21 ms·

Mullvad on Tailscale: Privately browse the web

567 points by xd1936 3y ago

progbits 3y ago
Other side (probably should merge): https://news.ycombinator.com/item?id=37420382 https://news.ycombinator.com/item?id=37420382
aftergibson 3y ago
Two excellent products merging to solve an immediate issue I have. That is amazing!
- tomxor 3y ago
  *collaboration, not merging, which is a good thing :)
k__ 3y ago
What's the unique selling point of Mullvad?
- gameoverhumans 3y ago
  You can pay for the service by mailing them cash: https://mullvad.net/en/pricing https://mullvad.net/en/pricing They run servers with no hard drives: https://mullvad.net/en/blog/2022/8/1/expanding-diskless-infrastructure-to-more-locations-system-transparency-stboot/ https://mullvad.net/en/blog/2022/8/1/expanding-diskless-infr...
  - dharmab 3y ago
    Not just no drives but, but also no logs, and per their last audit they're working towards no administrator access to the shell.
    - foobiekr 3y ago
      If they can update software they have administrator access any time they want it.
      - dharmab 3y ago
        But that requires compromising the supply chain rather than a single admin's account.
        foobiekr 3y ago
        No it just requires the company wanting to do it due to a government order. The “compromise” is coming from inside the house. Might as well claim no one knows the admin passwords because they are written in a notebook that the management keeps in their home safe.
    - Thaxll 3y ago
      How do they comply with countries that requiere logs actually?
      - lolinder 3y ago
        Presumably by operating in a country that doesn't.
  - foobiekr 3y ago
    The cash thing is awesome and good for them. That said, I don't know if Mullvad is good or evil, but one of the ways you can evaluate companies is to recognize when they're making sketchy, not-relevant claims to create an air of legitimacy. This "our servers have no disks" thing is kind of thing is marketing. It is meant to imply something that it doesn't actually demonstrate. Who cares if there are local disks? It doesn't change the threat model at all, it's mostly to convince people who don't know very much about claims which are basically impossible to prove. It's the higher-tier version of "we use military grade encryption." Lawful Intercept on the public internet does not rely on local hard drives on any node in the network and has not since the 90s, as a specific example of how meaningless this is.
    - dharmab 3y ago
      In Sweden, physical search of the drives is a real concern. The Swedish national police attempted to search Mullvad once, but since there was no data to seize they left empty handed.
      - anigbrowl 3y ago
        Realistically, what prevents police from just sticking in a USB device and doing a memory dump? I'm not sure I buy this story since police with a sufficiently strong warrant can always just take over a firm's premises and bring in their own forensic people until they find what they want.
        cstrahan 3y ago
        I could be wrong, but I would think that a conveniently timed power outage would prevent the memory dumping scenario :)
        anigbrowl 3y ago
        Unless you automate this process to flush all memory periodically, this seems like a good way to get charged for interfering with an investigation or have your assets seized and thrown into legal limbo. Police aren't complete morons, in the real world goofing around like this has consequences.
  - vinay_ys 3y ago
    You cannot hide from governments. If they want you badly enough they can track you anywhere. So, don't do anything illegal and expect any VPN to protect you because paid in cash! Remember, all governments have secret national security laws to surveil all data all the time and almost all governments' (even supposed enemies) secret national security agencies cooperate if they badly want to catch someone. You cannot hide from advertisers if you use a smartphone with apps. App developers who put ads within their app control the apps behavior completely and hence they can fingerprint your device and track you very well without using IP addresses. And within browsers, they can fingerprint you through many javascript features of the browser. Hiding your source IP does very little for your privacy. Almost all traffic (apps and websites) are encrypted via TLS (https, for example). So, even if you are on an insecure network, unless your OS's TLS certificate store is compromised, your communications are encrypted and protected against snooping from that insecure network. Also, even on open wifi networks, today, it is very unlikely that the wifi is running without at least WPA2 encryption. Most modern airports run secure wifi. (But they also monitor all traffic metadata for illegal activities). So, using a VPN as an exit node is just privacy theatre. VPN exit nodes in faraway countries are useful for bypassing content censorship in your own country, but it works only if the content streaming service cooperates with you. Remember, all ISPs are heavily regulated by governments and can be asked to mirror specific customer's traffic for analysis. I would be very surprised if they don't proactively do it for all VPN operator nodes by default.
    - ballenf 3y ago
      Are there browser plugins that can "fake" your browser fingerprint somewhat? Like, e.g., only showing OS default fonts installed, or fixing screen dimension info, etc? Or would this require forking a browser's code? Maybe futile, but I'd still consider using it.
      - bananapub 3y ago
        yes, and it's one of the things the Tor browser does to make fingerprinting harder.
        3y ago
  - SleekEagle 3y ago
    You can mail in cash for ivpn too
- master-lincoln 3y ago
  trustworthiness
- dewey 3y ago
  Trustworthy audits: https://mullvad.net/en/blog/tag/audits/ https://mullvad.net/en/blog/tag/audits/
- alangibson 3y ago
  They practice what they preach. The recently stopped selling recurring subscriptions, and most likely threw away a big chunk of money, because there was no way to support them in an anonymous way.
  - rozab 3y ago
    I'm glad I have a grandfathered subscription, because that seems like a usability nightmare
    - ipaddr 3y ago
      Convenience is the enemy of security
- bananapub 3y ago
  they take privacy extremely seriously, by trying to reduce the amount of data they even have that can get subpoenaed (no logs, no accounts, accept payment by cash) and appear to have not yet fucked up.
PentiumBug 3y ago
Ah! This could have been great for me, except that Tailscale recently cut off access to Cuban nationals to their service (they have their reasons, I guess.) Still, I think that the service they're building, step by step, is fine actually.
- whimsicalism 3y ago
  Any sort of export control/embargo that cuts off specifically VPN access to foreign nationals is supremely stupid imo
  - PentiumBug 3y ago
    Exactly. I do believe that certain individuals and organizations might/should be excluded from service here; however, it seems like the only technical solution to regulations enforcement is to wholesale block a whole country.
  - foobiekr 3y ago
    Should they sell VPN services to North Korea? What might the reasons be on the "no" side?
    - whimsicalism 3y ago
      The NK state is more than capable of arranging their own VPNs. I think the West gains a lot more by having generally available VPN access in adversary states than it loses from their ability to purchase technical services that they still will have difficulty getting access to currency to pay for and they still will have difficulty actually shipping anything to NK.
    - csomar 3y ago
      Bad comparison. NK is a nuclear state with nuclear weapons that is constantly threatening its neighbors. Cuba flirted with the idea but they didn't really materialize any nuclear or military capabilities. This was also a long time ago.
    - 3y ago
tw04 3y ago
On its face, this is really cool and being a user of both tailscale and mullvad this is awesome. My primary concern though: will this lead to potential privacy leaks? Can a government agency shakedown Tailscale now to trace your Mullvad ID/connection to your Tailscale account?
- dewey 3y ago
  That's exactly what they address here under "Private and (mostly) anonymous ": https://tailscale.com/blog/mullvad-integration/ https://tailscale.com/blog/mullvad-integration/ tl;dr: As always, it depends on your threat model.
  - tw04 3y ago
    That doesn't really answer my question at all, at least not thoroughly in plain english. The question is: if a government agency goes to tailscale and says: "we're looking for Mullvad user 912830193276163872" - does tailscale log that, can they provide it, will they provide it?
    - bastawhiz 3y ago
      Tailscale needs to know information about your Mullvad license in order to authenticate you with the exit nodes. So it's theoretically possible for a government to ask Tailscale to correlate the data they've collected about you (like a client IP) with an authorized Mullvad license. Which, of course, they'd need to know represents your traffic from talking to Mullvad, which means you're not really placing any extra trust in Tailscale. I would assume that Headscale could also support this functionality in the future if you trusted Mullvad but not Tailscale.
      - Terretta 3y ago
