3 ms·

Fantastic! Love seeing more work like this go into Wireguard. I've been using headscale (self-hosted tailscale) for personal use, but having only one machine n

Fantastic! Love seeing more work like this go into Wireguard. I've been using headscale (self-hosted tailscale) for personal use, but having only one machine not running Linux on the network is a bit silly, as Tailscale is userspace, and Wireguard uses very little CPU on Linux.

animeshjain 3y ago
can you please explain, why do you need a non-Linux machine on the network?
- thejosh 3y ago
  Mac laptop and my phone. The idea behind Tailscale is that you can sign in with any device. I can go and create a configuration file for WG, but then it gets longer and longer.
- j45 3y ago
  A common need is to have android, ios, windows, and mac computers all work, maybe even access a NAS together. And if it's the case, no, they can't use Linux like you.
j45 3y ago
I recently switched to Tailscale, and it was magic. It's very easy to recommend it to any non-tech user as well who wants to "connect to home". Well worth paying for in those cases. But, Tailscale had so much magic, that I didn't want to be solely dependant on it, remembering how Docker is turning out. Finding Headscale was a great discovery, and nice that the Tailscale clients already maintained can connect to a separate open-source project that lets you run your own server.
- sph 3y ago
  I would love and pay for Tailscale if they could solve the battery consumption issue on iOS. The bug report has been open for years now, they created a special TestFlight version with logging enabled for them to track it down, and no news since. If I forget to turn it off, I'm down to 0% battery in 12 hours of standby. https://github.com/tailscale/tailscale/issues/3363 https://github.com/tailscale/tailscale/issues/3363 I have it installed on all my systems, but I never use it because my use case is accessing my network while I'm out from my phone. One day I might replace it with WireGuard and be done with it. The official WG app doesn't drain my battery.
  - cassianoleal 3y ago
    > If I forget to turn it off At least for me, it's even worse. It's not enough to disconnect on the app, as it's still connected as far as iOS is concerned (check Settings -> VPN). I tried many things to fix that - force-closing the app, switching it off multiple times in settings, etc. The only thing that actually makes the VPN to disconnect and the battery drain to stop is to choose a different VPN profile in Settings.
    - sph 3y ago
      I think that problem might've been fixed recently, but I might be wrong.
      - zikduruqe 3y ago
        Version 1.48.1 on iOS has an on-demand setting like Wireguard does. https://i.imgur.com/Orupuu8.jpg https://i.imgur.com/Orupuu8.jpg
        cassianoleal 3y ago
        That's progress but I'm not sure how that helps much unless I select "Do Nothing" on Wifi and Mobile, and set to "detect Magic DNS", but that will only do me any good if I use magic DNS which I don't.
    - j45 3y ago
      Interesting and thanks to the 2 parent posts. I haven’t used tailscale much from iOS and will keep an eye out. If needed I suppose I mould just WireGuard into a box that can access the tailnet.
  - api 3y ago
    The drain is not because of Wireguard. It's because it's a mesh. Anything peer to peer or mesh has battery consumption issues on mobile, and it's very hard to get around it. Tailscale, ZeroTier, and any other mesh VPNs all have this problem. If Netbird is a mesh it will have this problem too. The reason is that we've broken the Internet such that all connections require keepalive about every 30 seconds. Otherwise NATs and stateful firewalls "forget" the connection and it dies and must be renegotiated. So if you have, say, 10 actively linked peers on your network you must send 10 packets every 30 seconds to keep links open. Then you have all the other peers constantly sending keepalives to you. Since clocks are not globally synchronized it means you are constantly transmitting and receiving. Phones can only seem to have long battery life due to aggressive power saving measures including turning off radios when not in use. Constant P2P traffic prevents the radio from sleeping and consumes background CPU. On devices with large batteries like laptops it's barely noticeable. On desktop and cloud it doesn't matter at all. Mobile devices are really only suited to be dumb terminals to access the cloud. The problem is mostly in the architecture of the network. It can't easily be fixed in software. Edit: one conceivable fix would be the introduction of an ultra low power side channel specifically for small and sparse "control" messages, but I don't see mobile carriers working on such a thing. For 99.9% of mobile users the use case is to scroll TikTok. The other fix would be a protocol to tell NATs and firewalls about active connections, but that would also require cooperation across vendors and so it won't happen. People who think NAT matters for security would freak out too.
braginini 3y ago
You could also try an updated self-hosted Netbird :) https://github.com/netbirdio/netbird#quickstart-with-netbird-cloud https://github.com/netbirdio/netbird#quickstart-with-netbird...

