5 ms·

Tailscale is one of my favorite companies. They're clearly on to something. Here's a great post by their CTO explaining a lot of the motivation and vision behin

Tailscale is one of my favorite companies. They're clearly on to something. Here's a great post by their CTO explaining a lot of the motivation and vision behind it: https://crawshaw.io/blog/remembering-the-lan https://crawshaw.io/blog/remembering-the-lan IMO the main outstanding questions/concerns are: * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are likely running with reduced security since that's a huge part of the appeal. This is exactly the situation BeyondCorps/Zero Trust was created to avoid. Tunneling services[0] are more of a Zero Trust approach, but they can't match the seamlessness of Tailscale once a node is connected to the tailnet. * Can it expand into the layman market? I wonder if the average person will ever be willing to install a VPN app on all their devices. On the flipside, I could see TS partnering with someone like Google to integrate TS tightly with Android and set up a private network between all your Google-signed-in devices. * The relay system - DERP is nice, but it's primarily intended for signaling/fallback. It feels like CGNAT adoption is growing faster than IPv6 is, and I wouldn't be surprised if fewer and fewer p2p connections succeed over time[1]. DERP forces everything over a single TCP connection (HOL blocking), and I'm not sure it even has any flow control. * Use in web browsers - They got a demo of this working, but it's pretty involved. You have to compile the entire Tailscale Golang library to WebAssembly which is a large artifact, and it's DERP-exclusive. * Portability in general - Depending on WireGuard, as awesome as it is, is fairly limiting. You either need admin privileges to create the TUN device, or you need to run an entire TCP stack in userspace alongside your own WireGuard implementation. I'd be interested to see something like Tailscale implemented on top of WebTransport. [0]: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling [1]: https://tailscale.com/blog/how-nat-traversal-works https://tailscale.com/blog/how-nat-traversal-works