        > Tailscale needs to know information about your Mullvad license in order to authenticate you with the exit nodes. That doesn't sound strictly true. Mullvad and Tailscale need to settle their costs between each other, and Tailscale needs to settle with you. What Tailscale needs to know about "your" Mullvad license is that x of y devices are using a Mullvad exit node, so they can charge you for y. What Mullvad needs to know is a high water mark usage (data transfer, throughput, connections, whatever) for Tailscale (not you) so they can charge Tailscale some carrier grade rate. There's little reason Tailscale couldn't do a iCloud Private Relay style Apple<->CloudFlare privacy preserving handoff.
jejeyyy77 3y ago
love Tailscale! hope it remains free
BxGyw2 3y ago
Fuck this is good, I've been manually maintaining NAT instances for each country with Mullvad on them, it was awful
tailspin2019 3y ago
This seems like a really smart move. Can anyone comment on whether it's possible to use something like NextDNS in conjunction with Tailscale and Mullvad? Edit: to clarify, I'm aware of the existing NextDNS integration with Tailscale - I was wondering if this (or other third party DNS) works specifically with these new Mullvad exit nodes...
- geoffeg 3y ago
  Tailscale supports using NextDNS as a nameserver: https://tailscale.com/kb/1218/nextdns/ https://tailscale.com/kb/1218/nextdns/
  - BonoboIO 3y ago
    Did not know that, thanks for mentioning. This fixes probably a big problem for me.
- bananapub 3y ago
  first result on google for "tailscale nextdns" explains how to - for some reason - leak all your dns queries to some random company you don't pay money to: https://tailscale.com/kb/1218/nextdns/ https://tailscale.com/kb/1218/nextdns/
  - Operyl 3y ago
    Err what? NextDNS is not free, you do pay them money every year to use it.
    - bananapub 3y ago
      https://nextdns.io/pricing https://nextdns.io/pricing
      - Operyl 3y ago
        You blow through 300k queries pretty quickly. The vast majority of users are paying nextdns.
mig39 3y ago
If you're already a Mullvad customer, is there some way to integrate this into your account? Right now, when I want to use Mullvad via my tailnet, I set the exit node to be a linux box at my house that is set to automatically send all traffic via Mullvad. That's free for me, since I already pay for Mullvad on that linux box at home.
- bananapub 3y ago
  https://twitter.com/bradfitz/status/1699806137661726790 https://twitter.com/bradfitz/status/1699806137661726790 fortunately it doesn't matter at all unless you've stacked up a lot of prepaid months at Mullvad.
  - smashah 3y ago
    Wouldn't it be more "efficient" networking if I could sometimes just use the mullvad app instead of tailscale > mullvad? Either way it would be good to at least have the option to use an existing account. Maybe tailscale is taking a cut since mullvad dropped recurring sub support natively.
    - bananapub 3y ago
      > Wouldn't it be more "efficient" networking if I could sometimes just use the mullvad app instead of tailscale > mullvad? no, why do you think that's the case? presumably the mullvad client does the exact same thing as the tailscale client will do - configure a wireguard tunnel. edit: it will be interesting to see how much effort Tailscale put into preventing dns/route leaks vs the mullvad client
    - bradfitz 3y ago
      See https://github.com/tailscale/tailscale/issues/2880 https://github.com/tailscale/tailscale/issues/2880 for some background. The root problem this all came from is that users can't really run two VPN clients at a time. It rarely works due to them fighting over the same resources in various OSes. So we need to either add Mullvad support to Tailscale's client or Tailscale support to Mullvad's client. The former is tons easier.
chandureddyvari 3y ago
It sounds great. But their banner is showing that my ip address is from Mumbai, whereas I’m actually in Bengaluru, India. That’s not really re-assuring. Maybe it’s just apple relay on my device that’s obfuscating my details. edit: my bad, hit me bit late that it’s the intended behaviour.
- bananapub 3y ago
  ... why yes, the thing you turned on that explicitly says it will reroute your traffic elsewhere will reroute your traffic elsewhere.
  - chandureddyvari 3y ago
    yeah. my bad. Turning off relay, did show the right message. Thanks for that.
- samstave 3y ago
  Good job! You outed yourself on social media. Better move to Mumbai now to throw off the ipTrace.
m00dy 3y ago
Mullvad is impressive; however, the issue with Mullvad ID persists. The proposed solution is a Zero-Knowledge Proof Authentication system. With this approach, Mullvad will retain your public key but will not possess information regarding the association of specific sessions with individual Mullvad IDs.
- bananapub 3y ago
  if you're going to go to some random thread and post about your slightly related hobbyhorse, at least provide a link to some information about whatever you're upset about.
deelowe 3y ago
Can someone help me understand why VPN use seems to have exploded in recent years? I mean, I'm aware of the typical use-cases of corporate devices and such, but I doubt that's the major contributor here as those use-cases have existed for decades now. What's the impetus for what seems to be massive growth over the past 3+ years?
- blahyawnblah 3y ago
  Privacy and tracking prevention. It can get you access to stuff that's not in your country, depending on the service you're trying to get.
- silverbax88 3y ago
  States attempting to pass age-verification laws, and large streamers trying to fuck over customers by locking their account access to their home IP.
- unethical_ban 3y ago
  For me the fact is there are really easy to use user interfaces for VPNs now. They are very performant and low latency as well, so they're practical for everyday browsing on the modern web and even for gaming and streaming. Also, geographical blocks on content such as Netflix and BBC etc
- judge2020 3y ago
  For VPN in the Corporate network sense, it's for easy access to your computers. You don't want to have to open ports on your router or hope that whatever world-accessible service you throw out there is secure - instead, Tailscale handles authentication, authorization (if you'd like to set up ACLs), and it handles NAT traversal without any open ports.
  - kevincox 3y ago
    I think the parent is talking about consumer VPNs which using VPN protocols to implement a proxy service, providing very little of a private network.
- 3y ago
wing-_-nuts 3y ago
Mullvad is such a good vpn. Too bad they disabled port forwarding. Does anyone know of a vpn that's anywhere near as good but allows it?
- tmikaeld 3y ago
  Ivacy has been around a long time and allows it [0]. [0] https://www.ivacy.com/port-forwarding/ https://www.ivacy.com/port-forwarding/ (They're based in Singapore)
  - bananapub 3y ago
    picking a VPN based on extreme privacy demands that's domiciled in Singapore seems pretty courageous
    - tmikaeld 3y ago
      track record matters more than where the provider is based, I know of no cases where Ivacy have provided logs of anything to authorities.
- kxrm 3y ago
  I went over to https://airvpn.org/ https://airvpn.org/, so far so good.
- redrove 3y ago
  ovpn and azirevpn come to mind.
- katbyte 3y ago
  I switched to airvpn and have been happy
- halJordan 3y ago
  This tailscale press release claims you can forward nonstandard ports with this configuration. Who knows what that means or even if the copy was just approved six months ago or what.
fulafel 3y ago
VPN originally meant something quite different from the commercial consumer VPN product that mullvad represents, and was more like the encrypted overlay network provided by Tailscale. These are coming together again in this revolution of the wheel of reinvention. Not using "reinvention" in any negative way here, this is is good, I think. For history and how some people (John Gilmore[1]) thought uniquitous interoperable VPN tech (using the IETF standardized IPSec) be used to end-to-end secure internet traffic generally, see eg this FreeS/WAN rationale from the 90s: http://web.archive.org/web/20210125023625/https://www.freeswan.org/freeswan_trees/freeswan-1.5/doc/rationale.html http://web.archive.org/web/20210125023625/https://www.freesw... Then in between then and now were the VPN dark ages where it was mostly only used as a tech to accesss old timey corporate "internal networks". [1] https://en.wikipedia.org/wiki/John_Gilmore_(activist) https://en.wikipedia.org/wiki/John_Gilmore_(activist)
- sam0x17 3y ago
  Don't forget that historically, a "half-measure" a lot of people used to use to get around regional blocking was "web proxies" like those linked to by proxy.org. I used to operate one as a young teen and I will say they are a security nightmare -- nothing stopping a web proxy operator from sniffing all user credentials passing through them, and modifying PHPRoxy to do this is trivial. Personally I used to run a domain parking service (back when I was a teen in the early 00s) that used the domains as web proxies and replaced all adsense blocks it could find in the content with my adsense code, and did a 50/50 split between my code and the domain owner's code. Google eventually became wise to this and banned that sort of thing but it was pretty cool while it lasted, and honestly I think it was super fair considering we didn't even add any ad blocks just re-used the existing ones already in the content.
  - lxgr 3y ago
