4 ms·

Isn't the performance also a difference? From what I understand, Tailscale uses wireguard, and ZT uses some other L2 tech. I haven't had the chance to personall

Isn't the performance also a difference? From what I understand, Tailscale uses wireguard, and ZT uses some other L2 tech. I haven't had the chance to personally compare, but it seems like that could be an order of magnitude difference in bandwidth between the two options.

rollcat 4y ago
We're neither latency- nor bandwidth-sensitive, and both services are overall quite reliable, so I haven't actually paid much attention to that aspect. But there are plenty of war stories of people using ZT or TS to do absolutely bonkers stuff, like zero-downtime migrations between cloud providers, with a write-heavy DB in there. I wholeheartedly recommend doing your own benchmarks! Everyone's workload will be slightly different, ultimately you should pick what works best for you.
- generalizations 4y ago
  I'll definitely have to do my own benchmarks! It's been weird how infrequently VPN tech is benchmarked. It's not easy to dig up hard numbers on bandwidth.
anderspitman 4y ago
It's worth noting that Tailscale runs WireGuard in userspace, which negates many (all?) of the performance benefits. I wonder if it will ever be possible for nonroot users to create WireGuard devices. They're just so useful.
- rollcat 4y ago
  Out of curiosity, what kinds of performance benefits are kernelspace-exclusive, in terms of VPN apps? I've seen arguments go both ways for different applications, with full usermode TCP/IP stacks, unikernels, even running apps directly on the NIC (snabb switch); historically there were also efforts like khttpd that ultimately failed.
  - anderspitman 4y ago
    I don't know much about what where specific gains come from. Generally avoiding copies and syscalls go a long way. I suspect in many cases WireGuard performance isn't going to be your bottleneck, but in those cases you're still reducing power consumption.

rollcat 4y ago

We're neither latency- nor bandwidth-sensitive, and both services are overall quite reliable, so I haven't actually paid much attention to that aspect. But there are plenty of war stories of people using ZT or TS to do absolutely bonkers stuff, like zero-downtime migrations between cloud providers, with a write-heavy DB in there. I wholeheartedly recommend doing your own benchmarks! Everyone's workload will be slightly different, ultimately you should pick what works best for you.

generalizations 4y ago
I'll definitely have to do my own benchmarks! It's been weird how infrequently VPN tech is benchmarked. It's not easy to dig up hard numbers on bandwidth.

anderspitman 4y ago

It's worth noting that Tailscale runs WireGuard in userspace, which negates many (all?) of the performance benefits. I wonder if it will ever be possible for nonroot users to create WireGuard devices. They're just so useful.

rollcat 4y ago
Out of curiosity, what kinds of performance benefits are kernelspace-exclusive, in terms of VPN apps? I've seen arguments go both ways for different applications, with full usermode TCP/IP stacks, unikernels, even running apps directly on the NIC (snabb switch); historically there were also efforts like khttpd that ultimately failed.
- anderspitman 4y ago
  I don't know much about what where specific gains come from. Generally avoiding copies and syscalls go a long way. I suspect in many cases WireGuard performance isn't going to be your bottleneck, but in those cases you're still reducing power consumption.