11 ms·
Tailscale Funnel now available in beta
- born-jre 4y agoself promo: Something like this but no server at all would be cool. wip, https://github.com/temphia/lpweb https://github.com/temphia/lpweb
- wasd 4y agodoes it work with subdomains?
- xeonmc 4y agoIs it possible to use this to host a Headscale server from behind NAT?
- 5evOX5hTZ9mYa9E 4y agoThis is kinda like CloudFlare tunnel?
- fuzzybear3965 4y agoKind of in the sense that it exposes a LAN-accessible service to the WAN, it seems to me. Also kind of like ngrok in the same sense.
- nirav72 4y agoyes. But hopefully without some of the limitation due to CF's TOS.
- aofeisheng 4y agoNo. Cloudflare Tunnel is basically a Layer 7 proxy. And most importantly, Cloudflare Tunnel is a MITM.
- deleted 4y ago[deleted]
- halJordan 4y agoFrom the article: When you turn on Funnel, we create public DNS records for your node.tailnet.ts.net name that points to a set of ingress servers we operate around the world, and then we give those servers very limited access to your tailnet.
- dave_universetf 4y agoThe funnel relays do SNI-based routing to the target machine in your tailnet, and that machine does the TLS termination. We use the initial TLS handshake to route the connection, but after that it's just opaque bytes to us. You can verify this in the client's source code, and use CT logs to see that there are no additional issued TLS certs beyond the one your end-machine created.
- kkielhofner 4y agoYes, it is. Cloudflare gets a lot of criticism on HN (I can fundamentally understand why) but it turns to irrational blind absolutist hatred very quickly. Cloudflare tunnels have been around for a while. They have a variety of features (IMO) well beyond what Tailscale has in beta here. In terms of the other comments, Cloudflare has many millions of satisfied customers and roughly 80% of the CDN market so people hosting internet facing properties obviously see value in what they provide. Cloudflare tunnels are a more mature, more capable, more performant, and cheaper version of Funnel backed by one of the largest networks in the world with hundreds of other features from CloudFlare tailscale doesn't have (and factoring in network, never will). If you have some grudge against Cloudflare for MITM, ToS, etc now you have an alternative (of sorts) to Cloudflare tunnels. Competition and choice is a good thing!
- analyst74 4y agoI was just reading about it the other day, pure ingenuity! For those who don't have time to read, Tailscale uses a quirk in how stateful firewall treats inbound UDP traffic to allow connection to a remote server without it opening up to the public.
- bingo-bongo 4y agoIsn’t this exactly about opening it up to the public internet..?
- drexlspivey 4y agoYes but without having to mess with your router config
- analyst74 4y agoIt only opens up to another machine validated by public keys. It serves similar purpose as opening firewall to just a specific IP/port and dynamically change the IP/port as the other machine moves or disconnects. One of the main advantage is that it works behind NATs you don't control (i.e. public WiFi). Edit: also most home routers do not have the ability to dynamically open up to specific IPs based on where your outside machine is.
- steponlego 4y agoI hear a lot of talk about Tailscale but it's just a branded VPN?
- thangngoc89 4y agoPretty much but it makes the experience so much better. Like stable IP/DNS to al of your machines no matters how are those configured/accessed the Internet. Or “air drop” files between machines
- cpach 4y agoIt’s solves real problems in a convenient and robust way. Like every product, it will not suit everyone.
- scosman 4y agoNot really - more like a managed wireguard config system, with fallback VPN for NAT punch though when needed (so it always works, no matter the network). Traffic is direct when it can be, but when it can't it still just works. Nothing that isn't possible manually, but is exponential in effort to maintain as you add systems, made super easy. Plus nice features are appearing all the time, like file sharing, Funnel, magic DNS, etc,
- pricci 4y agoWith easy p2p
- Eumenes 4y agoIts just a hosted wireguard
- linsomniac 4y agoIt's more than that, it's a full mesh wireguard with NAT punching and DNS and SSH authentication and firewalling.
- steponlego 4y agoWireguard smells.
- acaloiar 4y agoThis feature is a delight to use. I've tested a few web applications, APIs, and webhooks using it over the last month or two and only experienced a handful of glitches even before it was in beta. I like the idea of consolidating all my network ACLs with a single configuration file with Tailscale, but I don't like being wedded to a proprietary platform for my personal use. Hopefully headscale gets a similar feature, perhaps minus Tailscale's DNS management.
- explodingcamera 4y agoHow is it with high bandwidth application? E.g would it be okay to put my media server behind it? Currently tunneling it through a VPS so cloudflare doesn't get mad.
- xena 4y agoTailscalar here: there is a bandwidth limit, it's a funnel, not a hose. We don't announce what the bandwidth limit is, but please keep in mind that it does exist. I would suggest setting up your media server inside your tailnet for the best experiences, but it depends on who you are sharing it with and why.
- pciexpgpu 4y agoHola, how would the bandwidth limit work within the tailnet if I am accessing it from outside my home network? Wouldn't it incur some bandwidth on Tailscale's end? I wonder if the DERPy-stuff helps remove most of the bandwidth concerns - thinking out loud...
