4 ms·

Misleading blog title, I'd more call it "Fixing Tailscale Route Hijacking". This is, honestly, one of the things I like the least about tailscale, and also one

Misleading blog title, I'd more call it "Fixing Tailscale Route Hijacking". This is, honestly, one of the things I like the least about tailscale, and also one of the things they are least likely to change. I understand why they do it, but it feels a bit like too much magic. Tailscale is an incredible bit of kit though.

dartos 3y ago
I’ve been hearing a lot of tailscale hype lately, but I don’t quite get it. How is it any better than running my own WireGuard instance?
- omeid2 3y ago
  This smells like "How is Dropbox better than running my own FTP server?" Tailscale/Headscale is to Wireguard, what Ubuntu is to Linux.
- corobo 3y ago
  It's mainly the initial connection bit that Tailscale does that makes it great, in my opinion. The rest of the features are decent too but for me this is the reason I use it https://tailscale.com/blog/how-nat-traversal-works https://tailscale.com/blog/how-nat-traversal-works Of course if you don't need this, or can set up NAT traversal yourself, and don't need anything else Tailscale does aye set up your own WireGuard network, no worries. All the reasons I use tailscale after initial connection are indeed the same as if I'd set up any other VPN (direct connectivity, secure connection, private connection, etc) At its very basic level it's a nice wrapper around WireGuard that handles the fiddly bits that might stop the initial connection for you.
- mynegation 3y ago
  Remember that famous HN comment about how you do not need Dropbox because you could setup this thing with sshfs or something? Tailscale is that Dropbox of VPNs.
  - kennethrc 3y ago
    I have several WG peers(phones, laptop, tablet) hosted up on a US residential symmetric fiber, and a couple of travel routers that can connect to it as well (this was helpful when going overseas so I could get to US TV providers, among other things). Since I've done that work already, would TailScale buy me anything?
    - Yeri 3y ago
      They offer some extra's like MagicDNS, go/, ssh auth, etc But no, if you don't need that and if you've done the setup part, and you're just looking at the VPN part, you wouldn't gain anything. Tailscale magically works, recovers well from crashes/network changes (I've had a few issues here with WG native client), manages your keys (and rotation of), creates point to point tunnels (which is just confusing via a plain text config with several devices).
    - deleted 3y ago
      [deleted]
    - mynegation 3y ago
      Do you ever find yourself in a situation where all NAT traversal strategies fail and your only way is through DERP server. Unless your in your own DERP, this is one of the situations where Tailscale might be useful.
      - kennethrc 3y ago
        I've got my WG's server endpoint open to the world; unless I'm misunderstanding something this won't be an issue for me. That being said, none of my WG peers really ever need to talk to each other (but the way I have it set up the remote IP subnet does route within it, so I guess they could).
        aborsy 3y ago
        If outgoing udp is blocked, Wireguard can not connect.
- monsieurbanana 3y ago
  If you even know about what WireGuard is then you're already in a minority. I personally would rather think as little as possible about networking, so I've been eye-ing tailscale.
- forbiddenlake 3y ago
  When you start having more than two peers and want them all to communicate, it starts getting unwieldy to expand the mesh, because that's not built in to Wireguard. You can certainly still do it, even run your own coordinator (like headscale for tailscale), but it probably saves you time and headache on medium to large meshes.
- neilalexander 3y ago
  If you use Wireguard only to route to/from to a central hub that has a static IP address then what you have is perfectly fine. Tailscale works well for situations where you have lots of roaming devices that perhaps want to talk to each other as well as to central hubs or you want to gate all of this behind some kind of SSO.
  - dexterdog 3y ago
    You don't need a static IP. Just a name. I use wireguard on all of my devices connecting to the wireguard host on my router by name.
    - kennethrc 3y ago
      Yeah. My MikroTik router comes with a free DDNS service, for example
    - neilalexander 3y ago
      While you're correct, it's worth keeping in mind that Wireguard only looks up DNS names when the tunnel is started. If your remote endpoint address changes, the only way your client will find out is either if you restart the tunnel on the client device by hand, or in the lucky case, if the remote endpoint happens to send some data to you at the right time while your client is still hopefully reachable at the same IP+port, which may not be a given behind a NAT if a port mapping times out from inactivity or if it changed network in the meantime.
- zikduruqe 3y ago
  For me, I run Wireguard 99% of the time. I only use Tailscale for those rare times port 51820 is blocked for whatever reason. Then Tailscale works.
- paxys 3y ago
  How do you use WireGuard without a central internet-visible server or connect to a machine that is sitting behind a NAT?
- ktosobcy 3y ago
  Ease of use? If self host a couple of services on local RPi but when I tried to setup Wire Guard I just failed... In the end I opted for simple socks5 proxy but I'm tempted to use tailscale as it seems to JuatWork
- Arcuru 3y ago
  Easier setup and management.

