16 ms·

Tailscale is pretty useful

• sneak 2y ago
  You can do all of this stuff with Nebula (from slack oss), without some centralized service. I use it on all my computers and it works great.
  • frontsideair 2y ago
    This is the first time I’m hearing about Nebula. How does it compare to Tailscale?
• ur-whale 2y ago
  I am curious: what does tailscale offer that wireguard doesn't in the first place?
• laidoffamazon 2y ago
  I love tailscale, but the performance overhead on file transfer (my primary use case for it) is very real. Samba transfers take a 15 megabyte per second hit over tailscale even with a fairly fast CPU on both ends (Ryzen 3600 and Ryzen 7900X3D) on my local network
  • homebrewer 2y ago
    Try netbird, it's the same idea but with support for using kernel-mode WireGuard when one of the peers is able to connect to another one directly without doing NAT tricks (so either both peers are on the same subnet, or at least one of them has a public IP).
  • SteveNuts 2y ago
    In my experience Samba is just a slow protocol due to its chattiness.
    • RamRodification 2y ago
      Samba is not a protocol. It's an implementation of dozens of services and a dozen protocols, including SMB (Server Message Block).
    • huang_chung 2y ago
      This is just wrong. Tuned properly SMB is much faster than SFTP.
  • renewiltord 2y ago
    WG is quite fast. Can’t be the limiter. Like this guy I’ve driven 1 G easily on 7950 and Epyc 9654. I think I did 10 G but I can’t recall because at some point I just moved everything local and did 40 G. But I’m sure it would work on CPU on reasonable machine https://old.reddit.com/r/mikrotik/comments/112mo4v/is_there_a_mikrotik_device_that_can_do_wireguard/ https://old.reddit.com/r/mikrotik/comments/112mo4v/is_there_...
    • laidoffamazon 2y ago
      Tailscale is using a user space implementation of WG on my Windows machine for obvious reasons - I am imagining that to be part of the bottleneck.
      • dgacmu 2y ago
        A very likely culprit is the packet encapsulation changing things for the worse. An informative test would be to tcpdump (wireshark, etc) the packet stream with and without tailscale. Look at packet sizes, etc. The overhead shouldn't be 15% but there could be some weird interaction with the link MTU for the VPN causing, e.g., smaller packets to be sent with more overhead.
  • bb88 2y ago
    They have a DERP server I guess. Your traffic might be going through one of those.
  • vlovich123 2y ago
    15 MiB/s is trivially handled by any CPU you're likely to run. Indeed 100 MiB/s seems reasonable. 15 MiB/s cap seems either the protocol being used is doing too many round trips (assuming the machines you're testing with are far apart) or the network that's being set up requires routing through Tailscale's infra for hole punching.
    • immibis 2y ago
      It sounds like the traffic gets routed through a Tailscale relay because all attempts at direct connection failed. A direct connection would have been as fast as a direct connection.
    • laidoffamazon 2y ago
      Not a cap. It’s the delta. About 117megabytes a second measured by windows explorer to around 101. These are on my local network, connected to my switch over 1gig Ethernet.
      • vlovich123 2y ago
        Ok a 12% differential on a LAN is kind of surprising. I wonder what Tailscale could possibly doing that would be causing this issue because aside from the control plane I don't believe they're in the data path all that much. Maybe WireGuard on Windows isn't as optimized as it is on Linux? https://www.reddit.com/r/linux/comments/9bnowo/wireguard_benchmark_between_two_servers_with_10/ https://www.reddit.com/r/linux/comments/9bnowo/wireguard_ben... from 7 years ago is about trying to get it running at 10Gbps speeds.
      • baq 2y ago
        IME it adds about (at least) 1ms of latency over local networks. You should be able to use a different dns suffix to use the LAN interface instead of Tailscale.
  • huang_chung 2y ago
    You likely have network misconfiguration like MTU issue. Don't blame Samba if you cannot configure properly.
  • nsbk 2y ago
    It is indeed! I used to connect to a Synology NAS as remote backup location through Tailscale and the transfers would peak at around 5 MB/s. Now I mount the NAS volumes to a host at the same location and sftp to it. It’s still dog slow at 30MB/s but that’s the NAS limitation. Direct access to the NAS can also be achieved via Subnet Routers https://tailscale.com/kb/1019/subnets https://tailscale.com/kb/1019/subnets
• jaxtracks 2y ago
  The features here seem to be fairly standard with most the WireGuard based VPNs these days. For example, I use Nord for my use-case which is very similar to the author's. This allows me to rsync my home directory between my laptop, tablet, phone's Termux env, and desktop (all running Linux) to maintain configuration parity and file locality regardless of where I turn these devices on, so long as they have internet. Does Tailscale have features that set it apart now that other VPNs have gotten the private mesh thing down pretty well?
  • deleted 2y ago
    [deleted]
  • yjftsjthsd-h 2y ago
    What other VPNs do mesh networking? I only know of zerotier (proprietary) and nebula (FOSS except that the Android app is proprietary)
    • radlad 2y ago
      Shameless plug, but some of the Nebula team (including myself) works on https://www.defined.net/ https://www.defined.net/ (proprietary managed Nebula networks.) Also, ZeroTier is "open-source ish." They use the BSL license for most of their code (https://www.zerotier.com/blog/on-the-gpl-to-bsl-transition/ https://www.zerotier.com/blog/on-the-gpl-to-bsl-transition/) and I believe you can self-host (https://docs.zerotier.com/selfhost/ https://docs.zerotier.com/selfhost/)
      • yjftsjthsd-h 2y ago
        > Shameless plug, but some of the Nebula team (including myself) works on https://www.defined.net/ https://www.defined.net/ (proprietary managed Nebula networks.) My one objection to Nebula is that its Android app is proprietary, and your response is to plug the even more proprietary way to run it? > Also, ZeroTier is "open-source ish." So it's not FOSS.
        • 2y ago
• Trumpi 2y ago
  I was once in South Africa and needed to look up my prescriptions in the CVS app. I had lost my pills and needed to show a local pharmacist what I needed. CVS geoblocked me. Luckily I had a TailScale exit node running at home, which solved the problem.
  • deuschelandian 2y ago
    When I was in Germany - Capital One blocked access to my account unless I confirmed via SMS or tapping my card. Both of which I didn’t have with me. Tunnelling into my home machine I was able to access the account and transfer money I needed. Sure a VPN might be able to do this too but it’s nice being able to exit via a connection you control. I can also watch Plex movies without exposing ports.
    • codethief 2y ago
      Another data point: I was at Doha airport recently and logged into their public WiFi. Unfortunately, they seemed to be MitM'ing certain connections, mostly to well-known domains. To work around this, I tried setting up Mullvad (which I had used occasionally in the past) but they downgraded Mullvad.net to HTTP, too. Thankfully, I had Tailscale already set up and I could easily book their Mullvad package and add Mullvad as an exit node to my Tailnet. Problem solved.
  • HPsquared 2y ago
    Alternative: OpenVPN server on your router.
    • gabeio 2y ago
      > OpenVPN server on your router. Honestly I would suggest wireguard on your router before openvpn.
      • deuschelandian 2y ago
        That’s all Tailscale is really.
• deleted 2y ago
  [deleted]
• ydnaclementine 2y ago
  > it’s no longer possible thanks to a cursed thing called CGNAT as someone who does publicly expose services that have auth, why does CGNAT make exposing ports publicly bad?
  • jjcob 2y ago
    It makes it impossible, because your modem/router no longer has a public IP that you can connect to from the internet.
