22 ms·

I really like these guys, I wish their pricings wasn't so ridiculous. proper access control shouldn't cost 18 bucks a month for a vpn, it's basically unsellabl

I really like these guys, I wish their pricings wasn't so ridiculous. proper access control shouldn't cost 18 bucks a month for a vpn, it's basically unsellable to management at that price and the lower tiers are unsellable without it.

starttoaster 3y ago
I'm really interested in what you're comparing Tailscale to internally, because it does way more than just VPN. What are the cheaper options, and do they also have an SSH feature, oauth authentication to the network for automation services, the ability to stand up VPN node loadbalancers in kubernetes clusters, and ACME certificate request automation through LetsEncrypt? Just to list a few features that I use from Tailscale's free tier that I don't normally think of as the job of a VPN service. And they're constantly adding new features that make it a really interesting and competitive choice, in my opinion. Honestly I'm mostly interested in this take because I'm shocked by how much they offer in the cheaper tiers.
- conception 3y ago
  But if you’re comparing it to other VPNs and only need VPN the pricing is bonkers.
  - starttoaster 3y ago
    That's fair. I guess if you just need a VPN, it doesn't really make sense to consider a product that packs all of these VPN-adjacent features. But part of my point was how much you're able to do on Tailscale for free, so in that regard, the pricing really doesn't seem as bonkers to me, to be honest. The $6/month tier is also incredibly reasonable for unlimited users, but it is annoying, I'll grant, that they actually drop some ACL features from Free tier to Starter. I suppose that's how they funnel a large number of enterprises from considering Starter in favor of Premium. But if you actually make use of the feature set of the platform, which if you have a decent DevOps team I'm pretty sure there's tools in there that they'll love, then $18/User/month actually doesn't seem too outrageous to me.
  - newdee 3y ago
    Which other VPNs? And are you talking about trad VPN (concentrators/hub & spoke)? If so, you wouldn’t be considering Tailscale anyway.
- snapplebobapple 3y ago
  My problem is I don't care about any of the stuff you mentioned because I can't easily recreate my internal vlan segregation at the six dollar tier, I need to pay up for the 18 dollar a user tier, which is insane pricing for my shop of 70-100 users. Compare to the included fortissl vpn that is provided by my router. I can add users to groups in active directory that are then synced to azuread, which provides saml authentication to the vpn. Users login with their O365 credentials and I can configure it to mimic the already approved vlan segregation easily based on groups provided by O365. This basic stuff should just be there for a corporate solution and it appears to be but for 100 users the bill is 21.6k/year, which is literally 4 times higher than I can justify/ get approved. Yes it has a bunch of other features, but they are irrelevant because the basics aren't there at a price that is doable.
  - starttoaster 3y ago
    > Yes it has a bunch of other features, but they are irrelevant because the basics aren't there at a price that is doable. The basics don't cost $18/user/month though. The whole package does. I hear what you're saying, and maybe you just accidentally worded it this way, but the obvious rebuttal to it is: How much would it cost you to set up a solution where only ACL'd users can SSH into your infrastructure/servers? You're looking at services that cost money like Userify for that. For many of the other features Tailscale offers, you're probably either paying another service to handle that responsibility, not doing it at all, or you're spending your time recreating it, and I bet your time isn't cheap to the company either. Anyway, that's somewhat of a hypothetical rebuttal. I actually assume you did the due diligence and weighed the cost with the portion of the feature set that you actually would make use of. I could see the price being more fair if they offered a lower cost tier that only provided the VPN and ACLs for unlimited users, but I'm not a savvy businessman so I'm not sure if it makes sense for a multi-tool company to sell a minority of users a screwdriver.
    - snapplebobapple 3y ago
      You're assuming that feature matters to me (it does but I have a lot of users relative to servers, so even the most basic tier of userify express or their cloud offering would handle my needs for dramatically less than premium tailscale). What you're missing is the foundation of being able to deploy something like this depends on easy acls that integrate with my current identity system (i.e. saml) because I need to be able to control access per business unit so that when the mesh of everything is brought online users still only have access to the subset of systems they should have access to. This matters whether it's Sheila in accounting who only ever uses it to remote desktop to her on prem workstation, or jackie in IT using it to manage on prem servers across multiple locations and cloud servers. So yes, maybe a small subset of my users are actually using enough of the premium bundle to justify that cost but I can't even mix and match because the basis of every use case (the ACLs) are only in the premium package in a functional way.
