4 ms·
Look into Nebula (or Tailscale if you trust third parties). I have all my workstations and servers on a mesh network that appears as a single /24 that is end t
by sneak 2y ago
Look into Nebula (or Tailscale if you trust third parties). I have all my workstations and servers on a mesh network that appears as a single /24 that is end to end encrypted, mutually authenticated and works through/behind NAT. I can spawn a vhost on any server that reverse proxies an API to any port on any machine.
It’s been an absolute gamechanger.
- logtrees 2y agoWhooooaaa that is mind-blowing. Thanks for sharing. <3
- elorant 2y agoIs there any resource that goes into more detail about how to setup all this?
- sneak 2y agohttps://github.com/slackhq/nebula https://github.com/slackhq/nebula the docs are good. when creating the initial CA make absolutely sure you set the CA expiration to 10-30 years, the default is 1 which means your whole setup explodes in a year without warning.
- aborsy 2y agoWhy do you have to trust a third party? It’s end to end encrypted, and with tail lock enabled, nodes can not be added without user’s permission.
- sneak 2y agoThe idea of “user’s permission” is determined by tailscale and/or the oidc provider. I don’t know anything about “tail lock”, perhaps it is a new mitigation for this issue? I didn’t start with tailscale because the only way you could log into it was with Google or GitHub or something. I don’t trust Microsoft or Google with auth for my internal network. I thought about running Headscale but Nebula was faster/easier for me.
- aborsy 2y agoYes, Microsoft and Google will not be able to authenticate to your network if you enable tail lock. A node in your network has to sign.
- hammyhavoc 2y agoWell, one example, depending on your threat model—their privacy policy states that they retain info and comply with subpoenas. There's also potential for malicious updates to compromise a network (as there is with most software unless you're auditing the source for each update). E2EE is only as meaningful as where the keys reside, and how easily those keys are abused.
- aborsy 2y agoThat’s interesting! The metadata is generally public information, I don’t care about that. The malicious updates and key abuse are more concerning. It’s true for all software, and probably better done with OS, like on iOS. The VPN could steal the keys, but that’s a lawsuit!
- hammyhavoc 2y agoAre the keys not already kept on their own infra?
- aborsy 2y agoNo, private keys don’t leave user’s devices. This is the case in all such products. But with a malicious update, they could ship them to their infra, targeting some users. The product then becomes malware!
- 1oooqooq 2y agowhy either of these over plain wireguard if you're not provisioning accounts?
- sneak 2y agoWireguard doesn’t do nat punching and is not mesh, it’s p2p only. totally different use case.
- 1oooqooq 2y agotrue. i do may punch with a pnp client on the server side.
- thot_experiment 2y agoI feel like wire guard definitely does nat punching unless I misunderstand you, I've been doing this sort of thing to have my phone and desktop on the same "LAN" all the time so I can moonlight in from anywhere (among other things) and they're definitely natted.
- drio 2y ago@sneak, can you comment on your experience with nebula vs Tailscale?