- _joel 4y agoOnly the setting up of the session, it's effectively P2P then. Routing traffic back out onto the general internet for people without tailscale in your private net will be b/w limited, as mentioned.
- jonpurdy 4y agoI might be missing something; isn’t a Tailnet a bunch of user devices with wireguard tunnels connecting to each other directly? Where does the limit happen? (And thanks for your work!) Edit after 1 minute: of course, limit on Tailscale Funnel itself. (Too deep into thinking about Tailscale and forgot about the actual topic of the post. )
- dijit 4y agofundamentally, something has to be punching NAT somehow, so they're probably taking the traffic on their own servers and relaying it to your machine via the tailnet.
- jbverschoor 4y agoNot sure why it's called funnel, as a funnel is something that takes a bigger amount of something, and transforms it into a smaller amount of something.
- aofeisheng 4y agoThey claim it's short for "Fun Tunnel".
- bradwood 4y agoDo they really. I wonder if they're too nerdy to have gotten the saucy double entendre.
- bradfitz 4y agoI wrote that in the intro blog post: https://tailscale.com/blog/introducing-tailscale-funnel/ https://tailscale.com/blog/introducing-tailscale-funnel/ ... "Now that’s a fun tunnel, if we do say so ourselves."
- solarkraft 4y agoIt enables traffic from the wide internet into your narrow private network/host :)
- vosper 4y agoDoes it? If I pour some water through a funnel I get the same amount out the other end.
- gabereiser 4y agoThe is like DynDNS on steroids. Awesome job. It should be noted that for high bandwidth applications, you'll incur a bit of a penalty due to hops but other than that it's pretty solid.
- nsteel 4y agoWouldn't extra hops be more of an issue for low-latency applications?
- stdgy 4y agoI'm afraid I don't have a lot to add to this conversation but I have to say I just love Tailscale. I don't often run across software that feels so right and when I do it's a great surprise. Every time I see a new feature they're releasing I'm always impressed at how adept they are at targeting modern pain points. I grew up and got into software by messing around with self-hosting web servers and game communities as a kid. As time has gone on I felt like we had lost some of the magic of easily sharing your machines and your creations with other people. We have a ton of services where you can now deploy and share your creations, but we've moved further and further away from direct sharing. There were plenty of good reasons why this has happened, with security being the most obvious factor, but it still makes me a little sad. I want my things to be able to talk to each other no matter where I am. I want to be able to invite my friends in and have access to my stuff. Tailscale makes all of that quick, easy and awesome. I think it's really neat, makes me feel like a little nerdy kid again.
- teekert 4y agoI feel the same! Absolutely love Tailscale. I really hope they don’t change, I also love their philosophy. Only thing atm I don’t like it the battery use on my iPhone. But it’s well worth it.
- bradfitz 4y ago> Only thing atm I don’t like it the battery use on my iPhone. But it’s well worth it. FWIW, that's a very high priority currently by a number of people at Tailscale. We're working on it.
- teekert 4y agoThat’s great to hear! I’ve been turning TS off and on when accessing services to make it through the day, but as soon as the battery use goes down (to plain wireguard app levels) I’ll be using it for DNS as well. Then it will truly be TS all the things for me.
- deleted 4y ago[deleted]
- maxs 4y agoCan anyone explain how is this different to ngrok?
- BilalBudhani 4y agofrom what I can gather it provides the same functionality as ngrok without reaching for another tool. If Tailscale already exists in your networking tool belt this functionality comes really handy.
- srcreigh 4y agoNgrok doesn’t require TLS. I’m not sure if they decrypt traffic on their servers. These two pages make it unclear https://ngrok.com/docs/secure-tunnels/tunnels/tls-tunnels/ https://ngrok.com/docs/secure-tunnels/tunnels/tls-tunnels/ https://ngrok.com/docs/secure-tunnels/ https://ngrok.com/docs/secure-tunnels/
- r2b2 4y ago• Ngrok only provides tunnels. • Ngrok pulled a pricing bait-and-switch a year ago increasing prices to $240/year/user if you wanted a stable subdomain, even for bandwidth-trivial users. - Edit: Looks like they now have an $8/month/user tier for a single stable subdomain and now offer some edge hosting as well.
- TobyTheDog123 4y ago$8/user/mo is still far too much for a stable domain without the spam-guard intermediary page, and I'm glad there's some free competition in this space now. This is my first time using tailscale, and I set up and figured out funnel within fifteen minutes.
- quaintdev 4y agoSo will this allow me to setup matrix server at home?
- thefz 4y agoTailscale is so good I want to start a paid plan just to give them money.
- dimgl 4y agoThis is freaking amazing. Does this mean I never ever have to deal with something like ngrok again?
- Vexs 4y agoEvery time I see tailscale do something really neat I'm always a little disappointed to find out they still offer only the three auth schemes- and I really don't want to tie my networking to google/github/ms. On top of the various tinfoil hat reasons, I know a variety of people who have had these accounts terminated out of the blue, and it throwing out my networking stack would be insanely aggravating. If you're reading tailscale, I will pay you actual real dollars per month to offer a different not-tied-to-a-megacorp authentication scheme. Till then, guess I've got headscale.