j45 3y ago
You can install headscale and self-host for nothing then. Tailscale has competitors too with some overlaps, it might not be fully what you're looking for. All I know is within a few minutes I had more of a project working together than without it. It really is one of the more remarkably simple tools out there for everything it does, and has a generous free tier with 100 devices and 3 users.
- j45 3y ago
  Link to headscale https://github.com/juanfont/headscale https://github.com/juanfont/headscale
- selfmodruntime 3y ago
  Just a quick heads up, colleagues of mine could not successfully host headscale themselves. In the end, they saw the value and bought tailscale access. Configuring wireguard really is that hard. Tailscale is easily worth it
  - watermelon0 3y ago
    IIRC, Wireguard is exclusively managed by Tailscale clients, and not by the server (headscale in this case).
  - j45 3y ago
    Any details? Could be adjacent self-hosting issues compared to headscale itself. Considering it can also run in a docker container, it’s next to trivial to install locally to try out https://headscale.net/running-headscale-container/ https://headscale.net/running-headscale-container/
  - hnarn 3y ago
    > colleagues of mine could not successfully host headscale themselves it’d be interesting to know why, I use it frequently at work and it’s worked pretty well so far.
  - eddieroger 3y ago
    Your (their) mileage may vary. I set up Headscale with external auth and it's been a dream, the kind where I don't really have to think too much about it. The only little gotcha is that sometimes getting the iOS client to read the server url from settings can be tricky. But once authed, it "just works" for me.
djbusby 3y ago
What management is tripping over $18/mo? Per person that expense is closer to zero than any of a dozen other things we're buying for them.
- MobiusHorizons 3y ago
  Pretty sure that is the monthly cost per user, not a flat monthly fee.
stingraycharles 3y ago
I had a very easy time selling this. We moved away from an OpenVPN setup, and Tailscale made it so much easier to onboard new employees and to do a lot more things “the right way”. We’re a fully remote company, so it’s even more important. Although I admit that in my role I have quite a lot of weight in convincing management on these topics, price was not a concern. We’ve been a happy customer since April last year, everyone on the premium / “expensive” tier. I’m also very impressed with their development speed: some features that were said “May take a few years to be delivered” actually were delivered last year already. Cloudflare One could have been an alternative, but that would have been even more expensive.
- snapplebobapple 3y ago
  Yah, if I was a fully remote company this would have been an easier sell. What I actually am (and what the vast majority of business likely is) is a small bunch of office locations and a bunch of cloud infrastructure so I can approximate tailscale in a way I am unhappy with right now by limiting cloud access to the ips of the office and controlling access with various things from the office pcs. The vpn to do that works properly with acls and is included in our networking gear. So what tailscale is competing with is something that is a sunk cost and not ideal but of minimal additional cost vs 20k a year of additional cost providing premium features to all users when maybe 10% of users need them. Basically, tailscale has a bundling problem. They bundled necessary to all features (proper acls) with a bunch of premium stuff that is of less value to many and they don't have the market power of microsoft with their windows operating system to force that kind of arrangement down my throat. They need a 2-3 dollar a month tier with proper acls and mesh vpn, then al a carte of the rest of the feature bloat per user (ssh key management is worth no more than 2 dollars a month based on the competition, no idea what the other features are worth because I have no use for them). They also really need to improve their windows experience. More than once during testing I had a windows update break the vpn requiring alternate means of logging in and reconnecting, but that's an ancillary issue.
karmajunkie 3y ago
that’s basically the issue that pushed us to twingate. turns out i like twingate a little better for their routing capabilities anyway (which isn’t to say i don’t like tailscsle at all—i use both for different purposes.)

