronized keys, NAT busting, ACLs, and other things on top of it that are. Tailscale has made it incredibly easy to deploy and use confidently and that’s why people are happy.
- kybernetyk 4y ago
  So offloading a critical part of your infrastructure to a $5/mo service is a good idea now?
  - rs_rs_rs_rs_rs 4y ago
    ...yes? You're already offloading critical parts of your infrastructure anyway.
  - biorach 4y ago
    welcome to 2010
  - Operyl 4y ago
    Given the immense trust I have for the names behind Tailscale, sure. I don’t run my own data centers, either, so it is a sound business decision to offload this too.
  - lijogdfljk 4y ago
    To a novice, how else would you do it? Ie i can self host most of this, but wouldn't i be hosting it on literally a $5mo VPS with a static IP to work around my homes dynamic IP?
sph 4y ago
Your comment has strong "what does Dropbox do that curlftpfs doesn't?" energy.

m1ckey 4y ago

Related product from Cloudflare: https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/ https://developers.cloudflare.com/cloudflare-one/connections...

asim 4y ago

Now I'm like. OK tailscale, give me custom domains and I'm sold. Where are you @bradfitz!

School-Cotton 4y ago

If I understand correctly, this still won’t let me achieve my dream of hosting my personal email on my home computer, because smtp connections typically start out as plaintext and then negotiate up to TLS within the protocol itself.

jbverschoor 4y ago

I love tailscale, but never understood why zerotier wasn't more popular

rollcat 4y ago
As someone who's currently using ZT (both personally and at work), and evaluating switching over to TS... ZT is absolutely brilliant, but it lacks polish in a few places, that sometimes turn out to be critical. I could probably do a side-by-side comparison table, and ZT would still win in roughly 50% of the cases, but the places where it's losing are causing tiny bits of friction. ZT flow rules are approximately just as powerful as TS ACLs, but TS has an integrated editor that does formatting, validation, inserts hints and snippets for you, etc. TS ACLs also have test rules that allow you to create assertions, about what must (or must not) have access to what, increasing my confidence when making bigger changes. TS allows you to tag assets, making complex ACLs easier to reason about. TS has MagicDNS; with ZT we had to hack something together using their API and a bit of Terraform, and it needs to be rerun every time a node joins/leaves. I could probably write a tiny custom authoritative DNS resolver that talks to ZT API, but TS has it out of the box. We've effectively soft-bricked a ZT node behind an NAT during a routine dist-upgrade, because dpkg stopped to ask a question, in between the old ZT client version going down, and the new one coming back up. That costed us having to go on site in person to service the device (luckily just that one, and not the whole fleet - but we should've picked a canary node with secondary means of access, lessons learned). And to be fair, TS is also far from perfect: it's currently allowing one node to participate in only one tailnet, and switching tailnets requires re-authentication in the web browser. This is incredibly annoying in any BYOD scenario, if you want to have separate personal and work tailnets. ZT is infinitely more flexible here: any device can just join or leave networks at will, and it's up to the network admin to authorize it (once). The list goes on, I really like both tools but the small differences keep adding up in TS' favor.
- generalizations 4y ago
  Isn't the performance also a difference? From what I understand, Tailscale uses wireguard, and ZT uses some other L2 tech. I haven't had the chance to personally compare, but it seems like that could be an order of magnitude difference in bandwidth between the two options.

AviationAtom 4y ago

I try to escape Tailscale, but they keep trying to suck me back in. Tailscale crew: I know y'all read HN, so I say to you: keep up the good work and innovation!

keepquestioning 4y ago

This speaks like greek to me and I'm a software engineer. Don't get why this incredibly niche company is boosted like crazy on HN.

hoyd 4y ago

I love all the comments in the parenthesis.

Arif18691 4y ago

https://youtube.com/channel/UCjEFU_JKD2MRVNHFIk2HXHg https://youtube.com/channel/UCjEFU_JKD2MRVNHFIk2HXHg

Arif18691 4y ago

https://youtube.com/channel/UCjEFU_JKD2MRVNHFIk2HXHg https://youtube.com/channel/UCjEFU_JKD2MRVNHFIk2HXHg I need viral my YouTube channel subscriber

chaz6 4y ago

One nice way this could be improved is to add support for a wildcard dns record (e.g. *.host.tailnet.ts.net) so you are not limited to a single domain per host.

alwaysanon 4y ago

This is yet another amazing cherry-on-top of an amazing product. I switched Internet providers a couple months ago and was horrified to find that I was now behind a CGNAT. I went looking for a solution to reach my home lab on the go and found Tailscale. Tailscale solved that issue - and I actually had the epiphany that if I couldn't reach my home network without it then nobody else could either. So, maybe the CGNAT is actually a big security benefit in that way - but I digress. I originally was thinking of it like a network-level VPN but realised if I installed it on everything individually it would give me DNS and HTTPS certs for all the machines in my home lab - that work from anywhere as long as my laptop was connected to Tailscale. That is something I always wanted to do with let's encrypt but never got around to. And now this! It has really inspired my imagination. I've been running labs teaching 5-15 people k8s and k8s security out of AWS but this means I might be able to just run a bunch of VMs in my home lab all with Tailscale loaded and point people easily at them all. Maybe with code-server (VS code in a browser) on them to give them a browser-based terminal. And that is just one possible usecase... Thank you Tailscale people - it is such a great product that has exceeded all my expectations!

mikestaub 4y ago

I'm fine with companies making profit off of protocols, as long as their code is open source like https://github.com/firezone/firezone https://github.com/firezone/firezone or https://github.com/zerotier/ZeroTierOne https://github.com/zerotier/ZeroTierOne Tailscale seems great now, but its risky to trust their closed source for this type of service.

jacooper 4y ago
That's why headscale exist, its even sponsored by Tailscale!