4 ms·

OOh -- this sounds actually potentially awesome for business use-cases. Tailscale is the commercial tool to help setup and manage wireguard networks, and it had

OOh -- this sounds actually potentially awesome for business use-cases. Tailscale is the commercial tool to help setup and manage wireguard networks, and it had a big security incident earlier this year (though they were prompt to rectify). I don't use tailscale but I almost did. One of the things that caught me was not wanting to give a third party any control. (Also, at the time I didn't absolutely have a burning need given the number of servers and people involved). Tailscale's model is to charge businesses; I'm not sure if you are making this FOSS but something FOSS to me would be preferable. How does the privacy work on your site? I haven't the time to log in and play around right now. My main concerns would be if I'm posting my configs to a third party, that third party now has a vector to 'root' my networks. And if this is a site meant for sharing, there's the other concern that I or the site accidentally temporarily makes permissions public giving strangers that access. I'm sure you've already contemplated this in the design; I'd love to hear your approach on this forum.

candiddevmike 3y ago
Have you considered using Headscale?
- mushufasa 3y ago
  Oh -- yes I did actually. Forgot about that till just now.
- linsomniac 3y ago
  Tailscale is great, but for anything more than toy uses, particularly business uses, where it's a critical part of your infra, you should consider paying Tailscale or using Nebula. My biggest reasons for saying this are: Headscale config errors (including ACL issues) will take down the whole Tailnet until you can get it corrected, setting up extra "relay" nodes is fairly likely and somewhat "hard" (especially without a dedicated IP), and headscale can take quite a few resources. Data point: I recently set up a ~200 node Tailnet with headscale and in retrospect wish I had gone with Nebula. Tailscale's "magic" can be nice, but it can also lead to network weirdness. For example, I can't seem to use the tailnet to route traffic between sites without turning on "accept-routes", but turning that on causes traffic for local ethernet segments on those nodes to be routed over the Tailnet. Reasons I went with Headscale/Tailscale over Nebula: We could enforce periodic re-logins on user workstations, Tailscale was good at routing around networking problems (Nebula has since added similar functionality), Tailscale's self-service is really nice (A user can login from any of their devices using OIDC, Nebula you have to generate a cert). Tailscale and Headscale are both fantastic, just beware of the limitations.
  - cube2222 3y ago
    > and in retrospect wish I had gone with Nebula Could you expand why (happy Tailscale user here, asking mostly out of curiosity)?
    - linsomniac 3y ago
      Largely went into it above... Mostly it is the "adding an ACL can take down my tailnet" issue. I had hoped to use Tailscale as an overlay network, starting to route our internal traffic over it for some things, but I've lost my tailnet so many times because of issues with headscale ACLs taking it down. This is largely a headscale issue. Largely my issues are running ~200 nodes via headscale. Don't get me wrong, headscale is fantastic software. But it's not up for having our production networking rely on it. I tried and tried to get funding to by Tailscale, but it just wasn't in the cards with the economy as it is right now.
helloooooooo 3y ago
Which security issue? https://tailscale.com/security-bulletins/ https://tailscale.com/security-bulletins/ None of these appear particularly severe?
- mushufasa 3y ago
  https://emily.id.au/tailscale https://emily.id.au/tailscale
- linsomniac 3y ago
  https://tailscale.com/security-bulletins/#ts-2022-004 https://tailscale.com/security-bulletins/#ts-2022-004 It was a pretty severe issue, but tailscale did respond quickly to it.
rudasn 3y ago
Thanks for looking into it! Yes, I thought/think about security a lot. First, you don't have to share/upload your private keys to WireHub for it to work - the generated configs will only have the public key (which we do store, it's public anyway). Second, if you do provide provide private keys, you must first encrypt them in browser with a password. The password is never stored, just used for encryption. Third, because of 2, to see a full config with private keys and everything you need to provide said password. If you scroll at the bottom of the page you can see the widget in action. I don't want to worry about loosing important data, so I try to avoid collecting it in the first place.
- jve 3y ago
  > Other than the in-browser PrivateKey encryption/decryption mechanism, all functionality of WireHub is accessible without JavaScript. But that is done by browser, right? So one still must consider trust to wirehub.org to be sure that it is not sending the secret somewhere? But then again, same trust must be considered by hosted solution - trust for the running website code.
  - rudasn 3y ago
    Trust, or no trust, since it's all in the browser you can check for yourself what gets posted to WireHub when you submit the form containing your private key :) Quick edit: you also don't have to provide your private keys, just the public ones. Another edit: actually it's two forms. One that has the public key and password hint that gets posted to WireHub, and one that has the private key, your password and the password hint that's only handled on the client with javascript and never gets submitted. So I do try not to get to your secrets. I even have the form attribute of the private key input set to a non existent form, just in case it does get submitted, that piece of info will stay in the browser.
FL410 3y ago
Check out Nebula/Defined.net
- PlutoIsAPlanet 3y ago
  Been running a Nomad/Consul cluster on Nebula for nearly a year now and have next to zero issues. Only issue I ever had was caused by the Lighthouse being behind 1:1 NAT, due to Scaleway.
rodlette 3y ago
> Tailscale is the commercial tool to help setup and manage wireguard networks, and it had a big security incident earlier this year (though they were prompt to rectify). > I don't use tailscale but I almost did. One of the things that caught me was not wanting to give a third party any control. Yes, https://tailscale.com/security-bulletins/#ts-2022-004 https://tailscale.com/security-bulletins/#ts-2022-004 was scary. Their response was great, but I'm reminded of Tim Cook's response to a question over what he'd do if it was in Zuckerberg's position (re a FB leak): "I wouldn't be in that situation". Tailscale is a technical marvel, but it does a bit too much for my liking, for something that has the access it does... even more if you enable its SSH key support. I use plain Wireguard, but would like LAN discovery and STUN. https://www.wirehub.org/ https://www.wirehub.org/ looks nice, as does https://git.deuxfleurs.fr/Deuxfleurs/wgautomesh https://git.deuxfleurs.fr/Deuxfleurs/wgautomesh which does LAN discovery too (as Tailscale does).
braginini 3y ago
Have you seen NetBird? Can be fully self-hosted https://github.com/netbirdio/netbird#quickstart-with-self-hosted-netbird https://github.com/netbirdio/netbird#quickstart-with-self-ho...