starttoaster 3y ago

I'm really interested in what you're comparing Tailscale to internally, because it does way more than just VPN. What are the cheaper options, and do they also have an SSH feature, oauth authentication to the network for automation services, the ability to stand up VPN node loadbalancers in kubernetes clusters, and ACME certificate request automation through LetsEncrypt? Just to list a few features that I use from Tailscale's free tier that I don't normally think of as the job of a VPN service. And they're constantly adding new features that make it a really interesting and competitive choice, in my opinion. Honestly I'm mostly interested in this take because I'm shocked by how much they offer in the cheaper tiers.

conception 3y ago
But if you’re comparing it to other VPNs and only need VPN the pricing is bonkers.
- starttoaster 3y ago
  That's fair. I guess if you just need a VPN, it doesn't really make sense to consider a product that packs all of these VPN-adjacent features. But part of my point was how much you're able to do on Tailscale for free, so in that regard, the pricing really doesn't seem as bonkers to me, to be honest. The $6/month tier is also incredibly reasonable for unlimited users, but it is annoying, I'll grant, that they actually drop some ACL features from Free tier to Starter. I suppose that's how they funnel a large number of enterprises from considering Starter in favor of Premium. But if you actually make use of the feature set of the platform, which if you have a decent DevOps team I'm pretty sure there's tools in there that they'll love, then $18/User/month actually doesn't seem too outrageous to me.
- newdee 3y ago
  Which other VPNs? And are you talking about trad VPN (concentrators/hub & spoke)? If so, you wouldn’t be considering Tailscale anyway.
snapplebobapple 3y ago
My problem is I don't care about any of the stuff you mentioned because I can't easily recreate my internal vlan segregation at the six dollar tier, I need to pay up for the 18 dollar a user tier, which is insane pricing for my shop of 70-100 users. Compare to the included fortissl vpn that is provided by my router. I can add users to groups in active directory that are then synced to azuread, which provides saml authentication to the vpn. Users login with their O365 credentials and I can configure it to mimic the already approved vlan segregation easily based on groups provided by O365. This basic stuff should just be there for a corporate solution and it appears to be but for 100 users the bill is 21.6k/year, which is literally 4 times higher than I can justify/ get approved. Yes it has a bunch of other features, but they are irrelevant because the basics aren't there at a price that is doable.
- starttoaster 3y ago
  > Yes it has a bunch of other features, but they are irrelevant because the basics aren't there at a price that is doable. The basics don't cost $18/user/month though. The whole package does. I hear what you're saying, and maybe you just accidentally worded it this way, but the obvious rebuttal to it is: How much would it cost you to set up a solution where only ACL'd users can SSH into your infrastructure/servers? You're looking at services that cost money like Userify for that. For many of the other features Tailscale offers, you're probably either paying another service to handle that responsibility, not doing it at all, or you're spending your time recreating it, and I bet your time isn't cheap to the company either. Anyway, that's somewhat of a hypothetical rebuttal. I actually assume you did the due diligence and weighed the cost with the portion of the feature set that you actually would make use of. I could see the price being more fair if they offered a lower cost tier that only provided the VPN and ACLs for unlimited users, but I'm not a savvy businessman so I'm not sure if it makes sense for a multi-tool company to sell a minority of users a screwdriver.
  - snapplebobapple 3y ago
    You're assuming that feature matters to me (it does but I have a lot of users relative to servers, so even the most basic tier of userify express or their cloud offering would handle my needs for dramatically less than premium tailscale). What you're missing is the foundation of being able to deploy something like this depends on easy acls that integrate with my current identity system (i.e. saml) because I need to be able to control access per business unit so that when the mesh of everything is brought online users still only have access to the subset of systems they should have access to. This matters whether it's Sheila in accounting who only ever uses it to remote desktop to her on prem workstation, or jackie in IT using it to manage on prem servers across multiple locations and cloud servers. So yes, maybe a small subset of my users are actually using enough of the premium bundle to justify that cost but I can't even mix and match because the basis of every use case (the ACLs) are only in the premium package in a functional way.

