4 ms·

Author here. We might do BYODomain later. It was easier to launch with only *.ts.net. If you're using this for things like webhooks, the URL doesn't matter mu

Author here. We might do BYODomain later. It was easier to launch with only *.ts.net. If you're using this for things like webhooks, the URL doesn't matter much.

hamishwhc 4y ago
Anything stopping us from just creating a CNAME to our tailnet domain and registering certs for it instead of whatever.ts.net? This seems like it should work in my head...
- bradfitz 4y ago
  Our Funnel ingress servers won't proxy any TCP connection that doesn't have a *.ts.net SNI name currently. But BYODomain is something that'd be fun to add.
  - pbronez 4y ago
    BYODomain would be great. This would give me a secure & reliable to host public services out of my homelab.
    - anderspitman 4y ago
      It would be great if Tailscale adds this, but there are lots of services that provide this functionality if you need it today, including Cloudflare Tunnel.
  - xyzzy_plugh 4y ago
    Cloudflare's CNAME flattening with proxy enabled would do the trick. The ingress sees a request to the CNAME target so SNI works as usual.
- tonyarkles 4y ago
  From how I understood the article, they don't do TLS termination but they do SNI snooping to figure out how to route it? So if they don't have all of the infrastructure in place to map the SNI for your CNAME to your Tailscale network, that wouldn't work?
SequoiaHope 4y ago
That's a good point. I have a super simple status page I have wanted to make that would be externally accessible. I don't care what the URL is for that one. I guess this would be a great use for that! That one is behind a Starlink terminal so again, no static IP available there.
the100rabh 4y ago
bradknowles 4y ago
What about supporting UDP protocols?
linsomniac 4y ago
The next step is being able to send a redirect to the client's tailscale with the public key of the destination node, so it can establish an anonymous connection directly with the node running the service, using some sort of Funnel ACL (default deny).

Author here. We might do BYODomain later. It was easier to launch with only *.ts.net. If you're using this for things like webhooks, the URL doesn't matter much.

hamishwhc 4y ago

Anything stopping us from just creating a CNAME to our tailnet domain and registering certs for it instead of whatever.ts.net? This seems like it should work in my head...

bradfitz 4y ago
Our Funnel ingress servers won't proxy any TCP connection that doesn't have a *.ts.net SNI name currently. But BYODomain is something that'd be fun to add.
- pbronez 4y ago
  BYODomain would be great. This would give me a secure & reliable to host public services out of my homelab.
  - anderspitman 4y ago
    It would be great if Tailscale adds this, but there are lots of services that provide this functionality if you need it today, including Cloudflare Tunnel.
- xyzzy_plugh 4y ago
  Cloudflare's CNAME flattening with proxy enabled would do the trick. The ingress sees a request to the CNAME target so SNI works as usual.
tonyarkles 4y ago
From how I understood the article, they don't do TLS termination but they do SNI snooping to figure out how to route it? So if they don't have all of the infrastructure in place to map the SNI for your CNAME to your Tailscale network, that wouldn't work?

SequoiaHope 4y ago

That's a good point. I have a super simple status page I have wanted to make that would be externally accessible. I don't care what the URL is for that one. I guess this would be a great use for that! That one is behind a Starlink terminal so again, no static IP available there.

the100rabh 4y ago

bradknowles 4y ago

What about supporting UDP protocols?

linsomniac 4y ago

The next step is being able to send a redirect to the client's tailscale with the public key of the destination node, so it can establish an anonymous connection directly with the node running the service, using some sort of Funnel ACL (default deny).