5 ms·
Travelling with Tailscale
- ma2rten 3y agoI have an upcoming trip to Europe, which I am quite excited about. I wanted to set up a Tailscale exit node to ensure that critical apps I depend on, such as banking portals continue working from outside the country. I've never had an issue accessing banking portals from Europe.
- monsieurbanana 3y agoNot quite banking portals, but I've had banking apps of a South American country that were only available for Play Store accounts of that country. Really annoying, and even with VPN/proxy/Tailscale it's not easily fixable as you can only change the country of a play store account once every 12 months.
- Yeri 3y agoYes, many (smaller) banks only allow play/app store access to the countries they operate in (really annoying for expats!). But that won't affect you if you're just travelling. Even if you get a new phone, your account is still set to your original country.
- mpeg 3y agoI've done some work in this area with large american banks (around a decade ago, so it might have changed!) and generally the only problem you could have is if you were abroad and using a new device – you wouldn't get locked out but it might trigger some extra verification steps
- dpb001 3y agoYes, this is still a thing. Last year I installed Linux on an old laptop to use while traveling in SE Asia. Had problems with TD Bank because of this, complicated by my account needing SMS to the US number for the extra verification.
- paxys 3y agoI'm gonna assume they actually meant streaming services, not banks.
- pc86 3y agoWhy would you assume that? Especially since they said... the exact opposite.
- izacus 3y agoJust because you didn't, it doesn't mean us others don't get "flagged for fraud" and banned when trying to do something remotely.
- jsmith99 3y agoI wonder if trying to account for that would make you look even more risky/fraudulent. Eg you access the bank portal from a US address but at similar time you physically use the card in Europe.
- jxcl 3y agoMy credit union seems to blanket ban European IP addresses. You basically get an nginx 403 page if you try to access their site from anywhere that isn’t the US. It’s dumb but I like their other services so I make due with a vpn when I’m in Europe
- dainiusse 3y agoDon't do that for banks. I had a reverse problem. Went to usa (comming from eu) and used vpn for accessing bank portals. I paid using my card somewhere in sf, and then logged in to my bank using VPN. They blocked me because of possible fraud…
- mynegation 3y agoSeconded. Banks have all kinds of IP access rules that can bite you. Connecting from an IP allocated to one of the well known clouds will certainly raise a flag as throwaway VPS are often used for fraud.
- hypeatei 3y agoI understand why they do it (fraud mitigation in layers) but it's still ridiculous. Most US banks don't even offer TOTP for second factor; they force SMS 2FA which is not secure at all. Maybe once passkeys or hardware keys are widely adopted they can remove the atrocious fraud detection.
- Yeri 3y agoMany people (still) don't understand how 2FA works. Whereas 99.999%? of the users won't use tor/$vpnCompany/cloud provider IPs. It's all in terms of which is less likely to lead to a support request. I worked with a relatively big bank that used a tool like Akami or Cloudflare. With those tools you can just ban/block entire countries (think any IP from Iran, Russia, etc) or entire ASNs.
- copperx 3y agoIt's much better to have an exit node at home.
- dainiusse 3y agoIt won't help. That was my case. It is simply geolocation differenxe
- 3y ago
- mynegation 3y agoY’all installing Tailscale on work laptops? Unless you got an explicit written permission to do just that - don’t. In many places this is a fireable offence.
- phantomathkg 3y ago[citation needed]?
- mynegation 3y agoI cannot really cite from the internal documents like code of conduct or cybersecurity policy.
- cqqxo4zV46cp 3y agoAh, a person that has only worked for a particular type of organisation lectures me about what is and is not appropriate for me to do at work. I love this one. Thankfully I live in a country with real labour laws, where this couldn’t legally be a “fireable offence”, even if it were a problem, which it ain’t.
- mynegation 3y agoGood for you. My comment is not directed at you, but at people that may not be aware that installing certain software on work equipment might be a breach of policy.
- greggsy 3y agoIf you allow staff to install rando VPN profiles, let alone software, and instead rely solely on the goodwill of your employees - don’t. In many places that’s a fireable offence.
- mynegation 3y agoI mean… I agree with you. Unfortunately “I did that because no automated checks stopped me” is a very weak defence.
- paxys 3y agoThe great thing about Tailscale is that you don't need an external internet-visible server to act as a proxy. Its NAT traversal is near perfect. The digital ocean droplet mentioned in the post is likely creating more problems than it is solving (its IP address is easily recognizable, and so your traffic will be flagged across the internet). I use a raspberry pi connected to my router as a DNS server and exit node and the experience is seamless. And as a bonus I get to keep using my home IP address for all traffic.
- mfiro 3y agoMy dsl router has the option to setup wireguard and it can be the exit node with a few clicks. What does Tailscale offer more than that?
- ktosobcy 3y agoMost of the routers don't have such option?
- hx833001 3y agoMy router doesn’t, so with Tailscale I can get the same functionality using an Apple TV. It’s pretty nice.
- paxys 3y agoHow do you use the router's VPN when you are not at home?
- mfiro 3y agoAfter setting up the Wireguard on the router (Fritzbox), you get a QR code or config file which you can import to any Wireguard client.
- moritzruth 3y ago> Tailscale builds on top of WireGuard by adding automatic mesh configuration, single sign-on (SSO), NAT traversal, TCP transport, and centralized Access Control Lists (ACLs). — https://tailscale.com/kb/1035/wireguard https://tailscale.com/kb/1035/wireguard
- rpicard 3y agoI set up Tailscale on my Apple TV at home and can use it as an exit node when traveling, so traffic still comes from my home IP. https://tailscale.com/kb/1280/appletv https://tailscale.com/kb/1280/appletv
- linsomniac 3y agoMisleading blog title, I'd more call it "Fixing Tailscale Route Hijacking". This is, honestly, one of the things I like the least about tailscale, and also one of the things they are least likely to change. I understand why they do it, but it feels a bit like too much magic. Tailscale is an incredible bit of kit though.
- dartos 3y agoI’ve been hearing a lot of tailscale hype lately, but I don’t quite get it. How is it any better than running my own WireGuard instance?
- omeid2 3y agoThis smells like "How is Dropbox better than running my own FTP server?" Tailscale/Headscale is to Wireguard, what Ubuntu is to Linux.
- corobo 3y agoIt's mainly the initial connection bit that Tailscale does that makes it great, in my opinion. The rest of the features are decent too but for me this is the reason I use it https://tailscale.com/blog/how-nat-traversal-works https://tailscale.com/blog/how-nat-traversal-works Of course if you don't need this, or can set up NAT traversal yourself, and don't need anything else Tailscale does aye set up your own WireGuard network, no worries. All the reasons I use tailscale after initial connection are indeed the same as if I'd set up any other VPN (direct connectivity, secure connection, private connection, etc) At its very basic level it's a nice wrapper around WireGuard that handles the fiddly bits that might stop the initial connection for you.
- mynegation 3y agoRemember that famous HN comment about how you do not need Dropbox because you could setup this thing with sshfs or something? Tailscale is that Dropbox of VPNs.
- kennethrc 3y ago