j45 3y ago

You can install headscale and self-host for nothing then. Tailscale has competitors too with some overlaps, it might not be fully what you're looking for. All I know is within a few minutes I had more of a project working together than without it. It really is one of the more remarkably simple tools out there for everything it does, and has a generous free tier with 100 devices and 3 users.

j45 3y ago
Link to headscale https://github.com/juanfont/headscale https://github.com/juanfont/headscale
selfmodruntime 3y ago
Just a quick heads up, colleagues of mine could not successfully host headscale themselves. In the end, they saw the value and bought tailscale access. Configuring wireguard really is that hard. Tailscale is easily worth it
- watermelon0 3y ago
  IIRC, Wireguard is exclusively managed by Tailscale clients, and not by the server (headscale in this case).
- j45 3y ago
  Any details? Could be adjacent self-hosting issues compared to headscale itself. Considering it can also run in a docker container, it’s next to trivial to install locally to try out https://headscale.net/running-headscale-container/ https://headscale.net/running-headscale-container/
- hnarn 3y ago
  > colleagues of mine could not successfully host headscale themselves it’d be interesting to know why, I use it frequently at work and it’s worked pretty well so far.
- eddieroger 3y ago
  Your (their) mileage may vary. I set up Headscale with external auth and it's been a dream, the kind where I don't really have to think too much about it. The only little gotcha is that sometimes getting the iOS client to read the server url from settings can be tricky. But once authed, it "just works" for me.

djbusby 3y ago

What management is tripping over $18/mo? Per person that expense is closer to zero than any of a dozen other things we're buying for them.

MobiusHorizons 3y ago
Pretty sure that is the monthly cost per user, not a flat monthly fee.

stingraycharles 3y ago

I had a very easy time selling this. We moved away from an OpenVPN setup, and Tailscale made it so much easier to onboard new employees and to do a lot more things “the right way”. We’re a fully remote company, so it’s even more important. Although I admit that in my role I have quite a lot of weight in convincing management on these topics, price was not a concern. We’ve been a happy customer since April last year, everyone on the premium / “expensive” tier. I’m also very impressed with their development speed: some features that were said “May take a few years to be delivered” actually were delivered last year already. Cloudflare One could have been an alternative, but that would have been even more expensive.

snapplebobapple 3y ago
Yah, if I was a fully remote company this would have been an easier sell. What I actually am (and what the vast majority of business likely is) is a small bunch of office locations and a bunch of cloud infrastructure so I can approximate tailscale in a way I am unhappy with right now by limiting cloud access to the ips of the office and controlling access with various things from the office pcs. The vpn to do that works properly with acls and is included in our networking gear. So what tailscale is competing with is something that is a sunk cost and not ideal but of minimal additional cost vs 20k a year of additional cost providing premium features to all users when maybe 10% of users need them. Basically, tailscale has a bundling problem. They bundled necessary to all features (proper acls) with a bunch of premium stuff that is of less value to many and they don't have the market power of microsoft with their windows operating system to force that kind of arrangement down my throat. They need a 2-3 dollar a month tier with proper acls and mesh vpn, then al a carte of the rest of the feature bloat per user (ssh key management is worth no more than 2 dollars a month based on the competition, no idea what the other features are worth because I have no use for them). They also really need to improve their windows experience. More than once during testing I had a windows update break the vpn requiring alternate means of logging in and reconnecting, but that's an ancillary issue.

karmajunkie 3y ago

that’s basically the issue that pushed us to twingate. turns out i like twingate a little better for their routing capabilities anyway (which isn’t to say i don’t like tailscsle at all—i use both for different purposes.)