    With practically-ubiquitous HTTPS, these days proxy use is mainly a privacy risk since for HTTPS, they usually can only support transparent byte relaying anyway.
    - 3y ago
deleted 3y ago
[deleted]
flurdy 3y ago
Mullvad is what Mozilla VPN uses underneath as a while label VPN. I guess this parnership does not apply to those licenses.
cisco87 3y ago
Mh interesting, I've wrote a while ago a script to start on connection in order to have mullvad coexist with tailscale, if anyone is interested, I also have one for NVPN DOMAINS=(login controlplane log derp1-all derp2-all derp3-all derp4-all derp5-all derp6-all derp7-all derp8-all derp9-all derp10-all derp11-all derp12-all derp13-all derp14-all derp15-all derp16-all derp17-all derp18-all derp19-all derp20-all derp21-all derp22-all derp23-all derp24-all) FWMARK=$(wg show $1 fwmark) for d in ${DOMAINS[@]}; do IPS=$(dig +answer -4 $d.tailscale.com +short) for IP in ${IPS[@]}; do iptables -I INPUT --in-interface tailscale0 -j MARK --set-mark $FWMARK iptables -I OUTPUT --out-interface tailscale0 -j MARK --set-mark $FWMARK iptables -I INPUT -d $IP/32 -j MARK --set-mark $FWMARK iptables -I INPUT -s $IP/32 -j MARK --set-mark $FWMARK iptables -I OUTPUT -d $IP/32 -j MARK --set-mark $FWMARK done; done; iptables -I OUTPUT -d 100.100.100.100/32 -j MARK --set-mark $FWMARK iptables -I OUTPUT -s 100.100.100.100/32 -j MARK --set-mark $FWMARK iptables -I INPUT -d 100.100.100.100/32 -j MARK --set-mark $FWMARK iptables -I INPUT -s 100.100.100.100/32 -j MARK --set-mark $FWMARK
- Izkata 3y ago
  Code blocks are done on here by indenting with 2 spaces, not with ```
  - cisco87 3y ago
    Ah nice thank you
- rbonvall 3y ago
  Side note: you can simplify the first line like this: DOMAINS=(login controlplane log derp{1..24}-all)
  - cisco87 3y ago
    Thank you!
- drunner 3y ago
  What is the $1 in `wg show $1` work and how/when do you run this script?
ogaj 3y ago
I love tailscale's technology and their contributions to the security ecosystem, but I can't help but take a contrarian angle to many of the comments here... This feels like a bad idea, and perhaps it signals defeat in the enterprise space (where the tech would provide the most value, imo). Tailscale raised $100M last year, surely based on a theory of growth upmarket. While this partnership surely provides value to personal consumers, it feels, at best, a distraction from the larger opportunity and, at worst, counterproductive to achieving it. I'm skeptical of the obvious counterpoint that this assists a flywheel of greater b2c satisfaction leading to b2b success...
- bananapub 3y ago
  tailscale has many employees, adding a small patch to wireguard client programming and strapping in mullvad account provisioning seems like a very small amount of effort for a pretty cool feature that also earns some recurring money from the hitherto freeloading nerd customers.
  - ogaj 3y ago
    Point well taken. My comment was primarily based on two other factors: a) the strategic signal it sends re developer resource allocation and b) the market signal it sends, selling a security solution while partnering with a company (not a knock - I've been a mullvad customer!) that provides solutions which are frequently used to bypass compliance/regulatory controls.
    - ignoramous 3y ago
      True, but if it is any positive signal, FiloSottile (golang crypto lead) vouched for Mullvad integration: https://github.com/tailscale/tailscale/issues/2880#issuecomment-1072622664 https://github.com/tailscale/tailscale/issues/2880#issuecomm... I think Tailscale going after 3 wildly different market segments (hobbyists, smb/teams, enterprises) [0] is why we're likely to see more such features, not less. [0] https://tailscale.com/blog/pricing-v3/ https://tailscale.com/blog/pricing-v3/
- 3y ago
hiramfromthechi 3y ago
First Mullvad Browser, now this. Mullvad's been making moves. Love to see it.
brynjolf 3y ago
Shame you have to pay double if you want to use Mullvad inside and outside Tailscale. I hope they work on integrating the services both ways so I can bring my Mullvad account number over.
- bananapub 3y ago
  why would tailscale want to eliminate you paying them for this nice feature
gbraad 3y ago
Did it just hand out free device connectivity on adding the add-on?
- gbraad 3y ago
  Why the downvote? ! I signed up for the addon and got 15 free devices. Curious if others see this too...
  - gbraad 3y ago
    seems this is related to a legacy setup and is a temporary good faith offer.
mcsniff 3y ago
As a personal user of Mullvad and a professional (solo dev) user of Tailscale, I hope this goes well.
aborsy 3y ago
Tailscaled runs as root. Is there a way to confine it, without losing functionality? As it connects many devices in my network, a vulnerability in Tailscale will have a significant impact (they had recently a nearly 10 CVE). That’s not the case with the standard client server approach (clients can run user space Wireguard). Even though I don’t open ports with Tailscale (more precisely, I outsource them to Tailscale), I still can’t sleep well at night!
- deceptive-footy 3y ago
  Could be wrong here but I believe you only need to run as root once for setup. The daemon can be run as a non-root user just fine Source: that's how I run it on Arch
  - ac29 3y ago
    Are you sure? I set up tailscale recently on Arch and the daemon is definitely running via a systemd system service (not a user service).
    - Bu9818 3y ago
      I don't know the case for tailscale but systemd system services can definitely be run under a specific user/group and have sandboxing applied.
    - MrDrMcCoy 3y ago
      You can easily override the service unit to confine it to an unprivileged user and then assign the net admin syscap do it can do what it needs to do.
- strangecyan 3y ago
  There's a userspace networking mode that pulls it out of the kernel? https://tailscale.com/kb/1112/userspace-networking/ https://tailscale.com/kb/1112/userspace-networking/
- tailscaletom 3y ago
godelski 3y ago
Mullvad has been doing a lot recently and I'm really loving it. It kinda seems like they are building a decentralized open source ecosystem through partnerships with other companies that are seeking similar things. Which really seems like the "hacker"'s dream (people liking security, not crackers). I wonder if we'll see Matrix next or Signal? (highly doubt Signal, but one can dream that the ecosystem is moving speech will actually mean something). I'd love to see a world of open source open protocol products working all in harmony. I just never really expected to see that until we got relatively close to a post-scarce society.
oynqr 3y ago
Too bad I can't pay Tailscale in cash like I can Mullvad.
skuzzie 3y ago
This is awesome. Just yesterday I was thinking about how nice it would be if I could just connect to Mullvad directly from Tailscale. Great work!
asynchronous 3y ago
Props to both companies, doing great work.
BearhatBeer 3y ago
[flagged]
nickstinemates 3y ago
This partnership makes me want to remove tailscale from my stack and instead use wireguard directly. Leaves a bad impression. Fighting against my instinct and telling myself I'm irrational. Tailscale is one of the first things I install on every machine. It's so good. But this partnership erodes trust, doesn't build it.
- throwaway894345 3y ago
  Does Mullvad have a bad reputation? I genuinely don't understand why this partnership would erode trust? Can you elaborate?
  - nickstinemates 3y ago
    I personally think all of the VPN providers are essentially selling snake oil. In addition, I think there are better tools for the job. If you want anonymity, use Tor. If you want to bypass geo-restricted content, use Bittorrent. From a strategy standpoint, I am not sure how this helps Tailscale at all. It changes how I view them and not in a good way.
    - skeaker 3y ago
      >use Bittorrent Funny you should mention that as it's often a key reason to pick up a VPN for many users...
    - sjsdaiuasgdia 3y ago
      "I want to play on multiplayer game servers in regions other than the one I live in" is a use case of VPNs that is not covered by your alternate methods. The privacy benefits are massively oversold, I agree with you there.
    - contact9879 3y ago
      There are not only two reasons to use a consumer VPN. It is entirely reasonable to shift trust from an opaque, investor-owned corporation that has no profit incentive or regulatory reasons to protect their customers personal information and network footprint (in fact they have incentive to sell as much data about their customers as possible) to a much more transparent company that does have the incentive to protect their customers' data. Mullvad has been at the forefront of not just VPN companies, but of any company, in their transparency, focus on their technology and pushing for further improvements in protecting data, raising the bar for trust and integrity and being more open. Consumer VPNs are not a panacea (and Mullvad does not market themselves to be one). It is unfortunate that almost every single VPN company is actually snake oil, but Mullvad is a welcome counter-example.
Arcuru 3y ago