- xena 4y agoYou're in luck: https://tailscale.com/blog/custom-oidc/ https://tailscale.com/blog/custom-oidc/ You also don't need to pay Tailscale to use it.
- Vexs 4y agoWell god damn there it is! Three days fresh, even! Thanks! Looks like a fair lot of work to get it configured, but few good things come entirely free. Wonder if there's enough people that could get together for a communal one...?
- evntdrvn 4y agoyayyy! Thanks Xe and friends! Question about the docs, it mentions that "The WebFinger endpoint must be hosted at the domain of the email address provided during setup". Would it be possible to support a subdomain? Also, a small ask: could the webfinger request that's sent include the `rel` and a well-known user resource params, for the situations where there's already a webfinger implementation there that isn't 100% under dev control which requires these params like GET /.well-known/webfinger? resource=tailscale-webfinger%3A%40mydomain.com& rel=http%3A%2F%2Fopenid.net%2Fspecs%2Fconnect%2F1.0%2Fissuer HTTP/1.1 Host: mydomain.com lastly, is this request resent at every auth event? Thanks!@!
- xrd 4y agoGot to the end of that post and thought: definitely don't want to self host that! Are there good options for an IdP that has good data policies that are easy to wire in with tailscale? I'm not opposed to paying for it. I wonder if Zoho can do this for me, I'm very happy paying them $12/yr for email.
- _joel 4y agoNo complaints here, I seriously love what they're doing. Been tinkering a bit with it but it's had been a great utility and one that literally just works. Been trying to make inroads at $WORK with it as we use so much extra cruft that needs maintenance, breaks, isn't that performant really, stateful, no exposing or ACL management that doesn't require CA shaped pain. I feel an ADR coming up :)
- hendersoon 4y agoLooks very similar to Cloudflare Tunnels, except Tailscale goes out of their way to say web traffic only (CF had a bunch of shenanigans) and you don't need your own domain name. And you get all Tailscale's mesh network functionality too, which is awesome. https://www.cloudflare.com/products/tunnel/ https://www.cloudflare.com/products/tunnel/
- jacooper 4y agoIts great that they don't do any man-in-the-middle like cloudflared
- hhthrowaway1230 4y agois there an option for basic auth? i dont want super fancy security, but basic auth over https to protect my crappy legacy apps would be perfect
- westpfelia 4y agoI thought it said Tailscale Flannel is now available and I was so excited. Still cool. But damn.
- mayakacz 4y agoTailscalar here. Did you expect a wearable fabric or a CNI?
- duskwuff 4y ago"It can be two things."
- westpfelia 4y agolate. But was hoping for wearable :)
- zaptheimpaler 4y agoYesterday, I set up tailscale on a GCP box for just this - running a local server and serving it on GCP. I thought hmm, wouldn't it be cool if tailscale could just do this for you? And now, it does.. lol. Super cool!
- mthld 4y agoI sadly failed to find the information I needed: are we somehow allowed to use proper custom domains?
- dave_universetf 4y agoNot yet. That needs more machinery than we currently have to enable tailscale clients to do automatic TLS cert issuance for custom domains.
- monkeywork 4y agohow does this compare to cloudflare tunnels?
- jimmcslim 4y agoIn another Tailscale discussion I saw someone from Caddy hinting at some further integration coming very soon… is that still on the radar?
- dijit 4y agoI am really enjoying tailscale (even though I have a long standing issue with their log level!) I even pay for their service as a business! However their limits on the number of people named in ACLs seems far too low, if anyone from tailscale is reading, it would be great if ACL limits scaled somewhat with seats, because as it stands we get significantly less secure as we grow. Theres also a feature for autogroups which would be cool, but seems not fully explored. I know the big features are shiny and fun and drive a lot of attention to the product, but I hope it doesnt get in the way of being, fundamentally, a solid VPN solution.
- aborsy 4y agoWireguard is one of the best pieces of software developed in recent years. I’m working hard to replace the last use case of OpenVPN: restrictive networks allowing only egress https. Anywhere else Wireguard all the way! By the way, how does Tailscale use Wireguard over TCP? That’s another benefit of Tailscale.
- dcchambers 4y agoSo if I'm already using tailscale, I could use this to replace ngrok basically? Neat.
- rdelpret 4y agoThis seems pretty similar to cloudflared tunnels
- perryizgr8 4y agoCan someone confirm that this is functionally equivalent to CloudFlare tunnels? I think so, but I'm not 100% sure about it, because I don't fully understand what a Tailscale network does.
- jckahn 4y agoThis is great! It works as advertised and I can see myself using this a lot. I've made some simple BASH functions to easily open and close ports to the public internet with Funnel: https://github.com/jeremyckahn/dotfiles/commit/2f02c594d8f2b57927fff1937895ed438b9dce6a https://github.com/jeremyckahn/dotfiles/commit/2f02c594d8f2b...