4 ms·
As someone who's currently using ZT (both personally and at work), and evaluating switching over to TS... ZT is absolutely brilliant, but it lacks polish in a
by rollcat 4y ago
As someone who's currently using ZT (both personally and at work), and evaluating switching over to TS...
ZT is absolutely brilliant, but it lacks polish in a few places, that sometimes turn out to be critical. I could probably do a side-by-side comparison table, and ZT would still win in roughly 50% of the cases, but the places where it's losing are causing tiny bits of friction.
ZT flow rules are approximately just as powerful as TS ACLs, but TS has an integrated editor that does formatting, validation, inserts hints and snippets for you, etc. TS ACLs also have test rules that allow you to create assertions, about what must (or must not) have access to what, increasing my confidence when making bigger changes.
TS allows you to tag assets, making complex ACLs easier to reason about.
TS has MagicDNS; with ZT we had to hack something together using their API and a bit of Terraform, and it needs to be rerun every time a node joins/leaves. I could probably write a tiny custom authoritative DNS resolver that talks to ZT API, but TS has it out of the box.
We've effectively soft-bricked a ZT node behind an NAT during a routine dist-upgrade, because dpkg stopped to ask a question, in between the old ZT client version going down, and the new one coming back up. That costed us having to go on site in person to service the device (luckily just that one, and not the whole fleet - but we should've picked a canary node with secondary means of access, lessons learned).
And to be fair, TS is also far from perfect: it's currently allowing one node to participate in only one tailnet, and switching tailnets requires re-authentication in the web browser. This is incredibly annoying in any BYOD scenario, if you want to have separate personal and work tailnets. ZT is infinitely more flexible here: any device can just join or leave networks at will, and it's up to the network admin to authorize it (once).
The list goes on, I really like both tools but the small differences keep adding up in TS' favor.
- generalizations 4y agoIsn't the performance also a difference? From what I understand, Tailscale uses wireguard, and ZT uses some other L2 tech. I haven't had the chance to personally compare, but it seems like that could be an order of magnitude difference in bandwidth between the two options.
- rollcat 4y agoWe're neither latency- nor bandwidth-sensitive, and both services are overall quite reliable, so I haven't actually paid much attention to that aspect. But there are plenty of war stories of people using ZT or TS to do absolutely bonkers stuff, like zero-downtime migrations between cloud providers, with a write-heavy DB in there. I wholeheartedly recommend doing your own benchmarks! Everyone's workload will be slightly different, ultimately you should pick what works best for you.
- generalizations 4y agoI'll definitely have to do my own benchmarks! It's been weird how infrequently VPN tech is benchmarked. It's not easy to dig up hard numbers on bandwidth.
- anderspitman 4y agoIt's worth noting that Tailscale runs WireGuard in userspace, which negates many (all?) of the performance benefits. I wonder if it will ever be possible for nonroot users to create WireGuard devices. They're just so useful.
- rollcat 4y agoOut of curiosity, what kinds of performance benefits are kernelspace-exclusive, in terms of VPN apps? I've seen arguments go both ways for different applications, with full usermode TCP/IP stacks, unikernels, even running apps directly on the NIC (snabb switch); historically there were also efforts like khttpd that ultimately failed.
- anderspitman 4y agoI don't know much about what where specific gains come from. Generally avoiding copies and syscalls go a long way. I suspect in many cases WireGuard performance isn't going to be your bottleneck, but in those cases you're still reducing power consumption.
- jbverschoor 4y agoYea this has been exactly my experience as well. TS uses WG, so that might save so engineering time as well, and they really focus on creating usable features.
- hawski 4y agoRegarding DNS, in my small private network I use Avahi and nss-mdns with ZT.