Excellent, I'm finally able to retire the NixOS module I wrote to replace Tailscale to fix this exact problem [1]. It was certainly imperfect and overengineered, but it has worked for my use cases pretty well. I'm still not sure if I like the login situation for Tailscale (allowing only 3rd party auth) but I understand why they do it. EDIT: Turns out I can't use it yet since you have to buy Mullvad through Tailscale. I bought a year of Mullvad in May (they can't save payment info for port forwarding) and in the 4 months since they've removed port forwarding[2] and won't let me use my remaining credit for this integration. [1] https://jackson.dev/post/replacing-tailscale-with-nixos/ https://jackson.dev/post/replacing-tailscale-with-nixos/ [2] https://news.ycombinator.com/item?id=36113215 https://news.ycombinator.com/item?id=36113215
- alexktz 3y ago
  Custom OIDC providers are supported to mostly address your 3rd party auth concerns. https://tailscale.com/kb/1240/sso-custom-oidc/ https://tailscale.com/kb/1240/sso-custom-oidc/
orliesaurus 3y ago
So tailscale makes it super simple to create your little network, sorta like hamachi used to, but what's the point of mullvad in this equation - can someone explain it to me a little more clearly like im 5 (ELI5)?
- dreadlordbone 3y ago
  Probably access to their customer base.
  - orliesaurus 3y ago
    if that's the case then long gone are the days where Mullvad was the "send me cash in a snail-mail envelop and we'll let you in" provider
    - jerryzh 3y ago
      Actually you cannot use your present Mullvad account to do so. Instead, Mullvad provided exclusive API for tailscale as partner account to do so, which you can only get from Tailsacle if you choose their service. Mullvad only allows those data to go through its server. Given that Tailscale is a ridiculous company that advertises on privacy while force user to login via SSO by tech giants or OIDC which is shit in privacy, I will stick to my current origin Mullvad account and keep away from this service.
    - abound 3y ago
      In the most literal sense, they are still a "send me cash in a snail-mail envelope and we'll let you in" provider, see https://mullvad.net/en/pricing https://mullvad.net/en/pricing > Can I really pay with cash? > You bet, and please! Stay anonymous all the way. Just put your cash and payment token (randomly generated on our website) in an envelope and send it to us. We accept the following currencies: EUR, USD, GBP, SEK, DKK, NOK, CHF, CAD, AUD, NZD.
- bananapub 3y ago
  Tailscale creates a mesh network between your devices. In addition, you can tell it to tell some or all of your devices to use another device as an exit node for traffic heading to the Internet. Today they added the option to use Mullvad's VPN nodes to do that instead.
radicaldreamer 3y ago
Any way to expose ports using this integration (for Plex remote access etc.)?
- bananapub 3y ago
  Tailscale Funnel is the already existing feature for exposing ports.
isoprophlex 3y ago
Fantastic! Now all I need is a router that puts my entire home network - apple tv, internet of shit devices, everything - on tailscale...
- abwizz 3y ago
  german avm coporation has the "fritzbox" router lineup which can do ipsec and wireguard with normie gui. openwrt surely will do the job on many aio or a old laptop.
- kwanbix 3y ago
  Honest question, what would you achieve with that?
  - isoprophlex 3y ago
    An easy button in the tailscale/mullvad gui to get region-restricted content on all (my kids) devices.
    - kwanbix 3y ago
      but why do you need tailscale? won't you achieve that with mullvad?
      - isoprophlex 3y ago
        You are probably right. I guess I need a mullvad compatible router more than a tailscale compatible router...
- mig39 3y ago
  You can do it at the router level, or you can just have a device in your house (even a Raspberry PI) running an exit node. Then anybody using your tailnet can use it as an exit node, and route all traffic via your home connection.
  - 3y ago
comment0r 3y ago
Can I connect a device which is not capable of running custom software, i. e. the router my ISP gives me, but which is able to connect to WireGuard, be used to connect into an existing tailnet?
kristofferR 3y ago
Why is this only available in certain countries? It doesn't make sense that this isn't available in countries where both Tailscale and Mullvad are available, like here in Norway.
backendanon 3y ago
I've never used Tailscale or Mullvad, I do use a VPS and Wireguard that I configured and run. I'm wondering if people working at Tailscale or Mullvad could snoop on the traffic passing through their servers?
- raggi 3y ago
  Tailscalar here: Tailscale servers never see your traffic in plain text. In the integration with Mullvad in particular, WireGuard connections are always direct from your device to the selected Mullvad exit node.
hhh 3y ago
Finally, I can use Mullvad.
snapplebobapple 3y ago
Now if headscale could support thia that would be baller
- commoner 3y ago
  An issue has been created to implement support Wireguard-only peers like Mullvad exit nodes in Headscale: https://github.com/juanfont/headscale/issues/1545 https://github.com/juanfont/headscale/issues/1545 Headscale is a FOSS replacement for Tailscale's closed source coordination server. It is compatible with Tailscale's client apps, which are FOSS for Linux and Android, and partially closed source for macOS and Windows (https://tailscale.com/opensource/ https://tailscale.com/opensource/).
replwoacause 3y ago
Why would I use Tailscale over OpenVPN, for example? OpenVPN is supported by my router OOTB and the config was incredibly straightforward. It sounds like Mullvad adds a layer of privacy into a Tailscale network if I’m understanding it correctly. But Mullvad aside, I don’t get what separates Tailscale from something like OpenVPN.
- sitzkrieg 3y ago
  i believe wireguard is far more performant for one thing. i find the config files a million times more readable too but that's subjective
  - replwoacause 3y ago
    Huh. Well in my case I flipped the feature on in my Asus router, installed the OpenVPN client on my iPhone and imported the config file my router generated for me and that was it. Took like 2 minutes to do.
    - sitzkrieg 3y ago
      sure dont get me wrong, plugging in configs is same difference lol. but if your provider also has wireguard you may want to speedtest em
- dan_quixote 3y ago
  Significant ease of use.
- raggi 3y ago
  We have an article that tries to provide a detailed answer to this question! https://tailscale.com/compare/openvpn/ https://tailscale.com/compare/openvpn/
  - replwoacause 3y ago
    Cool thank you will give that a read.
dustingetz 3y ago
what’s the easiest way to get this on my TV roku stick so i can watch the HBO that I pay for in French?
artdigital 3y ago
So it’s $5 for 5 devices? I was expecting to see an option for existing mullvad customers to enter their credentials instead of buying a new subscription but may not be the same thing As someone that already has a subscription to a VPN service (not mullvad), I’m wondering what this would get me for end devices, vs just using my vpn provider as I’m already doing
- SadTrombone 3y ago
  Yep, disappointing that I can't bring my Mullvad credentials over and have to pay for a new account.
- OJFord 3y ago
  Oohh, this is exactly why you can't. I just commented similarly, but yours made me realise - this must be an agreement between the companies, Mullvad doesn't want you to fairly easily have all devices on the same tailnet, single exit node using 1/5 keys on Mullvad. Without Tailscale, if you configured them all separately, it'd use as many keys as you had devices. You can similarly bypass it without Tailscale, the same way you had to do it in Tailscale before this announcement, with everything egressing via a server which is the single Mullvad client. But it makes sense with the built-in solution (with probably better latency etc.) that they wouldn't want that.
OJFord 3y ago
Nice! Presently maintaining this hackily myself with an exit node running in Fly.io that reaches the internet via Mullvad, I'll be glad to simplify it and maintain less. I'm a bit confused about the payment section though - I have to pay for Mullvad via Tailscale now? Can't I just use the peer keys I've registered in my own account?
LilBytes 3y ago
Not supported in Australia yet, do we know when this will be available?
emmelaich 3y ago
Can I get a cut? > (to tailscale Mar 16, 2022) Hey can you also make a Tailscale browser in the same vein as the Tor browser? Random thought.
hsx 3y ago
This looks great, it's a shame that you have to go all the way through the payment process to see "Not available in your country (Australia)" though..
Kerbonut 3y ago
How do you use this with Tailnet lock?
mattlondon 3y ago
I recently (just earlier this week in fact) had to spend a few days on fast-but-restricted "guest" WiFi and was struggling with this very thing: I needed to use a tailnet to access my servers for vscode remote development, but also needed a VPN since the WiFi was blocking harmless stuff like duckduckgo.com In the end I was able to do a split-vpn config to allow VScode to bypass the VPN and leave the browser to use the VPN. Having tailscale just handle it would have been handy, and reading the docs today I found out that I could have just used a machine on my home network as the exitnode as well, which would have worked great too I expect. Have to say though that this was the first time I had used tailscale "in anger" for any serious period of time away from my home network. It was superb and (apart from the VPN issue) just worked exactly as advertised and I was able to access all the stuff on my NATed home network as if I was in my home office. Brilliant product - thanks to all the tailscale folks ("tailers"?) on here for the product!