  • ThePowerOfFuet 2y ago
    Not bad, impossible; it is NAT over which you have no control and thus cannot forward ports.
  • deleted 2y ago
    [deleted]
  • jen729w 2y ago
    FYI my ISP (Aussie Broadband) will put you on a non-CGNAT subnet if you call and ask. Tailscale is a better idea.
    • joshstrange 2y ago
      My ISP (USA, Metronet) will give you a static IP (instead of their CGNAT) for $10/mo which I happily pay. Tailscale is great but direct is always better IMHO.
  • tass 2y ago
    Other replies explained the why, though cgnat wouldn’t be a problem if you also had ipv6. Luckily for me I have a regular ip4 address but if that ever changed I’d be out of luck unless my isp (quantum fibre) implemented a proper ipv6 solution.
    • aodin 2y ago
      I have Quantum Fiber in Colorado and enabled IPv6 on the old CenturyLink C4000XG modem following these directions: https://www.centurylink.com/home/help/internet/modems-and-routers/advanced-setup/enable-ipv6.html https://www.centurylink.com/home/help/internet/modems-and-ro...
• simonw 2y ago
  I used Tailscale the other week to solve a problem where a government website was blocking me from scraping it from GitHub Actions... so I ran an exit node on an Apple TV on my homework and configure the GitHub Actions worker to use that instead. Worked great! https://til.simonwillison.net/tailscale/tailscale-github-actions https://til.simonwillison.net/tailscale/tailscale-github-act...
  • djsjajah 2y ago
    You could have also self-hosted the GitHub Actions runner which might have been easier as long as you had something to run the runner on.
    • deleted 2y ago
      [deleted]
• sixothree 2y ago
  I have nothing but performance issues with tailscale. On both my iPhone and my iPad it _destroys_ my battery. It uses some 40+ hours of background time in just a few days. On my PC whenever I come back home and tailscale was running, everything is out of memory and not running correctly. That's my experience. I wish it was better.
  • zimpenfish 2y ago
    > On both my iPhone and my iPad it _destroys_ my battery. On my iPhone, I've not even noticed any battery problems whilst running Tailscale 24/7. Are you running it with an exit node that funnels all traffic? I've just got it active for my nodes which might be why it's basically doing nothing.
    • sixothree 2y ago
      Default install. Very literally 20+ hours a day of background time.
      • zimpenfish 2y ago
        Just checked on my phone - for the last 24 hours, Tailscale has 5m screen, 22h 45m background for less than 1% of battery usage (as in it shows "-" below the 1% entries.) Can't remember what the default install is - do you have "VPN On Demand" turned on? That should keep it mostly idle unless you're actually talking to one of your nodes, I think?
• bb88 2y ago
  I think for simple cases, it's great. If you have remote boxes somewhere that needs administration, it's awesome. If you have more complex cases, the IPTables/Netfilter rules make it vastly more difficult to manage, particularly if you're running docker-compose (or anything using IPTables rules) on the same box and trying to troubleshoot the packets coming out of docker and going into tailscale. And then trying to figure out what tailscale is doing with your packets is not great as well. They've also broken features I relied upon with a minor release. Their nat traversal doesn't always work, as sometimes I get connected to a DERP server, so that limits the network speeds across the internet. I blame CG-NAT quite a bit -- it's really why we can't have nice things these days -- and I get tailscale is trying to fix a bunch of that. But the reality is, I just want an interface just like eth0 or wl0, not an IT infrastructure to move my packets across.
• EVa5I7bHFq9mnYK 2y ago
  I remember Hamachi did the same as Tailscale in the 90s, we used it to play virtual LAN DOOM. Greed killed it.
  • pushcx 2y ago
    I remember XBConnect and GameSpy for playing Xbox Halo 1 over the internet. I think a couple were invented for every big game or console before 2010 or so. Tailscale doesn't really address connecting to strangers, though.
    • MattSayar 2y ago
      Yes, XBConnect! Nevermind that you threw a grenade in Halo a whole 2 seconds after you pressed the button, you were playing with your friends! Good times.
  • dugmartin 2y ago
    The Hamachi UI and UX were great. I was very sad when it got bloated and then killed like a beached whale. I just looked and I guess it lives on as a whalezombie at https://vpn.net/ https://vpn.net/.
  • adamors 2y ago
    Hamachi was amazing, one of the best, most focused apps I've ever used. We were kids but it was still easy to use. Then they were bought by LogMeIn and was killed unceremoniously. Also, it's old but not 90s old: https://swapped.cc/#!/hamachi https://swapped.cc/#!/hamachi released in 2004 actually.
  • TacticalCoder 2y ago
    Not identical but in the 90s to play Windows games that only had a LAN mode over the Internet, we were using Kali in the 90s: https://en.wikipedia.org/wiki/Kali_(software) https://en.wikipedia.org/wiki/Kali_(software) This allowed us to play Warcraft II with random strangers: RTS games over the Internet... Felt like the future!
    • 2y ago
• tsujamin 2y ago
  The tailscale.com/tsnet package in Go [1] is really useful if you've not looked at it before: you can make single binary HTTP or whatever servers that are only exposed inside your tailnet. Their golink project [2] is a good example (and useful itself), but I've used it to build "peer to peer" comms for one application, and to host an API and Svelte SPA to control some other things in a tailnet. [1] https://pkg.go.dev/tailscale.com/tsnet https://pkg.go.dev/tailscale.com/tsnet [2] https://github.com/tailscale/golink https://github.com/tailscale/golink
  • xlii 2y ago
    How difficult it is to use? Right now I’m working on orchestrating dev-local service clusters here I bind plenty of hosts to mimick real world. I’m using proxy tunneling to punch in but I’d love to have Tailscale endpoint which I could use to connect external devices (like mobile clients or non-technical stakeholders for show and tell).
    • tsujamin 2y ago
      It’s pretty simple, I’ve not updated my package version in a while but iirc you give it a state directory, an auth key, and you get a Dial-like interface you can use with the stdlib http libraries
  • aranw 2y ago
    I've been using Tailscale for awhile now and even developed a few internal apps using tsnet as well but I had no idea about golink and it's awesome. Thanks for sharing that!
  • b_fiive 2y ago
    If you're a rust fan we make a similar library, that's all-in on "p2p-QUIC", with pre-baked protocols to import on top: https://github.com/n0-computer/iroh https://github.com/n0-computer/iroh
    • tsujamin 2y ago
      That’s super cool, I was going to say “nat punching and public relays are a requirement for me” but you already do that! Definitely filing this away for future projects.
• behnamoh 2y ago
  related: https://aplaceofmind.notion.site/Tales-of-my-Tailscale-Usage-119c78d259e74e6c879483de36009a2f https://aplaceofmind.notion.site/Tales-of-my-Tailscale-Usage...
• iamdamian 2y ago
  I'm curious to hear well-informed reasons from this crowd for why we can trust Tailscale given the non-self-hosted part of the architecture? Does it come down to Tailnet locks [1], not worrying that Tailscale will be compromised, not worrying that your home network is worth compromising, or something else? [1]: https://tailscale.com/kb/1226/tailnet-lock https://tailscale.com/kb/1226/tailnet-lock
  • sgc 2y ago
    Use headscale: https://headscale.net/stable/ https://headscale.net/stable/
    • haswell 2y ago
      What are the primary downsides of self-hosting this? The top issues that come to mind: 1. Maintaining high availability 2. Dealing with patches/upgrades But I'm also really curious how likely a self-hosted instance is to be an attack vector potentially more dangerous than using something like Tailscale.
