4 ms·
Yes. It is just Wireguard… with a bit of magic on top. As far as I can tell, the Tailscale magic is maintaining and distributing a wg.conf that is setup for a
by mbreese 4y ago
Yes. It is just Wireguard… with a bit of magic on top.
As far as I can tell, the Tailscale magic is maintaining and distributing a wg.conf that is setup for a dynamic mesh Wireguard network. To do this (and in particular the NAT traversal aspect), they use their own software to setup and figure out NAT ports.
One you have Wireguard figured out, it’s pretty easy to setup a hub and spoke model VPN, especially if you have a static server somewhere. Setting up a dynamic mesh VPN is another thing entirely and doing it without requiring a server from Tailscale to be part of the network is, like I said, a bit of magic. It’s a straightforward setup that they explain quite well on their site. But to actually make it work is quite impressive to me.
- nine_k 4y ago> without requiring a server from Tailscale AFAICT, Tailscale does not route your traffic through its servers (because it would be costly, among other things), but it does control your VPN nodes to distribute all the configuration fairy dust. So a server from Tailscale is still needed (and billed for).
- mbreese 4y agoRight, the command and control server -- but that server does not need to be part of your private Tailscale/WG network. The Tailscale server is only required for coordinating the WG configuration. My point was that this was all done without the Tailscale server needing to actually participate in your private network. That is to say, the Tailscale server can't monitor your traffic or private servers. Except of course in the case of Funnel... which is the original subject here. In this case, the Tailscale ingress server is added to your private network/nodelist. This it so that it can communicate with whatever private service you are running and then proxy that back out to the public Internet.