jdolak 2y ago
On your first point, I've been using tailscale for a bit and its ACL feature addresses most of my concerns there. My laptop can ssh into any of my servers but not the other way around, and my servers cant talk to each other unless I set them to.
- notsylver 2y ago
  Could you share your ACL setup? I haven't had time to look at it much but this sounds like exactly what I want to do.
  - prennert 2y ago
    The ACLs might look a bit scary at first, but they are actually quite intuitive once you coded up a rule or two. It basically works by tagging machines (especially those deployed with an API key) and grouping users. Then you set up rules which allow groups and tags can communicate with each other on specific ports. Since the default rule is DENY, you only need to specify rules for communication you actually want to allow. For instance you would create a tag for `servers` and a group for `sre`. Then you setup an ACL rule like this to allow SRE to ssh into servers: "action": "accept", "src": ["group:sre"], "dst": ["tag:server:22"] Because there is no rule with `group:sre` in `src` and `dst`, SREs cannot connect to each others machines. The tailscale docs are really good. And the videos they have are a great starting point if you dont come from a networking background. [0]: https://tailscale.com/kb/1018/acls https://tailscale.com/kb/1018/acls
- stampedbox 2y ago
  looking for this setup - please share if you could
  - unixhero 2y ago
    There is no setup. Just use Tailscale
thewebguyd 2y ago
> * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are likely running with reduced security since that's a huge part of the appeal. This is exactly the situation BeyondCorps/Zero Trust was created to avoid. Tunneling services[0] are more of a Zero Trust approach, but they can't match the seamlessness of Tailscale once a node is connected to the tailnet. At the very least there's ACLs so you can tag devices and restrict access down to specific ports and protocols based on either user identity or device tag. At my org we use tailscale much like a VPN, to give users access to a few internal web apps, and with ACLs those users can only hit the webserver on 443 and nothing else to that node. This way the web server itself has no ports exposed on the host, ufw deny all incoming. I can't answer if the VPN model is really the way to go, long term - probably not, but for our use case Tailscale has been absolutely perfect, and we accepted the tradeoffs were worth it over a more "complete" zero-trust approach, and the complexities that come along with it. What Tailscale doesn't solve is access to the data that web app serves if the user's machine is compromised, as tailscale is just determining "can the user hit the webserver on port 443?" and does nothing to evaluate the state of the user's host. I guess that's all to say, I/we don't see Tailscale as a zero-trust solution, but more or less a more convenient VPN with easier to use ACLs. Cloudflare Tunnel and the likes are much better suited to implementing a zero trust approach. I think there's still value though. A zero trust approach is the correct way for most organizations, but there's still a big niche for Tailscale especially for small-medium orgs and self-hosters/homelabbers.
- wkat4242 2y ago
  Tailscale is not just more convenient but also more efficient if your VPN meshes a lot ( not all traffic going to the same place). Because nodes can establish connections directly. A traditional VPN can't do that. This is the main reason I use a mesh vpn (though not tailscale)
  - guerby 2y ago
    Out of curiosity which one and why?
- 2y ago
epscylonb 2y ago
Agree that they are on to something. I gave a tech talk about them a while ago at work and said that I think they are on the cusp of providing a consumer VPN product that appeals to mainstream consumers. The Apple of VPNs, everything "just works" and is easy to understand.
- hattmall 2y ago
  Do mainstream consumers really need a VPN?
  - enos_feedler 2y ago
    Maybe if there was a mainstream reason to connect home machines with their phones. Personal backup, game streaming, etc. im not in this camp of believing it but maybe!
    - dharmab 2y ago
      I do this - I self host my movies/TV, ebooks, comics, photos, etc. and use tailscale to access it from anywhere. It's not really great for "mainstream" but for "tech enthusiast" it's very useful. Basically anyone who would consider buying a NAS (most consumer NAS devices can also run Docker containers these days)
  - parasubvert 2y ago
    Tailscale isn’t really a VPN, it’s an OSI layer 5 for the TCP/IP world. It makes connectivity as easy as 90s LAN parties were. I use Tailscale - so I can do remote tech support on my 81 year old mother’s computer - So I can remote in to my desktop from anywhere with my mobile phone or iPad or Vision Pro or Steam Deck if I need a file or need to print something - watching streaming media from my home network when I’m travelling (and avoiding VPN blocks because my home computer isn’t on a known VPN network) And the best part is none of this required almost any configuration beyond (a) installing the software, (b) checking the “allow exit node” box on my home computer, (c) sharing my mom’s computer onto my tailnet. It really is just useful with minimal fuss.
wkat4242 2y ago
Beyondcorp was mainly created to advocate cloud services and to minimise the (legit) worry off CIOs to see all their data in services connected to the entire internet. I still think VPN has a good usecase. It's great extra layer of defense and also a nice way to disclose access to devices at different locations. I don't use tailscale as it's too commercial for me but I use another VPN mesh service. Of course you still need to secure your endpoints properly.
- PLG88 2y ago
  Even Google admits BeyondCorp could not replace all their VPN needs... I wrote a Reddit post on it a while back - https://www.reddit.com/r/zerotrust/comments/1bfb7od/thoughts_on_googles_beyondcorp_and_the_long_tail/ https://www.reddit.com/r/zerotrust/comments/1bfb7od/thoughts...
reubenmorais 2y ago
> * Can it expand into the layman market? Maybe it's more enthusiast than layman, and I guess it's also not much of a market, but in the video arrrchival space it's pretty widespread, with people running e.g. Jellyfin behind Tailscale.
gz5 2y ago
I think you nailed it. TS is great but is in a middle ground niche with more targeted alternatives squeezing it from both sides: 1. If you actually need strong security, you are likely to go with open source zero trust or their commercial versions. 2. If you don't need strong security, you will often view VPN an insurance policy (TS simplifies but is still more difficult than 'do nothing'). So you end up with a relatively narrow band of 'use cases' like NAT traversal; semi-privacy; access to private IP hosted services. Enough to sustain a venture funded company?
godelski 2y ago
> set up a private network between all your ~~Google-signed-in~~ devices. I've been doing something like this as a fun side project. Idea is to get everything to pass through piholes and have both clear and VPN exit nodes. So then I can send some pis to people and we can create an internal network to share things like files, movies, streaming services, whatever. It also can increase security, especially making it easier for people like my parents when I need to fix their computers and I can just block malware for them, to some degree at least. It's also been very useful debugging stuff in my home network while I'm out somewhere else. And I can access any of my anywhere. I'm out traveling? Still got all my movies and stuff. One big issue is Apple, who doesn't seem to respect DNS and VPNs, especially local network access... the other aspect is that it makes some ssh automation annoying because they will change things, such as getting the name of the current ssid (wtf?!). So I can't just make a conditional in my config to go through TS instead of local network based on that
- nulbyte 2y ago
  > So I can't just make a conditional in my config to go through TS instead of local network based on that Tailscale can do hairpinning, so you may find you don't need a conditional config.