      • huslage 2y ago
        You own your attack surface at that point. Tailscale/Headscale is a matchmaker and key broker for the most part, the clients almost always (barring NAT issues) connect directly to one another. The normal security considerations apply as with running any service.
      • eddieroger 2y ago
        > 1. Maintaining high availability In my experience as a poor sysadmin (as in, bad), you don't /need/ HA for Headscale because the clients are pretty resilient. I've had my instance go down for a little bit and it's fine. Stale and new connections aren't, obviously, but it will work well enough that you won't realize Headscale itself has gone down until a while after it did.
        • PLG88 2y ago
• thomastjeffery 2y ago
  In other words (they do get to this point right away), port forwarding is pretty useful, and most of us don't have it anymore. I'm sick and tired of the way ISPs treat us. It's literally written into my lease what company I will pay for internet, and how much I will pay them. It is not, however, written in my lease how fast the connection will be. Not only am I unable to forward ports, I can't even change my own WiFi password! Sure, I could make a fuss and probably obtain access to my router, but it isn't worth the hassle. But why is there a hassle to begin with? How in the hell is it in anyone's interest to keep me from configuring my own router? I can come up with plenty of authoritative bullshit answers to this question, but they are all authoritative bullshit. I think that's the real answer: we have systemically built our society to operate on authoritative bullshit. sigh Tailscale is a usable workaround, but it shouldn't exist. It shouldn't need to exit. I just want to be able to host a server. Is that really so much to ask?
  • sfRattan 2y ago
    The authoritative bullshit isn't what society is running on, it's what society is giving as an excuse for enshittification that enriches interested parties. Your landlord (I'm guessing based on having seen it before) gets kickbacks from the ISP to force all tenants onto a specific (probably overpriced) Internet plan. The interest in keeping you from configuring your own router is in allowing the ISP's enshittifying further monetization tactics to proceed unopposed. The two big ones I've seen in this kind of setup are: Using DNS enforced by the router to gather data and place ads on any 404 error. Sharing their WiFi network that you lease with the ISP's other customers nearby.
    • thomastjeffery 2y ago
      I'm not even confident they get kickbacks. They probably just believe that either negotiating service details or providing infrastructure for competitive options would require more work from them. They are probably right about that: I'm not hassling them over it. I'm really not in a good position to anyway. As much as I would like to attribute malice to this behavior, it's most likely to be no more than laziness. If I moved into a house, I could get 1gbit symmetric from Google Fiber or UTOPIA at half the price. But that doesn't matter because I cannot remotely afford a mortgage. The real problem is Monopoly. Not the market dominance kind: the no one gets to compete kind. We have it in real estate, where every piece of the market is overvalued so far that very few individual people can meaningfully participate. We have it with ISPs who get to literally own the last mile infrastructure, so their customers can't physically connect to a competitor.
• yegle 2y ago
  CGNAT _can_ make it easier to access your server. If your Internet provider and your mobile provider is the same company, they could put all your connected devices in the same IP block within the CGNAT IP range. Now, not only you can access your device at home while away using your cellphone, you can also connect to your partner's phone with the same IP address at (or away from) home. Some Internet providers in China very recently started providing this service, e.g. https://www.chiphell.com/thread-2666772-1-1.html https://www.chiphell.com/thread-2666772-1-1.html (in Chinese). In addition to the convenience of accessing your home server while on the go, they also make the traffic within the CGNAT free.
  • genewitch 2y ago
    Lol I will be seriously surprised if at&t offers this, but I can see the tmo starlink thing potentially doing it. I signed up for the tmo beta even though I am not a tmo subscriber. Now I have a cool thing to test, can I access my behind-starlink stuff from my cellphone?
  • klabb3 2y ago
    Easier than what? You mean it can in these special cases become like not having a CGNAT? > they also make the traffic within the CGNAT free So.. both data caps and breaking the principle of net neutrality?
    • yegle 2y ago
      Easier than asking family members to install a new software, then ask them to share their "node" to you. Imagine you can remote desktop connect to your parents' computer after their phone call. The data cap is on your cell service (the US also has that). Net neutrality is debatable given the traffic is between my own devices so presumably no one gets hurt (think of accessing and streaming from your NAS at home).
      • klabb3 2y ago
        > Easier than asking family members to install a new software, then ask them to share their "node" to you. Right, but not easier than static IP (or dyn dns), both of which require technical knowledge and procedure to set up. I really don’t see the great simplification here. Plus you’d still have firewalls and it’d stop working as soon as you (the client) leave your company’s garden (eg at work). To be fair, static IPs also wouldn’t work when your parents (the server) move their device. > The data cap is on your cell service (the US also has that). Net neutrality is debatable given the traffic is between my own devices so presumably no one gets hurt (think of accessing and streaming from your NAS at home). Fair enough. That I don’t mind. I really dislike configuring multiple devices for an ISP, that’s consumer lock in imo. The provider can simply implement hairpinning on their infrastructure and the traffic won’t leave their network anyway.
• stego-tech 2y ago
  I've harped on some Tailscale implementations before for what I perceived to be nonsensical or bad approaches, but this one is an excellent example of its capabilities. In no particular order: * It's not reliant on port forwarding at your firewall * It can get around bad ISP habits, like CGNAT or a lack of IPv6 (or IPv4) * As the OP points out, it's broadly compatible with various forms of exit nodes Straightforward and to-the-point. Great writeup.
• smy20011 2y ago
  I use tailscale to build my personal podcast that include local weather and stocks I interested in. Running the whole pipeline on a steamdeck and use tailscale to securely delivery the generated podcast to my phone.
  • yjftsjthsd-h 2y ago
    How are you going from weather and stock information to a podcast? Is there some sort of TTS step there?
    • frotaur 2y ago
      See notebookLM, as an example
    • smy20011 2y ago
      Yeah, fully local LLM+TTS setup. Use jupyter notebook to fetch the stock and weather info and feed that into a local LLM and convert that to speech using opensource TTS. https://github.com/smy20011/MorningRadio https://github.com/smy20011/MorningRadio
  • necessary 2y ago
    What is the delivery mechanism?
    • smy20011 2y ago
      Local server. https://github.com/smy20011/MorningRadio https://github.com/smy20011/MorningRadio
• forty 2y ago
  Does it have "entry nodes" ? For exemple if I wanted to receive emails on my server while my home connection does not have an open port 25.
  • anderiv 2y ago
    Tailscale Funnel could likely do this.
    • forty 2y ago
      Funnel looks cool but apparently it doesn't help for non https traffic https://www.reddit.com/r/Tailscale/comments/1cyv6vf/wow_5_stars_for_tailscale_but_i_have_a_question/ https://www.reddit.com/r/Tailscale/comments/1cyv6vf/wow_5_st...
  • Duralias 2y ago
    They don't host anything like that, DERP servers are, aside from Funnel, internal to the tailscale network. But you can proxy traffic using a VPS really easily, which is basically the reverse of exit nodes.
• yamrzou 2y ago
  Is there an alternative to Tailscale with a lower memory footprint? I wanted to run Tailscale on a small router, but it failed due to out-of-memory (OOM) issues.
  • caconym_ 2y ago
    Wireguard?
    • yamrzou 2y ago
      Wireguard doesn't do NAT traversal on its own, which is, IMHO, the killer feature of Tailscale.
      • caconym_ 2y ago
        Taking on all the monolithic complexity of Tailscale just to get NAT traversal can be arguably not worth it, e.g. https://news.ycombinator.com/item?id=42132131 https://news.ycombinator.com/item?id=42132131 Fair enough if you're stuck behind a CGNAT though.