567 points by xd1936 3y ago

Other side (probably should merge): https://news.ycombinator.com/item?id=37420382 https://news.ycombinator.com/item?id=37420382

aftergibson 3y ago

Two excellent products merging to solve an immediate issue I have. That is amazing!

tomxor 3y ago
*collaboration, not merging, which is a good thing :)

k__ 3y ago

What's the unique selling point of Mullvad?

gameoverhumans 3y ago
You can pay for the service by mailing them cash: https://mullvad.net/en/pricing https://mullvad.net/en/pricing They run servers with no hard drives: https://mullvad.net/en/blog/2022/8/1/expanding-diskless-infrastructure-to-more-locations-system-transparency-stboot/ https://mullvad.net/en/blog/2022/8/1/expanding-diskless-infr...
- dharmab 3y ago
  Not just no drives but, but also no logs, and per their last audit they're working towards no administrator access to the shell.
  - foobiekr 3y ago
    If they can update software they have administrator access any time they want it.
    - dharmab 3y ago
      But that requires compromising the supply chain rather than a single admin's account.
      - foobiekr 3y ago
        No it just requires the company wanting to do it due to a government order. The “compromise” is coming from inside the house. Might as well claim no one knows the admin passwords because they are written in a notebook that the management keeps in their home safe.
  - Thaxll 3y ago
    How do they comply with countries that requiere logs actually?
    - lolinder 3y ago
      Presumably by operating in a country that doesn't.
- foobiekr 3y ago
  The cash thing is awesome and good for them. That said, I don't know if Mullvad is good or evil, but one of the ways you can evaluate companies is to recognize when they're making sketchy, not-relevant claims to create an air of legitimacy. This "our servers have no disks" thing is kind of thing is marketing. It is meant to imply something that it doesn't actually demonstrate. Who cares if there are local disks? It doesn't change the threat model at all, it's mostly to convince people who don't know very much about claims which are basically impossible to prove. It's the higher-tier version of "we use military grade encryption." Lawful Intercept on the public internet does not rely on local hard drives on any node in the network and has not since the 90s, as a specific example of how meaningless this is.
  - dharmab 3y ago
    In Sweden, physical search of the drives is a real concern. The Swedish national police attempted to search Mullvad once, but since there was no data to seize they left empty handed.
    - anigbrowl 3y ago
      Realistically, what prevents police from just sticking in a USB device and doing a memory dump? I'm not sure I buy this story since police with a sufficiently strong warrant can always just take over a firm's premises and bring in their own forensic people until they find what they want.
      - cstrahan 3y ago
        I could be wrong, but I would think that a conveniently timed power outage would prevent the memory dumping scenario :)
        anigbrowl 3y ago
        Unless you automate this process to flush all memory periodically, this seems like a good way to get charged for interfering with an investigation or have your assets seized and thrown into legal limbo. Police aren't complete morons, in the real world goofing around like this has consequences.
- vinay_ys 3y ago
  You cannot hide from governments. If they want you badly enough they can track you anywhere. So, don't do anything illegal and expect any VPN to protect you because paid in cash! Remember, all governments have secret national security laws to surveil all data all the time and almost all governments' (even supposed enemies) secret national security agencies cooperate if they badly want to catch someone. You cannot hide from advertisers if you use a smartphone with apps. App developers who put ads within their app control the apps behavior completely and hence they can fingerprint your device and track you very well without using IP addresses. And within browsers, they can fingerprint you through many javascript features of the browser. Hiding your source IP does very little for your privacy. Almost all traffic (apps and websites) are encrypted via TLS (https, for example). So, even if you are on an insecure network, unless your OS's TLS certificate store is compromised, your communications are encrypted and protected against snooping from that insecure network. Also, even on open wifi networks, today, it is very unlikely that the wifi is running without at least WPA2 encryption. Most modern airports run secure wifi. (But they also monitor all traffic metadata for illegal activities). So, using a VPN as an exit node is just privacy theatre. VPN exit nodes in faraway countries are useful for bypassing content censorship in your own country, but it works only if the content streaming service cooperates with you. Remember, all ISPs are heavily regulated by governments and can be asked to mirror specific customer's traffic for analysis. I would be very surprised if they don't proactively do it for all VPN operator nodes by default.
  - ballenf 3y ago
    Are there browser plugins that can "fake" your browser fingerprint somewhat? Like, e.g., only showing OS default fonts installed, or fixing screen dimension info, etc? Or would this require forking a browser's code? Maybe futile, but I'd still consider using it.
    - bananapub 3y ago
      yes, and it's one of the things the Tor browser does to make fingerprinting harder.
      - 3y ago
- SleekEagle 3y ago
  You can mail in cash for ivpn too
master-lincoln 3y ago
trustworthiness
dewey 3y ago
Trustworthy audits: https://mullvad.net/en/blog/tag/audits/ https://mullvad.net/en/blog/tag/audits/
alangibson 3y ago
They practice what they preach. The recently stopped selling recurring subscriptions, and most likely threw away a big chunk of money, because there was no way to support them in an anonymous way.
- rozab 3y ago
  I'm glad I have a grandfathered subscription, because that seems like a usability nightmare
  - ipaddr 3y ago
    Convenience is the enemy of security
bananapub 3y ago
they take privacy extremely seriously, by trying to reduce the amount of data they even have that can get subpoenaed (no logs, no accounts, accept payment by cash) and appear to have not yet fucked up.

PentiumBug 3y ago

Ah! This could have been great for me, except that Tailscale recently cut off access to Cuban nationals to their service (they have their reasons, I guess.) Still, I think that the service they're building, step by step, is fine actually.

whimsicalism 3y ago
Any sort of export control/embargo that cuts off specifically VPN access to foreign nationals is supremely stupid imo
- PentiumBug 3y ago
  Exactly. I do believe that certain individuals and organizations might/should be excluded from service here; however, it seems like the only technical solution to regulations enforcement is to wholesale block a whole country.
- foobiekr 3y ago
  Should they sell VPN services to North Korea? What might the reasons be on the "no" side?
  - whimsicalism 3y ago
    The NK state is more than capable of arranging their own VPNs. I think the West gains a lot more by having generally available VPN access in adversary states than it loses from their ability to purchase technical services that they still will have difficulty getting access to currency to pay for and they still will have difficulty actually shipping anything to NK.
  - csomar 3y ago
    Bad comparison. NK is a nuclear state with nuclear weapons that is constantly threatening its neighbors. Cuba flirted with the idea but they didn't really materialize any nuclear or military capabilities. This was also a long time ago.
  - 3y ago

tw04 3y ago

On its face, this is really cool and being a user of both tailscale and mullvad this is awesome. My primary concern though: will this lead to potential privacy leaks? Can a government agency shakedown Tailscale now to trace your Mullvad ID/connection to your Tailscale account?

dewey 3y ago
That's exactly what they address here under "Private and (mostly) anonymous ": https://tailscale.com/blog/mullvad-integration/ https://tailscale.com/blog/mullvad-integration/ tl;dr: As always, it depends on your threat model.
- tw04 3y ago
  That doesn't really answer my question at all, at least not thoroughly in plain english. The question is: if a government agency goes to tailscale and says: "we're looking for Mullvad user 912830193276163872" - does tailscale log that, can they provide it, will they provide it?
  - bastawhiz 3y ago
    Tailscale needs to know information about your Mullvad license in order to authenticate you with the exit nodes. So it's theoretically possible for a government to ask Tailscale to correlate the data they've collected about you (like a client IP) with an authorized Mullvad license. Which, of course, they'd need to know represents your traffic from talking to Mullvad, which means you're not really placing any extra trust in Tailscale. I would assume that Headscale could also support this functionality in the future if you trusted Mullvad but not Tailscale.
    - Terretta 3y ago
      > Tailscale needs to know information about your Mullvad license in order to authenticate you with the exit nodes. That doesn't sound strictly true. Mullvad and Tailscale need to settle their costs between each other, and Tailscale needs to settle with you. What Tailscale needs to know about "your" Mullvad license is that x of y devices are using a Mullvad exit node, so they can charge you for y. What Mullvad needs to know is a high water mark usage (data transfer, throughput, connections, whatever) for Tailscale (not you) so they can charge Tailscale some carrier grade rate. There's little reason Tailscale couldn't do a iCloud Private Relay style Apple<->CloudFlare privacy preserving handoff.

