5 ms·

> something that I'd like to get rid off in the future as well by adding a VPN layer on top. What VPN software would you use? Personally I've never found anyth

> something that I'd like to get rid off in the future as well by adding a VPN layer on top. What VPN software would you use? Personally I've never found anything I consider as trustworthy as OpenSSH.

throwaway63467 2y ago
I use OpenVPN for historical reasons but today I’d go for Wireguard, much simpler, faster and integrated in the kernel, connectionless so much less friction when e.g. rebooting or changing networks.
com 2y ago
Wireguard is quite good too, and if you’re up for some complication in your life you can do full mesh quite easily with it if your online infra is a bit distributed.
- RGamma 2y ago
  There's also helpers for wireguard meshes. Or become dependent on yet another service like tailscale (at least there's headscale) or zerotier.
- running101 2y ago
  It has no dhcp
  - com 2y ago
    I use IPv6 magic
  - immibis 2y ago
    you can statically configure if you don't have a zillion hosts
Sammi 2y ago
Aren't the cool kids using https://tailscale.com/ https://tailscale.com/ these days?
- diggan 2y ago
  Ain't no cool kids (in my world) using centralized for-profit services for essential things like that.
  - crote 2y ago
    Pretty much all of it is open-source, and there's a self-hosted open-source alternative available for the only closed-source cloud-hosted component[0] - and that's even actively being promoted by Tailscale![1] [0]: https://headscale.net/ https://headscale.net/ [1]: https://tailscale.com/opensource#encouraging-headscale https://tailscale.com/opensource#encouraging-headscale
    - diggan 2y ago
      Seems the cool kids are using Headscale then if anything, rather than Tailscale :)
- WhyNotHugo 2y ago
  multicast/mDNS is broken, and it doesn't seem that it will be fixed anytime soon. This prevents hosts discovering each other as if they were on non-virtual LAN. Personally, I find that having to set up an OIDC provider is too much overhead for a VPN. In a corporate setting, you likely have something already, but for individuals or small teams it's too much extra work.
  - iudqnolq 2y ago
    How could that work with their architecture? They configure your device to use a DNS server running locally in their app. That resolves their device names to their internal device IP addresses. Their device names default to hostnames, just like mDNS does. So to give an example if I enter http://geder http://geder in my browser I want that to resolve to 100.100.5.10 regardless of if I am on my home network (where geder is) or if I am on a train. From my perspective half the reason to use tailscale is that it replaces why I'd want mDNS with less bugs.
imhoguy 2y ago
Wireguard. Actually I setup also 2nd backup tunnel in case some upgrade or change messes up the first one.
- tmdetect 2y ago
  +1 to WireGuard. For people new to it, there are some great scripts which set up and configure it for you like https://github.com/Nyr/wireguard-install https://github.com/Nyr/wireguard-install

throwaway63467 2y ago

I use OpenVPN for historical reasons but today I’d go for Wireguard, much simpler, faster and integrated in the kernel, connectionless so much less friction when e.g. rebooting or changing networks.

com 2y ago

Wireguard is quite good too, and if you’re up for some complication in your life you can do full mesh quite easily with it if your online infra is a bit distributed.

RGamma 2y ago
There's also helpers for wireguard meshes. Or become dependent on yet another service like tailscale (at least there's headscale) or zerotier.
running101 2y ago
It has no dhcp
- com 2y ago
  I use IPv6 magic
- immibis 2y ago
  you can statically configure if you don't have a zillion hosts

Sammi 2y ago

Aren't the cool kids using https://tailscale.com/ https://tailscale.com/ these days?

diggan 2y ago
Ain't no cool kids (in my world) using centralized for-profit services for essential things like that.
- crote 2y ago
  Pretty much all of it is open-source, and there's a self-hosted open-source alternative available for the only closed-source cloud-hosted component[0] - and that's even actively being promoted by Tailscale![1] [0]: https://headscale.net/ https://headscale.net/ [1]: https://tailscale.com/opensource#encouraging-headscale https://tailscale.com/opensource#encouraging-headscale
  - diggan 2y ago
    Seems the cool kids are using Headscale then if anything, rather than Tailscale :)
WhyNotHugo 2y ago
multicast/mDNS is broken, and it doesn't seem that it will be fixed anytime soon. This prevents hosts discovering each other as if they were on non-virtual LAN. Personally, I find that having to set up an OIDC provider is too much overhead for a VPN. In a corporate setting, you likely have something already, but for individuals or small teams it's too much extra work.
- iudqnolq 2y ago
  How could that work with their architecture? They configure your device to use a DNS server running locally in their app. That resolves their device names to their internal device IP addresses. Their device names default to hostnames, just like mDNS does. So to give an example if I enter http://geder http://geder in my browser I want that to resolve to 100.100.5.10 regardless of if I am on my home network (where geder is) or if I am on a train. From my perspective half the reason to use tailscale is that it replaces why I'd want mDNS with less bugs.

imhoguy 2y ago

Wireguard. Actually I setup also 2nd backup tunnel in case some upgrade or change messes up the first one.

tmdetect 2y ago
+1 to WireGuard. For people new to it, there are some great scripts which set up and configure it for you like https://github.com/Nyr/wireguard-install https://github.com/Nyr/wireguard-install