      • selfhoster 2y ago
        I wasn't sure and still am not what your statement means, I checked Google, their AI tool offered this: "Yes, WireGuard does support NAT traversal, though it doesn't handle it natively; it relies on techniques like UDP hole punching to establish connections between peers behind NATs." That makes no sense to me, I have my peers talking to each other on the Wireguard VPN behind my ISP NAT. I do have one UDP port open on the VPS that they all talk to. Is that what you mean by, "Wireguard doesn't do NAT traversal on its own, which is, IMHO, the killer feature of Tailscale."? If so, how does not having to open one UDP port which can't really be detected anyway, justify having all your traffic controlled by a third party through servers (I forget what Tailscale called them) you don't own?
  • NexRebular 2y ago
    Maybe Nebula? You can do one yaml config file with all the certificates and firewall rules making it easy to script device provisioning too.
• erulabs 2y ago
  Tailscale also allows you to issue valid TLS certificates (`tailscale cert`), which is crazy useful for certain local development tasks, EG developing SSO for a mobile application where the SSO provider mandates TLS and the mobile devices dont easily allow you to bypass self-signed certificates. They keep piling on awesome features, big fan. The Tailscale k8s operator is also great.
  • 9dev 2y ago
    I use these certificates for almost any management UI of internal services that would go unencrypted for convenience otherwise, even for Postgres servers. It’s really versatile.
• high_byte 2y ago
  tailscale to expose a port is such overkill. just use ngrok for that.
  • PLG88 2y ago
    or one of the many alternatives - https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling. I will advocate for zrok.io as I work on its parent project, OpenZiti. zrok is open source and has a free (more generous and capable) SaaS than ngrok.
  • ghoshbishakh 2y ago
    For simple problems use simple tools. I believe the simplest tunneling tool out there is https://pinggy.io https://pinggy.io . Tailscale is for a different use case. Not just exposing one port to the interenet.
• textlapse 2y ago
  Also, their building up on top of a 'platform' is wonderful: funnel, exit nodes, sharing, ssh, drive etc. I wonder if they can figure out a way to distribute compute eventually via their network (not just clunky ssh): 'my' storage is already shared with 'my' nodes, why not 'my' compute? :) Seems like a great company/business.
  • bradfitz 2y ago
    That was actually something we debated launching before Tailscale SSH but ended up doing Tailscale SSH first because the state problem for compute was annoying and we'd seen the App Engine etc progression through the problem space and knew it could be a time suck. I still want to do it and we continue to brainstorm on the problem of state management and how to do it in an HA way, so you can run services where the compute bounces around some node in a set that's up and reachable on the tailnet but the state is durable and in sync between the nodes. It's a fun problem.
    • textlapse 2y ago
      Looks like the layers are there for a Tailscale API: I could imagine writing a platform-independent Go 'app' that uses funnel+drive that could 'float' around the nodes. Anyway, a fun problem (or worse, a solution looking for a problem as I couldn't immediately think of a problem that would require it just yet. May be distributed training and such) Cool to see a bradfitz reply though!
• deleted 2y ago
  [deleted]
• ezekg 2y ago
  > I have used Tailscale only for personal reasons so far, using the free tier; they have enterprise plans for enterprise use cases that I have no idea about. Does anybody know of any good materials on the enterprise use cases and configs? e.g. blogs, screencasts, etc.
  • CharlesW 2y ago
    This seems like a good place to start: https://tailscale.com/blog/patterns-from-the-field-use-cases https://tailscale.com/blog/patterns-from-the-field-use-cases
    • ezekg 2y ago
      I guess more specifically, I've been looking for material on k8s machine-to-machine networking using Tailscale.
      • lakomen 2y ago
        Talos has something about Wireguard, but I never used it in the k8s context
• finnjohnsen2 2y ago
  Tailscale is Canadian from what I can see, and not american. Which is a plus these days.
  • andix 2y ago
    Absolutely. We aren't allowed to introduce new services from US companies anymore. It's just too risky right now, who knows what's going to happen next in this trade war. What's happening to Canada and Mexico can happen to any country.
  • blueflow 2y ago
    Look closely, new customers make a contract with an US company.
• porridgeraisin 2y ago
  I use it extensively as well. - My home PC, my laptop, and my phone are the participants. - My home PC is connected to a GPU, and runs a colab runtime, SSHD, as well as a simple http file server in $HOME (actually, C:/Users/username, its windows) - My laptop doesn't have an NVIDIA GPU, so it just runs SSHD and a file server. - My phone serves nothing, but has an SSH client, and a http client obviously. There is simple hostname based DNS setup by tailscale automatically, so I can just go to http://laptop:8000 http://laptop:8000 to access all my files, or just ssh to username@computer Accessing everything from everywhere is absolutely great. And this is all on their free tier. Unrelated to tailscale, I use parsec for a similar solution for remote desktop, their "machine level user" feature allows me to initiate remote desktop from certain client devices directly. Too smooth.
• etra0 2y ago
  I work +1000km away from home, and I work by shifts, tailscale has helped me a lot on running stuff back at home. I was even able to stream my games through the tunnel with a (decent enough) latency of 27ms with variance of 2ms. Admittedly, I could buy a gaming laptop, but I don't want to carry a heavy laptop 4 times a month :P
• ramses0 2y ago
  See also Nebula: https://nebula.defined.net/docs/ https://nebula.defined.net/docs/ https://nebula.defined.net/docs/guides/quick-start/ https://nebula.defined.net/docs/guides/quick-start/ ...I believe 100% open source. You can basically hub between different devices (including iOS/Android) that are identified via certs. Recommended to have one or more public "lighthouses" so anything that can reach a lighthouse can reach any of your other servers (maybe kindof "syncthing for vpn/overlay-network?"). I've dorked around with it a little bit, but it's rare enough that I need access to my home network while out that I haven't doubled down on proper cert, key management, rotation, etc.
  • yjftsjthsd-h 2y ago
    The Nebula Android app is not open source:( That's why I dropped it, personally. https://github.com/DefinedNet/mobile_nebula/issues/19#issuecomment-1554451576 https://github.com/DefinedNet/mobile_nebula/issues/19#issuec... https://github.com/DefinedNet/mobile_nebula/issues/142 https://github.com/DefinedNet/mobile_nebula/issues/142
    • ramses0 2y ago
      Source Available vs Open Source on a monetizable/enterprise component? There are worse tradeoffs one could make, but thanks for pointing it out!
      • yjftsjthsd-h 2y ago
        Huh. Y'know, until you suggested it, it hadn't occurred to me that the mobile app could be monetizable. That could at least explain why they did that; I thought it was odd.
• CharlesW 2y ago
  Networking SmartFriends: Is port forwarding intrinsically a bad idea (as compared to using Tailscale Funnel) from a security perspective if I want to expose, say, a Plex server running on my NAS to the outside world?
  • sieabahlpark 2y ago
    [dead]
  • arsome 2y ago
    It's largely equivalent here - you're just exposing something via a tunnel rather than directly via your home IP. That could have benefits, for example, if you're concerned about a DDoS attack on that service taking your home internet out, you may be able to work around it like this. But it won't mitigate a gaping hole in the underlying service which you're still exposing. It could also have drawbacks, like limited bandwidth and higher latency, which would make it highly unsuitable for something like a game server.
  • zamadatix 2y ago
    The Funnel won't add secure activity to what happens inside the connection itself.