jejeyyy77 3y ago

love Tailscale! hope it remains free

BxGyw2 3y ago

Fuck this is good, I've been manually maintaining NAT instances for each country with Mullvad on them, it was awful

tailspin2019 3y ago

This seems like a really smart move. Can anyone comment on whether it's possible to use something like NextDNS in conjunction with Tailscale and Mullvad? Edit: to clarify, I'm aware of the existing NextDNS integration with Tailscale - I was wondering if this (or other third party DNS) works specifically with these new Mullvad exit nodes...

geoffeg 3y ago
Tailscale supports using NextDNS as a nameserver: https://tailscale.com/kb/1218/nextdns/ https://tailscale.com/kb/1218/nextdns/
- BonoboIO 3y ago
  Did not know that, thanks for mentioning. This fixes probably a big problem for me.
bananapub 3y ago
first result on google for "tailscale nextdns" explains how to - for some reason - leak all your dns queries to some random company you don't pay money to: https://tailscale.com/kb/1218/nextdns/ https://tailscale.com/kb/1218/nextdns/
- Operyl 3y ago
  Err what? NextDNS is not free, you do pay them money every year to use it.
  - bananapub 3y ago
    https://nextdns.io/pricing https://nextdns.io/pricing
    - Operyl 3y ago
      You blow through 300k queries pretty quickly. The vast majority of users are paying nextdns.

mig39 3y ago

If you're already a Mullvad customer, is there some way to integrate this into your account? Right now, when I want to use Mullvad via my tailnet, I set the exit node to be a linux box at my house that is set to automatically send all traffic via Mullvad. That's free for me, since I already pay for Mullvad on that linux box at home.

bananapub 3y ago
https://twitter.com/bradfitz/status/1699806137661726790 https://twitter.com/bradfitz/status/1699806137661726790 fortunately it doesn't matter at all unless you've stacked up a lot of prepaid months at Mullvad.
- smashah 3y ago
  Wouldn't it be more "efficient" networking if I could sometimes just use the mullvad app instead of tailscale > mullvad? Either way it would be good to at least have the option to use an existing account. Maybe tailscale is taking a cut since mullvad dropped recurring sub support natively.
  - bananapub 3y ago
    > Wouldn't it be more "efficient" networking if I could sometimes just use the mullvad app instead of tailscale > mullvad? no, why do you think that's the case? presumably the mullvad client does the exact same thing as the tailscale client will do - configure a wireguard tunnel. edit: it will be interesting to see how much effort Tailscale put into preventing dns/route leaks vs the mullvad client
  - bradfitz 3y ago
    See https://github.com/tailscale/tailscale/issues/2880 https://github.com/tailscale/tailscale/issues/2880 for some background. The root problem this all came from is that users can't really run two VPN clients at a time. It rarely works due to them fighting over the same resources in various OSes. So we need to either add Mullvad support to Tailscale's client or Tailscale support to Mullvad's client. The former is tons easier.

chandureddyvari 3y ago

It sounds great. But their banner is showing that my ip address is from Mumbai, whereas I’m actually in Bengaluru, India. That’s not really re-assuring. Maybe it’s just apple relay on my device that’s obfuscating my details. edit: my bad, hit me bit late that it’s the intended behaviour.

bananapub 3y ago
... why yes, the thing you turned on that explicitly says it will reroute your traffic elsewhere will reroute your traffic elsewhere.
- chandureddyvari 3y ago
  yeah. my bad. Turning off relay, did show the right message. Thanks for that.
samstave 3y ago
Good job! You outed yourself on social media. Better move to Mumbai now to throw off the ipTrace.

m00dy 3y ago

Mullvad is impressive; however, the issue with Mullvad ID persists. The proposed solution is a Zero-Knowledge Proof Authentication system. With this approach, Mullvad will retain your public key but will not possess information regarding the association of specific sessions with individual Mullvad IDs.

bananapub 3y ago
if you're going to go to some random thread and post about your slightly related hobbyhorse, at least provide a link to some information about whatever you're upset about.

deelowe 3y ago

Can someone help me understand why VPN use seems to have exploded in recent years? I mean, I'm aware of the typical use-cases of corporate devices and such, but I doubt that's the major contributor here as those use-cases have existed for decades now. What's the impetus for what seems to be massive growth over the past 3+ years?

blahyawnblah 3y ago
Privacy and tracking prevention. It can get you access to stuff that's not in your country, depending on the service you're trying to get.
silverbax88 3y ago
States attempting to pass age-verification laws, and large streamers trying to fuck over customers by locking their account access to their home IP.
unethical_ban 3y ago
For me the fact is there are really easy to use user interfaces for VPNs now. They are very performant and low latency as well, so they're practical for everyday browsing on the modern web and even for gaming and streaming. Also, geographical blocks on content such as Netflix and BBC etc
judge2020 3y ago
For VPN in the Corporate network sense, it's for easy access to your computers. You don't want to have to open ports on your router or hope that whatever world-accessible service you throw out there is secure - instead, Tailscale handles authentication, authorization (if you'd like to set up ACLs), and it handles NAT traversal without any open ports.
- kevincox 3y ago
  I think the parent is talking about consumer VPNs which using VPN protocols to implement a proxy service, providing very little of a private network.
3y ago

wing-_-nuts 3y ago

Mullvad is such a good vpn. Too bad they disabled port forwarding. Does anyone know of a vpn that's anywhere near as good but allows it?

tmikaeld 3y ago
Ivacy has been around a long time and allows it [0]. [0] https://www.ivacy.com/port-forwarding/ https://www.ivacy.com/port-forwarding/ (They're based in Singapore)
- bananapub 3y ago
  picking a VPN based on extreme privacy demands that's domiciled in Singapore seems pretty courageous
  - tmikaeld 3y ago
    track record matters more than where the provider is based, I know of no cases where Ivacy have provided logs of anything to authorities.
kxrm 3y ago
I went over to https://airvpn.org/ https://airvpn.org/, so far so good.
redrove 3y ago
ovpn and azirevpn come to mind.
katbyte 3y ago
I switched to airvpn and have been happy
halJordan 3y ago
This tailscale press release claims you can forward nonstandard ports with this configuration. Who knows what that means or even if the copy was just approved six months ago or what.

fulafel 3y ago

VPN originally meant something quite different from the commercial consumer VPN product that mullvad represents, and was more like the encrypted overlay network provided by Tailscale. These are coming together again in this revolution of the wheel of reinvention. Not using "reinvention" in any negative way here, this is is good, I think. For history and how some people (John Gilmore[1]) thought uniquitous interoperable VPN tech (using the IETF standardized IPSec) be used to end-to-end secure internet traffic generally, see eg this FreeS/WAN rationale from the 90s: http://web.archive.org/web/20210125023625/https://www.freeswan.org/freeswan_trees/freeswan-1.5/doc/rationale.html http://web.archive.org/web/20210125023625/https://www.freesw... Then in between then and now were the VPN dark ages where it was mostly only used as a tech to accesss old timey corporate "internal networks". [1] https://en.wikipedia.org/wiki/John_Gilmore_(activist) https://en.wikipedia.org/wiki/John_Gilmore_(activist)

sam0x17 3y ago
Don't forget that historically, a "half-measure" a lot of people used to use to get around regional blocking was "web proxies" like those linked to by proxy.org. I used to operate one as a young teen and I will say they are a security nightmare -- nothing stopping a web proxy operator from sniffing all user credentials passing through them, and modifying PHPRoxy to do this is trivial. Personally I used to run a domain parking service (back when I was a teen in the early 00s) that used the domains as web proxies and replaced all adsense blocks it could find in the content with my adsense code, and did a 50/50 split between my code and the domain owner's code. Google eventually became wise to this and banned that sort of thing but it was pretty cool while it lasted, and honestly I think it was super fair considering we didn't even add any ad blocks just re-used the existing ones already in the content.
- lxgr 3y ago
  With practically-ubiquitous HTTPS, these days proxy use is mainly a privacy risk since for HTTPS, they usually can only support transparent byte relaying anyway.
  - 3y ago

deleted 3y ago

[deleted]

flurdy 3y ago

Mullvad is what Mozilla VPN uses underneath as a while label VPN. I guess this parnership does not apply to those licenses.

