5 ms·

Leaving aside adoption, there is a degree to which HN is impressed that Tailscale has taken a set of technical problems that have caused many of us pain over th

Leaving aside adoption, there is a degree to which HN is impressed that Tailscale has taken a set of technical problems that have caused many of us pain over the years and that drive some less than ideal setups and just made them go away. They are magically taken care of behind an easy to use setup that Just Works. There's basically none of the "you have to tweak this setting under this circumstance" needed to get it working. That is difficult engineering requiring people who understand the problem domain and have a clear picture of the right architecture, as well as good product engineering.

djbusby 4y ago
Isn't TailScale "just" WireGuard?
- apitman 4y ago
  No. For example: https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/
- rkangel 4y ago
  Nope. It's Wireguard 'underneath' but a whole lot more over the top. Try this: Go set up a Wireguard connection from your PC at home to one at work. Then do the same thing with tailscale. One will be a lot easier than the other. And that's only 2 computers...
  - djbusby 4y ago
    Um. I already have like 100s of WG connection. Office to cloud, various servers all over connected to others, servers on many WG "subnets". WG is the easiest VPN I've ever used. Dropped all these other crazy rigs (stunnel, ssh-tunnel, etc) cause WG always "just works" and is on every platform. However, I've spent loads of time as network admin, planning IP-space for VPN layers, first time in 1997.
  - deleted 4y ago
    [deleted]
- rudasn 4y ago
  I think tailscale may be the only company that is build on WireGuard but also commits code to wireguard repo itself. That says a lot, to me at least, but parent's comment on giving the keys to the kingdom to a third party still holds (as it does for many other SaaS/cloud/hosted platforms of course).
- mbreese 4y ago
  Yes. It is just Wireguard… with a bit of magic on top. As far as I can tell, the Tailscale magic is maintaining and distributing a wg.conf that is setup for a dynamic mesh Wireguard network. To do this (and in particular the NAT traversal aspect), they use their own software to setup and figure out NAT ports. One you have Wireguard figured out, it’s pretty easy to setup a hub and spoke model VPN, especially if you have a static server somewhere. Setting up a dynamic mesh VPN is another thing entirely and doing it without requiring a server from Tailscale to be part of the network is, like I said, a bit of magic. It’s a straightforward setup that they explain quite well on their site. But to actually make it work is quite impressive to me.
  - nine_k 4y ago
    > without requiring a server from Tailscale AFAICT, Tailscale does not route your traffic through its servers (because it would be costly, among other things), but it does control your VPN nodes to distribute all the configuration fairy dust. So a server from Tailscale is still needed (and billed for).
    - mbreese 4y ago
      Right, the command and control server -- but that server does not need to be part of your private Tailscale/WG network. The Tailscale server is only required for coordinating the WG configuration. My point was that this was all done without the Tailscale server needing to actually participate in your private network. That is to say, the Tailscale server can't monitor your traffic or private servers. Except of course in the case of Funnel... which is the original subject here. In this case, the Tailscale ingress server is added to your private network/nodelist. This it so that it can communicate with whatever private service you are running and then proxy that back out to the public Internet.

djbusby 4y ago

Isn't TailScale "just" WireGuard?

apitman 4y ago
No. For example: https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/
rkangel 4y ago
Nope. It's Wireguard 'underneath' but a whole lot more over the top. Try this: Go set up a Wireguard connection from your PC at home to one at work. Then do the same thing with tailscale. One will be a lot easier than the other. And that's only 2 computers...
- djbusby 4y ago
  Um. I already have like 100s of WG connection. Office to cloud, various servers all over connected to others, servers on many WG "subnets". WG is the easiest VPN I've ever used. Dropped all these other crazy rigs (stunnel, ssh-tunnel, etc) cause WG always "just works" and is on every platform. However, I've spent loads of time as network admin, planning IP-space for VPN layers, first time in 1997.
- deleted 4y ago
  [deleted]
rudasn 4y ago
I think tailscale may be the only company that is build on WireGuard but also commits code to wireguard repo itself. That says a lot, to me at least, but parent's comment on giving the keys to the kingdom to a third party still holds (as it does for many other SaaS/cloud/hosted platforms of course).
mbreese 4y ago
Yes. It is just Wireguard… with a bit of magic on top. As far as I can tell, the Tailscale magic is maintaining and distributing a wg.conf that is setup for a dynamic mesh Wireguard network. To do this (and in particular the NAT traversal aspect), they use their own software to setup and figure out NAT ports. One you have Wireguard figured out, it’s pretty easy to setup a hub and spoke model VPN, especially if you have a static server somewhere. Setting up a dynamic mesh VPN is another thing entirely and doing it without requiring a server from Tailscale to be part of the network is, like I said, a bit of magic. It’s a straightforward setup that they explain quite well on their site. But to actually make it work is quite impressive to me.
- nine_k 4y ago
  > without requiring a server from Tailscale AFAICT, Tailscale does not route your traffic through its servers (because it would be costly, among other things), but it does control your VPN nodes to distribute all the configuration fairy dust. So a server from Tailscale is still needed (and billed for).
  - mbreese 4y ago
    Right, the command and control server -- but that server does not need to be part of your private Tailscale/WG network. The Tailscale server is only required for coordinating the WG configuration. My point was that this was all done without the Tailscale server needing to actually participate in your private network. That is to say, the Tailscale server can't monitor your traffic or private servers. Except of course in the case of Funnel... which is the original subject here. In this case, the Tailscale ingress server is added to your private network/nodelist. This it so that it can communicate with whatever private service you are running and then proxy that back out to the public Internet.