  • amlib 2y ago
    The main question is weather you want to share something like a Plex server with other people and force/convince them to essentially install a VPN to do so (which usually mean other VPNs are out of the game. You can't, for example, have Tailscale work alongside an adblock VPN in Android). To me thats a deal breaker and quite a burden to the people who want to access it. You are better off putting all those services behind a reverse proxy with a cert from let's encrypt.
    • CharlesW 2y ago
      All good points, thank you! I was considering Tailscale Funnel (which is like Cloudflare Tunnel) and doesn’t require Tailscale on the client side. https://tailscale.com/blog/introducing-tailscale-funnel https://tailscale.com/blog/introducing-tailscale-funnel
• 9dev 2y ago
  We’re using Tailscale for our internal network, and it’s amazing. We’re a team distributed across multiple countries, and with Tailscale, it’s like we’re sitting in a single office, connected to the same router. And on top of that, we get centrally managed ACLs for everyone, TLS certificates, and SSO with Microsoft accounts. Amazing stuff! My main gripe, though, is DNS. It’s great to be able to reach prod-db-1, prod-db-2, and prod-db-3, tag them as „db“ and create a rule to allow TCP on db:5432. however, it’s annoying that all of this is supported, but not the obvious extension - DNS records for the tags, so I can point apps to a group of servers belonging to the same tag.
  • cess11 2y ago
    Similar to how you would use keepalived to get a virtual IP and broker between addresses under it?
    • 9dev 2y ago
      Yes, but with all the benefits of Tailscale nodes—automatic DNS resolution, ACLs, and TLS certificates out of the box, and so on. The building blocks are all there, it’s just that nobody has built the feature yet.
  • bcye 2y ago
    I noticed that limitation quickly too. My solution was to just point A records on my domain to the tailscale internal ip and use the let's encrypt wildcard certificate my registrar (porkbun) provides out of the box.
  • rudasn 2y ago
    I don't get it. `db` should resolve to all host ips? Wouldnt a load balancer make more sense in that scenario?
    • 9dev 2y ago
      Consider `db` resolves to multiple A records: db. IN A 100.64.123.1 # prod-db-1. db. IN A 100.64.123.2 # prod-db-2. db. IN A 100.64.123.3 # prod-db-3. This is good for service discovery—e.g., you can configure something like RabbitMQ to discover cluster members from an A record—and it's nice for browsers, which will pick one host at random when connecting, which effectively is load balancing. In a usual setup, the problem is that if a host goes down, clients will still try to reach it because it's still in the DNS record; but with Tailscale, the "DNS" is generated by the local Tailscale daemon on the fly, so you get a live view, and if this was implemented, it would be possible to only return available servers for tag queries.
• MasterYoda 2y ago
  Is there any simple FOSS alternative to tailscale that you can self-host? The only thing I need is to simply connect to the home network and I dont want to need to open and forward ports etc in routers and firewalls for it to work, just something simple plug and play and is secure.
  • mfro 2y ago
    It's functionally just a VPN. Selfhosting wireguard or openvpn is not particularly difficult.
    • knowaveragejoe 2y ago
      It uses Wireguard, sure, but it's using a coordination service to give you a effectively a flat network mesh instead of hub and spoke.
    • wkat4242 2y ago
      No it's not the same as normal wireguard with some 'just works' config sauce. Devices can connect directly and also find the best way to do it. For example two devices in the same office will create a direct path between them without having to go through the off-site vpn server. At this mesh vpn is really good.
      • mfro 2y ago
        I know it's not just wireguard. That's why I said it's 'functionally' just a VPN. For the average user, it provides VPN-like functionality
  • duskwuff 2y ago
    Yes - https://headscale.net/ https://headscale.net/ Fully compatible with Tailscale client binaries; it just replaces the control server.
  • knowaveragejoe 2y ago
    > The only thing I need is to simply connect to the home network and I dont want to need to open and forward ports etc in routers and firewalls for it to work, just something simple plug and play and is secure That's tailscale, basically. Install on devices and they can magically talk to each other across the internet with no other configuration. If you really want to, you can run headscale and manage the coordination plane yourself as well. https://github.com/juanfont/headscale https://github.com/juanfont/headscale
• elevation 2y ago
  Tailscale is becoming less useful as network providers become hostile to it. Last week I noticed McDonalds guest wifi is blocking new connections over the tailscale control ports. It will pass wireguard mesh traffic for established sessions, but their firewall rules prevent you from establishing new ones.
  • crims0n 2y ago
    It was for that reason OpenVPN set up in SSL mode over TCP 443 was king, a few years ago most firewalls could not distinguish it from regular TLS encrypted web traffic. These days with application layer "next gen" firewalls though, a zealous network administrator can distinguish between the two and block just the VPN connection if they so choose.
    • kdmtctl 2y ago
      Chinese V2Ray derivatives are indistinguishable from regular traffic and still penetrate the GFW but get detected when used for domestic services, which is not advised. Work best for short lived sessions in restrictive environments.
  • parasubvert 2y ago
    Are they blocking the global tailscale IP addresses / host names for their DERP relays? Tailscale will tunnel over HTTPS if it can’t establish a UDP relay.
  • devilbunny 2y ago
    So connect over cellular or personal hotspot, then connect to WiFi to avoid burning your data. This is definitely becoming more common. I discovered the workaround purely by accident, when I took my laptop to work (which is unusual, it's a personal device not used for work but I needed to do some work on files that were on it). It was logged into my Tailscale when I last turned it on at the house and I discovered that it reconnected fine as long as it didn't have to do the authentication over the work network.
  • drdaeman 2y ago
• smackeyacky 2y ago
  My favourite use of tailscale: I have a bluetooth gateway (Cassia X1000) in my workshop where I normally develop. I was at home doing some Android work at one point rather than at the workshop and needed to test some new Cassia functionality. Tailscale exit node in the workshop. Tailscale client on my linux dev laptop at home. Started up the android emulator via Android Studio, connected to the Cassia via the app being debugged, debugged what I needed to, shipped it. At the time it seemed like actual magic had happened.
• andix 2y ago
  And it's Canadian. Cool. We have a policy now that doesn't allow us to bring in new services from US companies.
  • andix 2y ago
    Downvotes on this comment, nice. It's about reducing exposure in a possible trade war.
  • steve_adams_86 2y ago
    Kind of: Schedule A Tailscale Entity Existing customer accounts as of September 2, 2024 Tailscale Inc., a Canadian business corporation New customer accounts on or after September 3, 2024 Tailscale US Inc., a Delaware corporation My account is associated with Tailscale US Inc., unfortunately. https://tailscale.com/terms https://tailscale.com/terms
• apitman 2y ago
  Tailscale is one of my favorite companies. They're clearly on to something. Here's a great post by their CTO explaining a lot of the motivation and vision behind it: https://crawshaw.io/blog/remembering-the-lan https://crawshaw.io/blog/remembering-the-lan IMO the main outstanding questions/concerns are: * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are likely running with reduced security since that's a huge part of the appeal. This is exactly the situation BeyondCorps/Zero Trust was created to avoid. Tunneling services[0] are more of a Zero Trust approach, but they can't match the seamlessness of Tailscale once a node is connected to the tailnet. * Can it expand into the layman market? I wonder if the average person will ever be willing to install a VPN app on all their devices. On the flipside, I could see TS partnering with someone like Google to integrate TS tightly with Android and set up a private network between all your Google-signed-in devices. * The relay system - DERP is nice, but it's primarily intended for signaling/fallback. It feels like CGNAT adoption is growing faster than IPv6 is, and I wouldn't be surprised if fewer and fewer p2p connections succeed over time[1]. DERP forces everything over a single TCP connection (HOL blocking), and I'm not sure it even has any flow control. * Use in web browsers - They got a demo of this working, but it's pretty involved. You have to compile the entire Tailscale Golang library to WebAssembly which is a large artifact, and it's DERP-exclusive. * Portability in general - Depending on WireGuard, as awesome as it is, is fairly limiting. You either need admin privileges to create the TUN device, or you need to run an entire TCP stack in userspace alongside your own WireGuard implementation. I'd be interested to see something like Tailscale implemented on top of WebTransport. [0]: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling [1]: https://tailscale.com/blog/how-nat-traversal-works https://tailscale.com/blog/how-nat-traversal-works
  • jdolak 2y ago
    On your first point, I've been using tailscale for a bit and its ACL feature addresses most of my concerns there. My laptop can ssh into any of my servers but not the other way around, and my servers cant talk to each other unless I set them to.