cisco87 3y ago

Mh interesting, I've wrote a while ago a script to start on connection in order to have mullvad coexist with tailscale, if anyone is interested, I also have one for NVPN DOMAINS=(login controlplane log derp1-all derp2-all derp3-all derp4-all derp5-all derp6-all derp7-all derp8-all derp9-all derp10-all derp11-all derp12-all derp13-all derp14-all derp15-all derp16-all derp17-all derp18-all derp19-all derp20-all derp21-all derp22-all derp23-all derp24-all) FWMARK=$(wg show $1 fwmark) for d in ${DOMAINS[@]}; do IPS=$(dig +answer -4 $d.tailscale.com +short) for IP in ${IPS[@]}; do iptables -I INPUT --in-interface tailscale0 -j MARK --set-mark $FWMARK iptables -I OUTPUT --out-interface tailscale0 -j MARK --set-mark $FWMARK iptables -I INPUT -d $IP/32 -j MARK --set-mark $FWMARK iptables -I INPUT -s $IP/32 -j MARK --set-mark $FWMARK iptables -I OUTPUT -d $IP/32 -j MARK --set-mark $FWMARK done; done; iptables -I OUTPUT -d 100.100.100.100/32 -j MARK --set-mark $FWMARK iptables -I OUTPUT -s 100.100.100.100/32 -j MARK --set-mark $FWMARK iptables -I INPUT -d 100.100.100.100/32 -j MARK --set-mark $FWMARK iptables -I INPUT -s 100.100.100.100/32 -j MARK --set-mark $FWMARK

Izkata 3y ago
Code blocks are done on here by indenting with 2 spaces, not with ```
- cisco87 3y ago
  Ah nice thank you
rbonvall 3y ago
Side note: you can simplify the first line like this: DOMAINS=(login controlplane log derp{1..24}-all)
- cisco87 3y ago
  Thank you!
drunner 3y ago
What is the $1 in `wg show $1` work and how/when do you run this script?

ogaj 3y ago

I love tailscale's technology and their contributions to the security ecosystem, but I can't help but take a contrarian angle to many of the comments here... This feels like a bad idea, and perhaps it signals defeat in the enterprise space (where the tech would provide the most value, imo). Tailscale raised $100M last year, surely based on a theory of growth upmarket. While this partnership surely provides value to personal consumers, it feels, at best, a distraction from the larger opportunity and, at worst, counterproductive to achieving it. I'm skeptical of the obvious counterpoint that this assists a flywheel of greater b2c satisfaction leading to b2b success...

bananapub 3y ago
tailscale has many employees, adding a small patch to wireguard client programming and strapping in mullvad account provisioning seems like a very small amount of effort for a pretty cool feature that also earns some recurring money from the hitherto freeloading nerd customers.
- ogaj 3y ago
  Point well taken. My comment was primarily based on two other factors: a) the strategic signal it sends re developer resource allocation and b) the market signal it sends, selling a security solution while partnering with a company (not a knock - I've been a mullvad customer!) that provides solutions which are frequently used to bypass compliance/regulatory controls.
  - ignoramous 3y ago
    True, but if it is any positive signal, FiloSottile (golang crypto lead) vouched for Mullvad integration: https://github.com/tailscale/tailscale/issues/2880#issuecomment-1072622664 https://github.com/tailscale/tailscale/issues/2880#issuecomm... I think Tailscale going after 3 wildly different market segments (hobbyists, smb/teams, enterprises) [0] is why we're likely to see more such features, not less. [0] https://tailscale.com/blog/pricing-v3/ https://tailscale.com/blog/pricing-v3/
3y ago

hiramfromthechi 3y ago

First Mullvad Browser, now this. Mullvad's been making moves. Love to see it.

brynjolf 3y ago

Shame you have to pay double if you want to use Mullvad inside and outside Tailscale. I hope they work on integrating the services both ways so I can bring my Mullvad account number over.

bananapub 3y ago
why would tailscale want to eliminate you paying them for this nice feature

gbraad 3y ago

Did it just hand out free device connectivity on adding the add-on?

gbraad 3y ago
Why the downvote? ! I signed up for the addon and got 15 free devices. Curious if others see this too...
- gbraad 3y ago
  seems this is related to a legacy setup and is a temporary good faith offer.

mcsniff 3y ago

As a personal user of Mullvad and a professional (solo dev) user of Tailscale, I hope this goes well.

aborsy 3y ago

Tailscaled runs as root. Is there a way to confine it, without losing functionality? As it connects many devices in my network, a vulnerability in Tailscale will have a significant impact (they had recently a nearly 10 CVE). That’s not the case with the standard client server approach (clients can run user space Wireguard). Even though I don’t open ports with Tailscale (more precisely, I outsource them to Tailscale), I still can’t sleep well at night!

deceptive-footy 3y ago
Could be wrong here but I believe you only need to run as root once for setup. The daemon can be run as a non-root user just fine Source: that's how I run it on Arch
- ac29 3y ago
  Are you sure? I set up tailscale recently on Arch and the daemon is definitely running via a systemd system service (not a user service).
  - Bu9818 3y ago
    I don't know the case for tailscale but systemd system services can definitely be run under a specific user/group and have sandboxing applied.
  - MrDrMcCoy 3y ago
    You can easily override the service unit to confine it to an unprivileged user and then assign the net admin syscap do it can do what it needs to do.
strangecyan 3y ago
There's a userspace networking mode that pulls it out of the kernel? https://tailscale.com/kb/1112/userspace-networking/ https://tailscale.com/kb/1112/userspace-networking/
tailscaletom 3y ago

godelski 3y ago

Mullvad has been doing a lot recently and I'm really loving it. It kinda seems like they are building a decentralized open source ecosystem through partnerships with other companies that are seeking similar things. Which really seems like the "hacker"'s dream (people liking security, not crackers). I wonder if we'll see Matrix next or Signal? (highly doubt Signal, but one can dream that the ecosystem is moving speech will actually mean something). I'd love to see a world of open source open protocol products working all in harmony. I just never really expected to see that until we got relatively close to a post-scarce society.

oynqr 3y ago

Too bad I can't pay Tailscale in cash like I can Mullvad.

skuzzie 3y ago

This is awesome. Just yesterday I was thinking about how nice it would be if I could just connect to Mullvad directly from Tailscale. Great work!

asynchronous 3y ago

Props to both companies, doing great work.

BearhatBeer 3y ago

[flagged]

nickstinemates 3y ago

This partnership makes me want to remove tailscale from my stack and instead use wireguard directly. Leaves a bad impression. Fighting against my instinct and telling myself I'm irrational. Tailscale is one of the first things I install on every machine. It's so good. But this partnership erodes trust, doesn't build it.

throwaway894345 3y ago
Does Mullvad have a bad reputation? I genuinely don't understand why this partnership would erode trust? Can you elaborate?
- nickstinemates 3y ago
  I personally think all of the VPN providers are essentially selling snake oil. In addition, I think there are better tools for the job. If you want anonymity, use Tor. If you want to bypass geo-restricted content, use Bittorrent. From a strategy standpoint, I am not sure how this helps Tailscale at all. It changes how I view them and not in a good way.
  - skeaker 3y ago
    >use Bittorrent Funny you should mention that as it's often a key reason to pick up a VPN for many users...
  - sjsdaiuasgdia 3y ago
    "I want to play on multiplayer game servers in regions other than the one I live in" is a use case of VPNs that is not covered by your alternate methods. The privacy benefits are massively oversold, I agree with you there.
  - contact9879 3y ago
    There are not only two reasons to use a consumer VPN. It is entirely reasonable to shift trust from an opaque, investor-owned corporation that has no profit incentive or regulatory reasons to protect their customers personal information and network footprint (in fact they have incentive to sell as much data about their customers as possible) to a much more transparent company that does have the incentive to protect their customers' data. Mullvad has been at the forefront of not just VPN companies, but of any company, in their transparency, focus on their technology and pushing for further improvements in protecting data, raising the bar for trust and integrity and being more open. Consumer VPNs are not a panacea (and Mullvad does not market themselves to be one). It is unfortunate that almost every single VPN company is actually snake oil, but Mullvad is a welcome counter-example.