candiddevmike 3y ago

Have you considered using Headscale?

mushufasa 3y ago
Oh -- yes I did actually. Forgot about that till just now.
linsomniac 3y ago
Tailscale is great, but for anything more than toy uses, particularly business uses, where it's a critical part of your infra, you should consider paying Tailscale or using Nebula. My biggest reasons for saying this are: Headscale config errors (including ACL issues) will take down the whole Tailnet until you can get it corrected, setting up extra "relay" nodes is fairly likely and somewhat "hard" (especially without a dedicated IP), and headscale can take quite a few resources. Data point: I recently set up a ~200 node Tailnet with headscale and in retrospect wish I had gone with Nebula. Tailscale's "magic" can be nice, but it can also lead to network weirdness. For example, I can't seem to use the tailnet to route traffic between sites without turning on "accept-routes", but turning that on causes traffic for local ethernet segments on those nodes to be routed over the Tailnet. Reasons I went with Headscale/Tailscale over Nebula: We could enforce periodic re-logins on user workstations, Tailscale was good at routing around networking problems (Nebula has since added similar functionality), Tailscale's self-service is really nice (A user can login from any of their devices using OIDC, Nebula you have to generate a cert). Tailscale and Headscale are both fantastic, just beware of the limitations.
- cube2222 3y ago
  > and in retrospect wish I had gone with Nebula Could you expand why (happy Tailscale user here, asking mostly out of curiosity)?
  - linsomniac 3y ago
    Largely went into it above... Mostly it is the "adding an ACL can take down my tailnet" issue. I had hoped to use Tailscale as an overlay network, starting to route our internal traffic over it for some things, but I've lost my tailnet so many times because of issues with headscale ACLs taking it down. This is largely a headscale issue. Largely my issues are running ~200 nodes via headscale. Don't get me wrong, headscale is fantastic software. But it's not up for having our production networking rely on it. I tried and tried to get funding to by Tailscale, but it just wasn't in the cards with the economy as it is right now.