    • 2y ago
• pierluc-works 2y ago
  Does anyone have some insight why installing security/tailscale on freebsd is installing security/ca_root_nss which contains a very scary message? https://github.com/freebsd/freebsd-ports/blob/ec981e26cd312887c3888afa567130c044790252/security/ca_root_nss/files/pkg-message.in https://github.com/freebsd/freebsd-ports/blob/ec981e26cd3128...
  • treve 2y ago
    The error message is somewhat self explanatory. Tailscale installs new root certs. Freebsd does not endorse them. You're giving complete trust to tailscale. In case that wasn't helpful, maybe you have a more specific question
• buybackoff 2y ago
  I used to expose my workstation RDP directly but with a non-standard port. Then I became a "homelabber", and paranoid, and added a mix of nginx with basic auth in front of Guacamole. The UX in browser is so abysmal that I used it to configure direct RDP when I really needed to work remotely when traveling. Then I learned Tailscale and it is really liberating. Just direct RDP with negligible (for me) risks. I run OneDrive, JetBrains Toolbox, Podman just visible in the tray and what else as services, such as OpenVPN, etc. I keep Tailscale running only when I travel. I think paranoia should stop at some point, yet I still read the top comment about security/trust very attentively.
• ctm92 2y ago
  Tailscale is super awesome, I was amazed when I first set it up that it just worked out of the box. It can be set up by everyone without having to expose ports on the router (something that is often not even possible anymore due to CGNAT), so you get a lot of convenience without giving up security
• boldlybold 2y ago
  Tailscale is great. I put my whole company on it shortly after joining (we had some servers with RDP exposed to the internet...). It has had ~0 problems in the last year, and non-technical people are able to use it with ease.
• etc-hosts 2y ago
  I selfhost tailscale with headscale, I used a helm chart in a k8s cluster, works great. I ran into a corporate network recently that blocked the Tailscale DERP servers.
• globular-toast 2y ago
  Is Tailscale useful if you don't have CGNAT? I solve the problem in the article using Wireguard on my router and a dyndns client. In a way I think all these solutions just keep enabling IPv4 to continue and that sucks. Does Tailscale offer anything in an IPv6 world? Are they another company with an interest in stopping IPv6 progress?
  • greenicon 2y ago
    Wireguard does not re-resolve dns when your dyndns ip changes. This ip change is common in parts of Europe where it usually changes daily. To circumvent this you need a jumphost or similar. This again brings additional issues when you don’t want to go through the jumphost when at home (I use nftables-magic on the router, but it’s not very nice).
• unixpickle 2y ago
  This should just be called "why VPNs are useful", i think?
• jd3 2y ago
  I tried using tailscale to share my hdhomerun prime tuners over the internet, but sadly, it doesn't seem to work due to Tailscale's lack of support for mDNS lookups[0][1]. You can't just forward the port b/c the hdhr device packets have a ttl of 1 hop (and, while you could change the ttl through iptables, that seems like a lot of trouble). I can open a stream manually through http://192.168.1.189:5004/auto/v600 http://192.168.1.189:5004/auto/v600 while connected to tailscale (w/ my apple tv in-home as an exit node) on my laptop outside of the house, but when I open the HDHR/Channels apps, they can't detect the HDHR tuner itself. Apparently this "just works" with openvpn, so I've been thinking about just switching back to that. [0]: https://github.com/tailscale/tailscale/issues/1013 https://github.com/tailscale/tailscale/issues/1013 [1]: https://old.reddit.com/r/HDHR/comments/z8byns/watching_remotely_with_hdhomerun_and_tailscale/ https://old.reddit.com/r/HDHR/comments/z8byns/watching_remot...
• datadeft 2y ago
  It is one of the tools I use as well and I pay for it. It makes life so much easier. At work we have to test a lot of country dependent settings and with TS and Mullvad is is very simple. I can also access my home network easily.
  • samstave 2y ago
    > I can also access my home network easily. expand plz
    • datadeft 2y ago
      So I have this small form box (it is hardly bigger then few mobile phones stacked on each other) and I run Tailscale on it as well (also as an exit node). I installed Tailscale on my MBP and mobile phones as well. Now it is forming a network where regardless of where I am in the world I can chose my home server as an exit node and also access the samba shares and the other devices (rpi3 and rpi4).
      • samstave 2y ago
        Imagine a network of tailscale droplets that allow for agents to exit via a tailscale node in their locale and do work - then funnel data back to master wherever... (Like If I wanted to crawl an area in germany, but needed an exit tracert that originated there - a tailscale droplet that could be connected to, perform [object] and openly pipe data back to master?
• kortilla 2y ago
  > But my old Raspberry Pi was too weak to run it, so I ended up uninstalling it, and unrelatedly my pet project grew out and has its place in the cloud now. It’s incredible how shitty modern software is that a raspberry pi couldn’t run a basic VPN. If any tailscale devs see this you should try to reproduce this issue and use it as an opportunity to clean up a bunch of dumb assumptions that likely hurt real users as well, just through less direct means like battery consumption and slower overall performance.
  • frontsideair 2y ago
    I saw from the comments that they provide smaller binaries, which may have worked on my Raspberry Pi. Maybe I’ll give it a try one day. https://tailscale.com/kb/1207/small-tailscale https://tailscale.com/kb/1207/small-tailscale
  • 1oooqooq 2y ago
    i always evaluate TS, the see the enterprisey crap it is and just keep ssh without being brain dead about unix auth and user management. honestly, not sure what's all the hype. ssh under wg with sane user management and key distribution cover 110% of the TS use cases. and thebonly difficult part is the key distribution but that should be difficult by design otherwise you're doingnit wrong anyway. you can even resuse the ssh keys for the wg tunnel if you're smart about it.
• sotix 2y ago
  I don’t understand why one would use Tailscale over WireGuard. Is it because it’s easier to setup sort of like how Dropbox was? I’m primarily wary of the rug being pulled out and Tailscale suddenly costing me a lot of money whereas my WireGuard setup seems more stable in the long term. Or is there more to it that I’m missing?
  • 2OEH8eoCRo0 2y ago
    Tailscale uses wireguard
  • christina97 2y ago
    Yes: much easier to set up. It also provides a backup relay node system in case it can’t establish direct connection between your devices. When you set up wireguard you have to update every system’s config to add a new device, Tailscale does this for you. That’s the key thing.
    • sotix 2y ago
      Got it. That is very nice.