Arcuru 3y ago

Excellent, I'm finally able to retire the NixOS module I wrote to replace Tailscale to fix this exact problem [1]. It was certainly imperfect and overengineered, but it has worked for my use cases pretty well. I'm still not sure if I like the login situation for Tailscale (allowing only 3rd party auth) but I understand why they do it. EDIT: Turns out I can't use it yet since you have to buy Mullvad through Tailscale. I bought a year of Mullvad in May (they can't save payment info for port forwarding) and in the 4 months since they've removed port forwarding[2] and won't let me use my remaining credit for this integration. [1] https://jackson.dev/post/replacing-tailscale-with-nixos/ https://jackson.dev/post/replacing-tailscale-with-nixos/ [2] https://news.ycombinator.com/item?id=36113215 https://news.ycombinator.com/item?id=36113215

alexktz 3y ago
Custom OIDC providers are supported to mostly address your 3rd party auth concerns. https://tailscale.com/kb/1240/sso-custom-oidc/ https://tailscale.com/kb/1240/sso-custom-oidc/

orliesaurus 3y ago

So tailscale makes it super simple to create your little network, sorta like hamachi used to, but what's the point of mullvad in this equation - can someone explain it to me a little more clearly like im 5 (ELI5)?

dreadlordbone 3y ago
Probably access to their customer base.
- orliesaurus 3y ago
  if that's the case then long gone are the days where Mullvad was the "send me cash in a snail-mail envelop and we'll let you in" provider
  - jerryzh 3y ago
    Actually you cannot use your present Mullvad account to do so. Instead, Mullvad provided exclusive API for tailscale as partner account to do so, which you can only get from Tailsacle if you choose their service. Mullvad only allows those data to go through its server. Given that Tailscale is a ridiculous company that advertises on privacy while force user to login via SSO by tech giants or OIDC which is shit in privacy, I will stick to my current origin Mullvad account and keep away from this service.
  - abound 3y ago
    In the most literal sense, they are still a "send me cash in a snail-mail envelope and we'll let you in" provider, see https://mullvad.net/en/pricing https://mullvad.net/en/pricing > Can I really pay with cash? > You bet, and please! Stay anonymous all the way. Just put your cash and payment token (randomly generated on our website) in an envelope and send it to us. We accept the following currencies: EUR, USD, GBP, SEK, DKK, NOK, CHF, CAD, AUD, NZD.
bananapub 3y ago
Tailscale creates a mesh network between your devices. In addition, you can tell it to tell some or all of your devices to use another device as an exit node for traffic heading to the Internet. Today they added the option to use Mullvad's VPN nodes to do that instead.

radicaldreamer 3y ago

Any way to expose ports using this integration (for Plex remote access etc.)?

bananapub 3y ago
Tailscale Funnel is the already existing feature for exposing ports.

isoprophlex 3y ago

Fantastic! Now all I need is a router that puts my entire home network - apple tv, internet of shit devices, everything - on tailscale...

abwizz 3y ago
german avm coporation has the "fritzbox" router lineup which can do ipsec and wireguard with normie gui. openwrt surely will do the job on many aio or a old laptop.
kwanbix 3y ago
Honest question, what would you achieve with that?
- isoprophlex 3y ago
  An easy button in the tailscale/mullvad gui to get region-restricted content on all (my kids) devices.
  - kwanbix 3y ago
    but why do you need tailscale? won't you achieve that with mullvad?
    - isoprophlex 3y ago
      You are probably right. I guess I need a mullvad compatible router more than a tailscale compatible router...
mig39 3y ago
You can do it at the router level, or you can just have a device in your house (even a Raspberry PI) running an exit node. Then anybody using your tailnet can use it as an exit node, and route all traffic via your home connection.
- 3y ago

comment0r 3y ago

Can I connect a device which is not capable of running custom software, i. e. the router my ISP gives me, but which is able to connect to WireGuard, be used to connect into an existing tailnet?

kristofferR 3y ago

Why is this only available in certain countries? It doesn't make sense that this isn't available in countries where both Tailscale and Mullvad are available, like here in Norway.

backendanon 3y ago

I've never used Tailscale or Mullvad, I do use a VPS and Wireguard that I configured and run. I'm wondering if people working at Tailscale or Mullvad could snoop on the traffic passing through their servers?

raggi 3y ago
Tailscalar here: Tailscale servers never see your traffic in plain text. In the integration with Mullvad in particular, WireGuard connections are always direct from your device to the selected Mullvad exit node.

hhh 3y ago

Finally, I can use Mullvad.

snapplebobapple 3y ago

Now if headscale could support thia that would be baller

commoner 3y ago
An issue has been created to implement support Wireguard-only peers like Mullvad exit nodes in Headscale: https://github.com/juanfont/headscale/issues/1545 https://github.com/juanfont/headscale/issues/1545 Headscale is a FOSS replacement for Tailscale's closed source coordination server. It is compatible with Tailscale's client apps, which are FOSS for Linux and Android, and partially closed source for macOS and Windows (https://tailscale.com/opensource/ https://tailscale.com/opensource/).

replwoacause 3y ago

Why would I use Tailscale over OpenVPN, for example? OpenVPN is supported by my router OOTB and the config was incredibly straightforward. It sounds like Mullvad adds a layer of privacy into a Tailscale network if I’m understanding it correctly. But Mullvad aside, I don’t get what separates Tailscale from something like OpenVPN.

sitzkrieg 3y ago
i believe wireguard is far more performant for one thing. i find the config files a million times more readable too but that's subjective
- replwoacause 3y ago
  Huh. Well in my case I flipped the feature on in my Asus router, installed the OpenVPN client on my iPhone and imported the config file my router generated for me and that was it. Took like 2 minutes to do.
  - sitzkrieg 3y ago
    sure dont get me wrong, plugging in configs is same difference lol. but if your provider also has wireguard you may want to speedtest em
dan_quixote 3y ago
Significant ease of use.
raggi 3y ago
We have an article that tries to provide a detailed answer to this question! https://tailscale.com/compare/openvpn/ https://tailscale.com/compare/openvpn/
- replwoacause 3y ago
  Cool thank you will give that a read.

dustingetz 3y ago

what’s the easiest way to get this on my TV roku stick so i can watch the HBO that I pay for in French?

artdigital 3y ago

So it’s $5 for 5 devices? I was expecting to see an option for existing mullvad customers to enter their credentials instead of buying a new subscription but may not be the same thing As someone that already has a subscription to a VPN service (not mullvad), I’m wondering what this would get me for end devices, vs just using my vpn provider as I’m already doing

SadTrombone 3y ago
Yep, disappointing that I can't bring my Mullvad credentials over and have to pay for a new account.
OJFord 3y ago
Oohh, this is exactly why you can't. I just commented similarly, but yours made me realise - this must be an agreement between the companies, Mullvad doesn't want you to fairly easily have all devices on the same tailnet, single exit node using 1/5 keys on Mullvad. Without Tailscale, if you configured them all separately, it'd use as many keys as you had devices. You can similarly bypass it without Tailscale, the same way you had to do it in Tailscale before this announcement, with everything egressing via a server which is the single Mullvad client. But it makes sense with the built-in solution (with probably better latency etc.) that they wouldn't want that.

OJFord 3y ago

Nice! Presently maintaining this hackily myself with an exit node running in Fly.io that reaches the internet via Mullvad, I'll be glad to simplify it and maintain less. I'm a bit confused about the payment section though - I have to pay for Mullvad via Tailscale now? Can't I just use the peer keys I've registered in my own account?

LilBytes 3y ago

Not supported in Australia yet, do we know when this will be available?

emmelaich 3y ago

Can I get a cut? > (to tailscale Mar 16, 2022) Hey can you also make a Tailscale browser in the same vein as the Tor browser? Random thought.

hsx 3y ago

This looks great, it's a shame that you have to go all the way through the payment process to see "Not available in your country (Australia)" though..

Kerbonut 3y ago

How do you use this with Tailnet lock?

mattlondon 3y ago

I recently (just earlier this week in fact) had to spend a few days on fast-but-restricted "guest" WiFi and was struggling with this very thing: I needed to use a tailnet to access my servers for vscode remote development, but also needed a VPN since the WiFi was blocking harmless stuff like duckduckgo.com In the end I was able to do a split-vpn config to allow VScode to bypass the VPN and leave the browser to use the VPN. Having tailscale just handle it would have been handy, and reading the docs today I found out that I could have just used a machine on my home network as the exitnode as well, which would have worked great too I expect. Have to say though that this was the first time I had used tailscale "in anger" for any serious period of time away from my home network. It was superb and (apart from the VPN issue) just worked exactly as advertised and I was able to access all the stuff on my NATed home network as if I was in my home office. Brilliant product - thanks to all the tailscale folks ("tailers"?) on here for the product!