  - godelski 2y ago
    Thanks I'll look into that. Though part of my gripe is just not having this in general. I can want to work on a certain machine I don't open and if I'm on an internal network but if external I want to do a proxy jump. The ssid is the most obvious and consistent way to determine this, at least to me. Anyone got another idea?
VikingCoder 2y ago
I personally feel like paid DERP is unfortunately the way of the future.
- apitman 2y ago
  I think paid DERP could be an excellent model, especially since it lends itself well to small local companies that offer service for 5-10USD/mo. I'm mostly concerned about whether the DERP protocol can scale in that way.
  - VikingCoder 2y ago
    I think if there's revenue, they will revise and scale. I suspect it'll be more complicated than a flat subscription, which is unfortunate. I think it'll be a combination of bytes and number of connections.
LeoPanthera 2y ago
> install a VPN app on all their devices I run it on my router, providing access to the entire subnet, so it doesn't have to be all your devices.
- apitman 2y ago
  That's a useful tool. But you lose all the Tailscale security features like ACLs in that case right? And configuring a router also isn't something most people can/will do.
derefr 2y ago
> If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are likely running with reduced security since that's a huge part of the appeal. This is exactly the situation BeyondCorps/Zero Trust was created to avoid. In addition to the ACLs mentioned by the sibling, a tailnet is not quite a plain-old VPN overlay network, in that each device on a tailnet gets assigned a predictable, durable LAN IP address based on the credentials that device is logged into Tailscale with. Which means that, for at least the "personal" devices (laptops, phones, tablets), you can configure your servers on a tailnet to do something that's less finicky than full-on credential-based auth, but still more secure in practice than no auth: namely, host-based authentication — which should be a reasonable 1:1 proxy for user authentication (assuming the constraints from the previous paragraph.) To put that in concrete terms: on a tailnet, a user's SSH credential for a given server can simply be the fact that the user is able to originate the connection from the expected LAN IP address of the user's workstation. Except that instead of that LAN + the user's workstation living in a physical building, they're both virtual, and the user's physical workstation (of the moment) must provide credentials to bind to the tailnet IP that allows it to present itself as the virtual workstation.
spr-alex 2y ago
we've got a tailscale integration that takes care of the security concerns. set policy to decide what can talk out to the tailscale node and what the tailscale gateway is granted access to. this is especially important when you can't run a tailscale client on the devices you want to connect https://github.com/spr-networks/spr-tailscale https://github.com/spr-networks/spr-tailscale
Andrew_nenakhov 2y ago
> I wonder if the average person will ever be willing to install a VPN app on all their devices. Of course the average person will be willing to install a VPN app: all it takes is a bit of internet censorship, blocking access to their favourite services, and some geofencing, where services limit access to them based on IP address. Just ask people from China, Russia, Ukraine, Turkey, UK, Germany, etc.
- hn_throwaway_99 2y ago
  But what you're referring to as a "VPN app" is something very different than what the parent poster is referring to with respect to what Tailscale is. When you use services like NordVPN, Mullvad, Surfshark, etc., you're just installing a VPN client, and you're basically just using them as a reverse proxy to hide your IP address (present it as coming from another country). That is the use case you are talking about. Tailscale is very different. It is about setting up your own VPN so that you can access devices from your home or wherever from the Internet at large in a secure manner.
  - JFingleton 2y ago
    Indeed. VPNs were originally created to allow secure remote connections to and between LANs. The whole privacy thing is a by-product, and they're not that great at it. Tor exists and is far better at providing privacy.
    - Andrew_nenakhov 2y ago
      Tor is far to easily blocked, and given that a great number of nodes are compromised, it is likely it is far worse at providing privacy than some self-hosted vpn on some cheap hosting.
  - Dylan16807 2y ago
    > But what you're referring to as a "VPN app" is something very different than what the parent poster is referring to with respect to what Tailscale is. Does that matter? It still shows willingness to install.
PLG88 2y ago
Great insights, I think you will like OpenZiti, Anders, which is included in your list for both itself and zrok, which we built on top. Directly answering your concerns: - Deny by default and least privilege model means getting access to a node does not give you access to all services on the overlay. This includes SDKs so that only embedded apps are authorised, the apps have no listening ports on underlay and are literally unattackable via conventional IP-based tooling, all conventional network threats are immediately useless. - Its open source nature means its being adopted by companies to create more powerful ecosystems. - The overlay, while looking similar to DERP, uses individual service encryption and routing with flow control and smart routing (I know people who get much much better performance as a result). - Our SDK includes a 'clientless' endpoint for the browser called BrowZer - https://blog.openziti.io/introducing-openziti-browzer https://blog.openziti.io/introducing-openziti-browzer. All users need to do it log into their IdP and everything else is done automatically, without involvement from the user. - We don't build on Wireguard, which provides much more flexibility.
- concerndc1tizen 2y ago
  How does OpenZiti compare to Nebula? What does it do better/worse, and are the use cases different?
  - PLG88 2y ago
    I will preface by saying I am not a Nebula expert, and it may have changed since I last looked. Similarities: - Fully open source, using CAs as strong identities (rather than relying on SSO from third parties), completely self-hosted (with 3rd party SaaS options), and providing scalable, performant overlay networking. Differences: - OpenZiti is focused on connecting services based on zero trust principles. In contrast, Nebula focuses on connecting machines – e.g., you can authorize only a single port without needing to set up ACLs or firewall rules. - OpenZiti does not require inbound ports or hole punching, it builds outbound only connections via an overlay which looks sort of similar to DERP (but better with app specific encryption, routing, flow control, smart routing etc). This overlay also removes need for complex FW rules, ACLs, public DNS, L4 loadbalancers, etc. - As alluded to above, truly private, zero trust DNS entries with unique naming – if you wanted to call your service "my.secret.service", you can do that; it does not force you to have a valid Top Level Domain. - OpenZiti includes SDKs (along with appliance or host based tunnels) to bring overlay networking and zero trust principles directly into your application. - FOSS Nebula does not include "provisioning new clients with identities", as this person pointed out in our public forum - https://openziti.discourse.group/t/using-openziti-in-distributed-surveillance-system/2135 https://openziti.discourse.group/t/using-openziti-in-distrib...
qudat 2y ago
For prototyping web services I’ve been using https://tuns.sh https://tuns.sh which uses a managed version of dish. What’s great is there’s nothing to install locally since it uses ssh port forwarding to function.
Valien 2y ago
Psst...did you say browsers? https://github.com/tailscale/ts-browser-ext https://github.com/tailscale/ts-browser-ext super experimental but really cool