  • rainsford 2y ago
    Wireguard is not an alternative to Tailscale, any more than FTP is an alternative to Dropbox. And not just because Tailscale actually uses Wireguard under the hood. Also if your comment is a sarcastic callback to the "why don't you just use FTP" comments when Dropbox came out, well done. Wireguard is a great VPN protocol, but what the basic protocol doesn't do is make it transparently easy to use in a wide variety of edge cases without having to reconfigure anything. If all I want is two devices to be able to talk to each other, at least one of which is in a fixed location where I have total control over the network, then yeah, raw Wireguard is probably a decent solution. If I want to do anything else, I need a management layer on top of Wireguard, and Tailscale is by far the best solution for that out there. As a thought exercise, consider a home network where a laptop connects to a NAS to store media files. I take the laptop to some random destination and connect it to hotel WiFi, while someone else takes the NAS to a totally different hotel and connects it to the WiFi. With Tailscale, the laptop can immediately directly access the NAS without even having to change the mount point. Think about what it would take to set up similar functionality with raw Wireguard. I'm not saying this is a common scenario, or that you can't do the same thing manually. But the fact that such a setup would just work is pretty impressive.
• xyst 2y ago
  I like tailscale as a replacement for the dogshit enterprise VPNs I have had to use in the past (looking at you, ZScaler). But for personal/single home use it’s overkill. I used to run a WireGuard server on a raspberry pi with ddns to update dns record on an as needed basis. Eventually replaced it with my gateways built in WireGuard server which also has ddns enabled The use cases described by the author are taken care of with a simple wg server. Sure you don’t get the distributed peer network of tailscale but I can live without that.
  • esjeon 2y ago
    Yup, port forwarding is always a big win over any VPN, for real. No random stutter, no random disconnection, no random DERP fallback. It's just that ISPs are killing home port forwarding with CGNAT.
• scottfits 2y ago
  super useful, at airgarage we have a network of license plate readers deployed around the country and tailscale is a game changer for remote access and debugging. https://www.airgarage.com/capabilities/license-plate-recognition https://www.airgarage.com/capabilities/license-plate-recogni...
• raaron773 2y ago
  Tailscale is great but one thing i dont like about it is that i cannot re-use ip addresses. This feature is offered by ZeroTier it can be very useful if for some reason you have to format and re-install os and everything.. Unfortunately, i cannot use zerotier because the speed i get over it is terrible
• ronef 2y ago
  To add on to this, more than just useful, incredible team building it!
• KronisLV 2y ago
  I previously used WireGuard and for a bit tried just having an SSH tunnel with autossh, but in the end just settled on using Tailscale, because it doesn’t ask me to manually manage the keys and also doesn’t drop around every 30 minutes for a bit and doesn’t need weird hacks to expose ports for my Docked network traffic. That said, what messed with me greatly was the fact that Tailscale seems to have an MTU of 1280 whereas Docker by default had 1500 which lead to inexplicably dropped overlay traffic with nonsensical log messages in my reverse proxy web server. Basically, I had to delete docker_gwbridge and recreate it with some specific options: https://docs.docker.com/engine/swarm/networking/#customize-the-docker_gwbridge https://docs.docker.com/engine/swarm/networking/#customize-t... It was quite the mess. I have no idea why Docker couldn’t just figure out that it needs the smaller MTU by itself, cause it listens for the Swarm on an interface that’s related to Tailscale and it can see what MTU that has. Still, Tailscale in of itself is pretty nice.
  • vetrom 2y ago
    tldr - wireguard doesn't do per-peer MTU: https://www.wireguard.com/todo/#per-peer-pmtu https://www.wireguard.com/todo/#per-peer-pmtu Its due to some strangeness in general with tcpip layers that don't forward PMTU discovery ICMP messages. You'll see the same thing in some cell networks, and wireguard is particularly fragile here, because wireguard itself doesn't have a PMTU discovery mechanism. Or, to be more exact, wireguard currently doesn't have a method to 'bubble up' a PMTU process to the inner wireguard interface from mtu-impacting events in its outer layer. There's hacks like https://github.com/luizluca/wireguard-ipv6-pmtu/blob/main/wireguard-finetune-wg-mtu https://github.com/luizluca/wireguard-ipv6-pmtu/blob/main/wi... that try to handle this by monitoring outer route discovered MTUs and then applying them to wireguard routes. In applications where I've had to deal with this (wireguard over cellmodem networks), I tool my network setup to poll whatever the cell network mtu happens to be and then set the wireguard MTU appropriately. This gets really painful though if you think you wanna do something like run a network that really wants a >1280 MTU over tailscale. It's pretty much not doable, and it is, in fact, my biggest gripe with tailscale. Yes, its suboptimal for the 'whole-internet' usecase, but I really do want my wireguard links to be 9000 MTU. Maybe wireguard will get that in the future, since it is an acknowledged problem. I bet someone in the conjunction of secure networking and HPC spaces could even justify paying the wireguard team to implement it.
• sheepscreek 2y ago
  Been using it since the early days and it has become a core tool in my arsenal. Tailscale along with 5G and RDP or Parsec means I have access to my powerful home server and primary dev machine no matter where I am. Can even access it on my iPhone (only RDP).
  • 0xFF0123 2y ago
    Parsec have a mobile app as well
• deleted 2y ago
  [deleted]
• dlo777777 2y ago
  [dead]
• jerryoftheyear 2y ago
  I absolutely love Tailscale, it's been a game changer for accessing my home gear from anywhere.
• juped 2y ago
  I kind of have a mental block around Tailscale even though it would be useful in some cases for me, because the name "Tailscale" instantly trips all my snake oil trauma responses. Can't they call it "Weyergourd" or something?
• vermilingua 2y ago
  Hugged: https://web.archive.org/web/20250305011820/https://blog.6nok.org/tailscale-is-pretty-useful/ https://web.archive.org/web/20250305011820/https://blog.6nok...
  • miyuru 2y ago
    Thanks, I am also getting this unusual error on blog.6nok.org. "This Deployment is paused by the owner. Your connection is working correctly. Vercel is working correctly."
    • tills13 2y ago
      Maybe a cost based trigger on the vercel project?
      • o1o1o1 2y ago
        I'd be very interested, is there someone who could elaborate please? I'm terrified using a service like Vercel because I heard about the massive cost trap that can hit you hard and I don't know if there is any alternative for (easily & quickly) hosting NextJS apps.
        • frontsideair 2y ago
          That’s exactly why I put the spend limit, and this was the first time to confirm that it actually works.
          • o1o1o1 2y ago
            Good to know that this is possible, thank you!
        • ashfn 2y ago
          Its relatively straightforward to host a nextjs app in a docker container and route it with nginx and cloudflare, but you probably wont get as good uptime
• valcron1000 2y ago
  I have to point out that their online videos are amazing to leaen how to quickly set up certain features like SSH. In less than 5 minutes I had VSCode on a Macbook Air connected to my desktop machine running Linux on a completely different network.
