4 ms·

Same. Wireguard is so easy to set up I don't see why I would need anything else.

renonce 3y ago
My computers are behind firewalls and I need Tailscale to do the NAT punching. I don't see another tool that does the job as well as Tailscale.
- imiric 3y ago
  The hub and spoke configuration bypasses firewalls and NAT, which WG can do natively. Though doing this "well" is subjective, so I can understand someone preferring Tailscale because it's easier to use.
- abwizz 3y ago
  not familiar with wireguard per se, but afaik it's using udp-packets which get translated/mapped just fine by any NAT implementation. nothing in need of punching imho. if your access concentrator (server) is behind a nat, you'll need a port-forwarding from the outside but that's rare.
  - patte 3y ago
    Tailscale builds a mesh, where the participants can communicated directly, so it's common for all nodes to be behind a FW that does NAT. There is a very interesting blog post from tailscale about all the trickery they pull to reliably deal with NAT: https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/
    - abwizz 3y ago
      i stand corrected. thanks!
OJFord 3y ago
Tailscale uses Wireguard, but offers so much more on top. I used to think the same, but I think I was mixing it up with Zerotier; had a play with it and now think it's pretty great. For example, you can set ACL rules for which devices can access which others (or the internet, if you have explicit exit nodes) - it's using Wireguard for networking, but you can't do that with (just) Wireguard, it's not just 'make Wireguard easier to set up', as you said that doesn't really need doing.
- throwaway742 3y ago
  I see. I use firewalls to control which devices can access which others. To each their own.
  - tehbeard 3y ago
    This is a chud "Dropbox is just rsync" attitude. There's value to some to having networking config centralised like that. It allows things like auto adding certain clients to certain rules/groups automatically. Not spending time cycling through each server to poke iptables.

My computers are behind firewalls and I need Tailscale to do the NAT punching. I don't see another tool that does the job as well as Tailscale.

imiric 3y ago
The hub and spoke configuration bypasses firewalls and NAT, which WG can do natively. Though doing this "well" is subjective, so I can understand someone preferring Tailscale because it's easier to use.
abwizz 3y ago
not familiar with wireguard per se, but afaik it's using udp-packets which get translated/mapped just fine by any NAT implementation. nothing in need of punching imho. if your access concentrator (server) is behind a nat, you'll need a port-forwarding from the outside but that's rare.
- patte 3y ago
  Tailscale builds a mesh, where the participants can communicated directly, so it's common for all nodes to be behind a FW that does NAT. There is a very interesting blog post from tailscale about all the trickery they pull to reliably deal with NAT: https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/
  - abwizz 3y ago
    i stand corrected. thanks!

OJFord 3y ago

Tailscale uses Wireguard, but offers so much more on top. I used to think the same, but I think I was mixing it up with Zerotier; had a play with it and now think it's pretty great. For example, you can set ACL rules for which devices can access which others (or the internet, if you have explicit exit nodes) - it's using Wireguard for networking, but you can't do that with (just) Wireguard, it's not just 'make Wireguard easier to set up', as you said that doesn't really need doing.

throwaway742 3y ago
I see. I use firewalls to control which devices can access which others. To each their own.
- tehbeard 3y ago
  This is a chud "Dropbox is just rsync" attitude. There's value to some to having networking config centralised like that. It allows things like auto adding certain clients to certain rules/groups automatically. Not spending time cycling through each server to poke iptables.