helloooooooo 3y ago

Which security issue? https://tailscale.com/security-bulletins/ https://tailscale.com/security-bulletins/ None of these appear particularly severe?

mushufasa 3y ago
https://emily.id.au/tailscale https://emily.id.au/tailscale
linsomniac 3y ago
https://tailscale.com/security-bulletins/#ts-2022-004 https://tailscale.com/security-bulletins/#ts-2022-004 It was a pretty severe issue, but tailscale did respond quickly to it.

rudasn 3y ago

Thanks for looking into it! Yes, I thought/think about security a lot. First, you don't have to share/upload your private keys to WireHub for it to work - the generated configs will only have the public key (which we do store, it's public anyway). Second, if you do provide provide private keys, you must first encrypt them in browser with a password. The password is never stored, just used for encryption. Third, because of 2, to see a full config with private keys and everything you need to provide said password. If you scroll at the bottom of the page you can see the widget in action. I don't want to worry about loosing important data, so I try to avoid collecting it in the first place.

jve 3y ago
> Other than the in-browser PrivateKey encryption/decryption mechanism, all functionality of WireHub is accessible without JavaScript. But that is done by browser, right? So one still must consider trust to wirehub.org to be sure that it is not sending the secret somewhere? But then again, same trust must be considered by hosted solution - trust for the running website code.
- rudasn 3y ago
  Trust, or no trust, since it's all in the browser you can check for yourself what gets posted to WireHub when you submit the form containing your private key :) Quick edit: you also don't have to provide your private keys, just the public ones. Another edit: actually it's two forms. One that has the public key and password hint that gets posted to WireHub, and one that has the private key, your password and the password hint that's only handled on the client with javascript and never gets submitted. So I do try not to get to your secrets. I even have the form attribute of the private key input set to a non existent form, just in case it does get submitted, that piece of info will stay in the browser.

FL410 3y ago

Check out Nebula/Defined.net

PlutoIsAPlanet 3y ago
Been running a Nomad/Consul cluster on Nebula for nearly a year now and have next to zero issues. Only issue I ever had was caused by the Lighthouse being behind 1:1 NAT, due to Scaleway.

rodlette 3y ago

> Tailscale is the commercial tool to help setup and manage wireguard networks, and it had a big security incident earlier this year (though they were prompt to rectify). > I don't use tailscale but I almost did. One of the things that caught me was not wanting to give a third party any control. Yes, https://tailscale.com/security-bulletins/#ts-2022-004 https://tailscale.com/security-bulletins/#ts-2022-004 was scary. Their response was great, but I'm reminded of Tim Cook's response to a question over what he'd do if it was in Zuckerberg's position (re a FB leak): "I wouldn't be in that situation". Tailscale is a technical marvel, but it does a bit too much for my liking, for something that has the access it does... even more if you enable its SSH key support. I use plain Wireguard, but would like LAN discovery and STUN. https://www.wirehub.org/ https://www.wirehub.org/ looks nice, as does https://git.deuxfleurs.fr/Deuxfleurs/wgautomesh https://git.deuxfleurs.fr/Deuxfleurs/wgautomesh which does LAN discovery too (as Tailscale does).

braginini 3y ago

Have you seen NetBird? Can be fully self-hosted https://github.com/netbirdio/netbird#quickstart-with-self-hosted-netbird https://github.com/netbirdio/netbird#quickstart-with-self-ho...