• freetime2 2y ago
  I'm thinking about exposing some services outside of my LAN, and wondering whether it would be better to go with Tailscale or Cloudflare Tunnel. [1]. At a high-level both solutions seems pretty similar, with a client service running on the machine you want to share. My sense is that tailscale makes sense for a more locked-down service that is not accessible to the general public (although they do have a way to open up access to the world [4], it felt like more of a temporary thing than a permanent solution when I was looking into it). And Cloudflare is more for exposing a service to the world, with support for a custom domain name, DDoS protection and other IP blocking feaures, etc. Cloudflare does have a "Zero Trust Network Access" product that I think might offer similar functionality to Tailscale, but honestly pretty hard to tell what it does from their website or how hard it would be to set up. They both have free tiers that are pretty generous for "homelab" use cases. [2][3] Does that sound pretty much correct? Are Tailscale and Cloudflare competitors with a lot of overlapping functionality? Or are they mostly distinct products serving different use cases/markets? [1] https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/ https://developers.cloudflare.com/cloudflare-one/connections... [2] https://tailscale.com/pricing https://tailscale.com/pricing [3] https://www.cloudflare.com/plans/ https://www.cloudflare.com/plans/ [4] https://tailscale.com/kb/1223/funnel https://tailscale.com/kb/1223/funnel
  • aborsy 2y ago
    Cloudflare Access is a reverse proxy: you encrypt to Cloudflare, Cloudflare decrypts and scans the traffic, Cloudflare re encrypts to the origin server. So, traffic is not end to end encrypted (Cloudflare man in the middles the traffic). That’s the reason we didn’t use it. Otherwise it’s a good service.
  • briHass 2y ago
    Good luck with CF's Tunnel. It may have been the complexity of my network at work, but I wasted a day trying to get that to work. Endless web setup 'wizards' and clicking around different components and their settings in the CF portal. It felt like trying to build out a moderately complicated cloud infra environment. Tailscale is dead simple, even to create 'routers' that act more like a VPN appliance inside your network. It really does feel like something Apple would've come out with in their hayday: missing advanced features for power users, but is somehow able to deliver what feels like magic with minimal setup.
• aborsy 2y ago
  Tailscale is not just a wrapper around Wireguard, as some people imply in the comments. The codebase is far bigger, and it does far more. They are different products. What Tailscale does is difficult to do with Wireguard: Easy VPN, SSO with MFA, key distribution, static private IP for each node, peer to peer direct connectivity, split tunneling, fine grained access control rules down to per port and application, Wireguard over TCP, NAT transversal for devices behind firewall, central management, sharing nodes with others, DNS, file sending, routing rules (with exit nodes, subnet routers, “via”), key rotation, … Wireguard connects peer A to peer B, and its simplicity stops there. I found Tailscale to be a very good tool, that I extensively use. My only concern is: what happens if their infrastructure is compromised at some point, like Okta’s? Assuming I have tail lock enabled.
  • RGBCube 2y ago
    You can completely selfhost a control server, using Headscale: <https://headscale.net https://headscale.net> It's completely OSS, just like the Android & Linux clients.
• gerdesj 2y ago
  VPNs are complicated and its rarely a case of one is better than another. Tools for the job, should be our watchword ... phrase 8) IPSEC is somewhat old school but very solid - if you can do opportunistic IPSEC via DNS etc it can be rather nifty. You can also use FRRRRRRRRRRRR to do it routed. IPSEC with BINAT can be used to avoid issues involving duplicate network addressing. I default to IPSEC for site to site links. OpenVPN is more TCP/IP related compared to IPSEC - that's very simplified. You can easily set an IP address for a client and other niceties. OpenVPN is superb for massive client deployment. If you have a central CA and can deploy certs on all devices eg via MS AD CA then you can use a single config file for all clients, which is a doddle to deploy via GPO. Tailscale is the new kid on the block. As with all new kids you need to examine what works for you and you could be one person or an entire multi national. The real world is rather messy. For example your home/office/corp network will almost certainly have a MTU of 1500 bytes. When you hit the internets it gets really messy. Some British Telecom links (for example) will support mini jumbo frames and some won't and the real world continues to get more and more complicated.
• pkulak 2y ago
  I set up a Wireguard tunnel into my home network years ago, before Tailscale was really a thing, and I always wonder if I should switch, but I can never make the effort worth it in my head. If I was starting all over, I'd go Tailscale for sure, but a single tunnel really gets me 99% of the way there.
• cmstoken 2y ago
  Site looks down. Archive link: https://archive.is/OtRtF https://archive.is/OtRtF
• lamking 2y ago
  [flagged]
• Nemo_bis 2y ago
  > I know its local IP address and can ssh into it easily when I’m home, but when I’m outside, that’s not possible as it’s not exposed to the internet. I never understood this problem. I just create a Tor hidden service when I want to ssh into a machine behind a firewall.
• melson 2y ago
  We can also try to selfhost this https://github.com/openp2p-cn/openp2p https://github.com/openp2p-cn/openp2p
• LinAGKar 2y ago
  Tailscale is also crazy unreliable in my experience, at least on Android. It had to be force quit and restarted every day, and even outside of that apps would randomly get connection errors. And they don't seem to care about bug reports. I ended up switching to regular Wireguard, which has since been perfectly reliable.
• ziofill 2y ago
  I love tailscale! I am now on vacation and all my devices can still use pihole running on a raspberry pi at home on the other side of the world. And it was trivial to set up!
• jpgvm 2y ago
  We recently did a pretty big rollout of Tailscale and tbh I am presently surprised with how well it works. Between subnet routing to our bare metal stuff and the Kubernetes operator, especially the ability to expose services to the Tailnet has been a big win. I was a doubter a bit as to how it would work at a bigger org but so far rock solid, easy to setup and great user experience.
• DictumMortuum 2y ago
  Also check out zerotier. I've been using it because it has a lot more features that tailscale (although it's been 4-5 years that I have the zerotier network set up). Pretty damn useful to connect to services in my internal network wherever I go. I have it set up on my router, so I don't need to install it on every single server in the house :D
  • linsomniac 2y ago
    ZeroTier is definitely very good. I came very close to using it instead of Tailscale at work. One of the big reasons I didn't was I had asked sales a question about redundancy and they said "we've never gone down", so I quoted a tweet from them saying "Our control plane is coming back after the outage" and asked about it, and never got a reply. I'm looking at setting up a VPN for my services at home and am considering ZeroTier or Nebula. Tailscale is out because I already have a tailnet and you can only have one (you have to switch networks if you have multiple). I kind of regret not having used Nebula instead of Tailscale, because it gets rid of the control plane and it has less "magic" to it. Though Nebula seems to be moving much slower as far as improvements. I also checked out defined.net for nebula hosting, but at that time they were just starting to work on their API and I absolutely needed that because we have hosts that respin and join our net every night.
• sunshine-o 2y ago
  The main advantage of Tailscale for most is it allows to avoid having a fixed IP address/DNS, and keep all ports closed. As long as you trust them this really give you a lot of security at a very low cost.
• _jsdp 2y ago
  - Install & authenticate on all your machines - Boom, everything works - Internet? feels like local-net This is just brilliant tech. Thank you so much for building this guys and the amazing effort that goes behind it everyday
• stpedgwdgfhgdd 2y ago
  https://github.com/cloudflare/cloudflared https://github.com/cloudflare/cloudflared
• p4bl0 2y ago
  When reading about this kind o use cases, I'm always really glad my ISP gets me static and dedicated IPv4 and IPv6 addresses along with a good fiber connection to the internet for less than 30€/mo.
• deleted 2y ago
  [deleted]
• deleted 2y ago
  [deleted]
• jFriedensreich 2y ago
  I really love tailscales offering but the performance was just significantly worse compared to cloudflare.one to the level of switching back and biting the bitter pill of fully depending on orange cloud for everything as well as having sub par usability compared to tailscale or even the rest of cloudflare.
• drio 2y ago
  For those using WireGuard directly: What techniques do you use to establish connections when behind network infrastructure that blocks all UDP traffic?
  • RadiozRadioz 2y ago
    SSH tunnel.
• east4ming 2y ago
  [dead]
• aristidesfl 2y ago
  Open source alternative: https://netbird.io/ https://netbird.io/