dartos 3y ago

I’ve been hearing a lot of tailscale hype lately, but I don’t quite get it. How is it any better than running my own WireGuard instance?

omeid2 3y ago
This smells like "How is Dropbox better than running my own FTP server?" Tailscale/Headscale is to Wireguard, what Ubuntu is to Linux.
corobo 3y ago
It's mainly the initial connection bit that Tailscale does that makes it great, in my opinion. The rest of the features are decent too but for me this is the reason I use it https://tailscale.com/blog/how-nat-traversal-works https://tailscale.com/blog/how-nat-traversal-works Of course if you don't need this, or can set up NAT traversal yourself, and don't need anything else Tailscale does aye set up your own WireGuard network, no worries. All the reasons I use tailscale after initial connection are indeed the same as if I'd set up any other VPN (direct connectivity, secure connection, private connection, etc) At its very basic level it's a nice wrapper around WireGuard that handles the fiddly bits that might stop the initial connection for you.
mynegation 3y ago
Remember that famous HN comment about how you do not need Dropbox because you could setup this thing with sshfs or something? Tailscale is that Dropbox of VPNs.
- kennethrc 3y ago
  I have several WG peers(phones, laptop, tablet) hosted up on a US residential symmetric fiber, and a couple of travel routers that can connect to it as well (this was helpful when going overseas so I could get to US TV providers, among other things). Since I've done that work already, would TailScale buy me anything?
  - Yeri 3y ago
    They offer some extra's like MagicDNS, go/, ssh auth, etc But no, if you don't need that and if you've done the setup part, and you're just looking at the VPN part, you wouldn't gain anything. Tailscale magically works, recovers well from crashes/network changes (I've had a few issues here with WG native client), manages your keys (and rotation of), creates point to point tunnels (which is just confusing via a plain text config with several devices).
  - deleted 3y ago
    [deleted]
  - mynegation 3y ago
    Do you ever find yourself in a situation where all NAT traversal strategies fail and your only way is through DERP server. Unless your in your own DERP, this is one of the situations where Tailscale might be useful.
    - kennethrc 3y ago
      I've got my WG's server endpoint open to the world; unless I'm misunderstanding something this won't be an issue for me. That being said, none of my WG peers really ever need to talk to each other (but the way I have it set up the remote IP subnet does route within it, so I guess they could).
      - aborsy 3y ago
        If outgoing udp is blocked, Wireguard can not connect.
monsieurbanana 3y ago
If you even know about what WireGuard is then you're already in a minority. I personally would rather think as little as possible about networking, so I've been eye-ing tailscale.
forbiddenlake 3y ago
When you start having more than two peers and want them all to communicate, it starts getting unwieldy to expand the mesh, because that's not built in to Wireguard. You can certainly still do it, even run your own coordinator (like headscale for tailscale), but it probably saves you time and headache on medium to large meshes.
neilalexander 3y ago
If you use Wireguard only to route to/from to a central hub that has a static IP address then what you have is perfectly fine. Tailscale works well for situations where you have lots of roaming devices that perhaps want to talk to each other as well as to central hubs or you want to gate all of this behind some kind of SSO.
- dexterdog 3y ago
  You don't need a static IP. Just a name. I use wireguard on all of my devices connecting to the wireguard host on my router by name.
  - kennethrc 3y ago
    Yeah. My MikroTik router comes with a free DDNS service, for example
  - neilalexander 3y ago
    While you're correct, it's worth keeping in mind that Wireguard only looks up DNS names when the tunnel is started. If your remote endpoint address changes, the only way your client will find out is either if you restart the tunnel on the client device by hand, or in the lucky case, if the remote endpoint happens to send some data to you at the right time while your client is still hopefully reachable at the same IP+port, which may not be a given behind a NAT if a port mapping times out from inactivity or if it changed network in the meantime.
zikduruqe 3y ago
For me, I run Wireguard 99% of the time. I only use Tailscale for those rare times port 51820 is blocked for whatever reason. Then Tailscale works.
paxys 3y ago
How do you use WireGuard without a central internet-visible server or connect to a machine that is sitting behind a NAT?
ktosobcy 3y ago
Ease of use? If self host a couple of services on local RPi but when I tried to setup Wire Guard I just failed... In the end I opted for simple socks5 proxy but I'm tempted to use tailscale as it seems to JuatWork
Arcuru 3y ago
Easier setup and management.