animeshjain 3y ago

can you please explain, why do you need a non-Linux machine on the network?

thejosh 3y ago
Mac laptop and my phone. The idea behind Tailscale is that you can sign in with any device. I can go and create a configuration file for WG, but then it gets longer and longer.
j45 3y ago
A common need is to have android, ios, windows, and mac computers all work, maybe even access a NAS together. And if it's the case, no, they can't use Linux like you.

j45 3y ago

I recently switched to Tailscale, and it was magic. It's very easy to recommend it to any non-tech user as well who wants to "connect to home". Well worth paying for in those cases. But, Tailscale had so much magic, that I didn't want to be solely dependant on it, remembering how Docker is turning out. Finding Headscale was a great discovery, and nice that the Tailscale clients already maintained can connect to a separate open-source project that lets you run your own server.

sph 3y ago
I would love and pay for Tailscale if they could solve the battery consumption issue on iOS. The bug report has been open for years now, they created a special TestFlight version with logging enabled for them to track it down, and no news since. If I forget to turn it off, I'm down to 0% battery in 12 hours of standby. https://github.com/tailscale/tailscale/issues/3363 https://github.com/tailscale/tailscale/issues/3363 I have it installed on all my systems, but I never use it because my use case is accessing my network while I'm out from my phone. One day I might replace it with WireGuard and be done with it. The official WG app doesn't drain my battery.
- cassianoleal 3y ago
  > If I forget to turn it off At least for me, it's even worse. It's not enough to disconnect on the app, as it's still connected as far as iOS is concerned (check Settings -> VPN). I tried many things to fix that - force-closing the app, switching it off multiple times in settings, etc. The only thing that actually makes the VPN to disconnect and the battery drain to stop is to choose a different VPN profile in Settings.
  - sph 3y ago
    I think that problem might've been fixed recently, but I might be wrong.
    - zikduruqe 3y ago
      Version 1.48.1 on iOS has an on-demand setting like Wireguard does. https://i.imgur.com/Orupuu8.jpg https://i.imgur.com/Orupuu8.jpg
      - cassianoleal 3y ago
        That's progress but I'm not sure how that helps much unless I select "Do Nothing" on Wifi and Mobile, and set to "detect Magic DNS", but that will only do me any good if I use magic DNS which I don't.
  - j45 3y ago
    Interesting and thanks to the 2 parent posts. I haven’t used tailscale much from iOS and will keep an eye out. If needed I suppose I mould just WireGuard into a box that can access the tailnet.
- api 3y ago
  The drain is not because of Wireguard. It's because it's a mesh. Anything peer to peer or mesh has battery consumption issues on mobile, and it's very hard to get around it. Tailscale, ZeroTier, and any other mesh VPNs all have this problem. If Netbird is a mesh it will have this problem too. The reason is that we've broken the Internet such that all connections require keepalive about every 30 seconds. Otherwise NATs and stateful firewalls "forget" the connection and it dies and must be renegotiated. So if you have, say, 10 actively linked peers on your network you must send 10 packets every 30 seconds to keep links open. Then you have all the other peers constantly sending keepalives to you. Since clocks are not globally synchronized it means you are constantly transmitting and receiving. Phones can only seem to have long battery life due to aggressive power saving measures including turning off radios when not in use. Constant P2P traffic prevents the radio from sleeping and consumes background CPU. On devices with large batteries like laptops it's barely noticeable. On desktop and cloud it doesn't matter at all. Mobile devices are really only suited to be dumb terminals to access the cloud. The problem is mostly in the architecture of the network. It can't easily be fixed in software. Edit: one conceivable fix would be the introduction of an ultra low power side channel specifically for small and sparse "control" messages, but I don't see mobile carriers working on such a thing. For 99.9% of mobile users the use case is to scroll TikTok. The other fix would be a protocol to tell NATs and firewalls about active connections, but that would also require cooperation across vendors and so it won't happen. People who think NAT matters for security would freak out too.

braginini 3y ago

You could also try an updated self-hosted Netbird :) https://github.com/netbirdio/netbird#quickstart-with-netbird-cloud https://github.com/netbirdio/netbird#quickstart-with-netbird...