jdolak 2y ago

On your first point, I've been using tailscale for a bit and its ACL feature addresses most of my concerns there. My laptop can ssh into any of my servers but not the other way around, and my servers cant talk to each other unless I set them to.

notsylver 2y ago
Could you share your ACL setup? I haven't had time to look at it much but this sounds like exactly what I want to do.
- prennert 2y ago
  The ACLs might look a bit scary at first, but they are actually quite intuitive once you coded up a rule or two. It basically works by tagging machines (especially those deployed with an API key) and grouping users. Then you set up rules which allow groups and tags can communicate with each other on specific ports. Since the default rule is DENY, you only need to specify rules for communication you actually want to allow. For instance you would create a tag for `servers` and a group for `sre`. Then you setup an ACL rule like this to allow SRE to ssh into servers: "action": "accept", "src": ["group:sre"], "dst": ["tag:server:22"] Because there is no rule with `group:sre` in `src` and `dst`, SREs cannot connect to each others machines. The tailscale docs are really good. And the videos they have are a great starting point if you dont come from a networking background. [0]: https://tailscale.com/kb/1018/acls https://tailscale.com/kb/1018/acls
stampedbox 2y ago
looking for this setup - please share if you could
- unixhero 2y ago
  There is no setup. Just use Tailscale

thewebguyd 2y ago

> * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are likely running with reduced security since that's a huge part of the appeal. This is exactly the situation BeyondCorps/Zero Trust was created to avoid. Tunneling services[0] are more of a Zero Trust approach, but they can't match the seamlessness of Tailscale once a node is connected to the tailnet. At the very least there's ACLs so you can tag devices and restrict access down to specific ports and protocols based on either user identity or device tag. At my org we use tailscale much like a VPN, to give users access to a few internal web apps, and with ACLs those users can only hit the webserver on 443 and nothing else to that node. This way the web server itself has no ports exposed on the host, ufw deny all incoming. I can't answer if the VPN model is really the way to go, long term - probably not, but for our use case Tailscale has been absolutely perfect, and we accepted the tradeoffs were worth it over a more "complete" zero-trust approach, and the complexities that come along with it. What Tailscale doesn't solve is access to the data that web app serves if the user's machine is compromised, as tailscale is just determining "can the user hit the webserver on port 443?" and does nothing to evaluate the state of the user's host. I guess that's all to say, I/we don't see Tailscale as a zero-trust solution, but more or less a more convenient VPN with easier to use ACLs. Cloudflare Tunnel and the likes are much better suited to implementing a zero trust approach. I think there's still value though. A zero trust approach is the correct way for most organizations, but there's still a big niche for Tailscale especially for small-medium orgs and self-hosters/homelabbers.

wkat4242 2y ago
Tailscale is not just more convenient but also more efficient if your VPN meshes a lot ( not all traffic going to the same place). Because nodes can establish connections directly. A traditional VPN can't do that. This is the main reason I use a mesh vpn (though not tailscale)
- guerby 2y ago
  Out of curiosity which one and why?
2y ago

epscylonb 2y ago

Agree that they are on to something. I gave a tech talk about them a while ago at work and said that I think they are on the cusp of providing a consumer VPN product that appeals to mainstream consumers. The Apple of VPNs, everything "just works" and is easy to understand.

hattmall 2y ago
Do mainstream consumers really need a VPN?
- enos_feedler 2y ago
  Maybe if there was a mainstream reason to connect home machines with their phones. Personal backup, game streaming, etc. im not in this camp of believing it but maybe!
  - dharmab 2y ago
    I do this - I self host my movies/TV, ebooks, comics, photos, etc. and use tailscale to access it from anywhere. It's not really great for "mainstream" but for "tech enthusiast" it's very useful. Basically anyone who would consider buying a NAS (most consumer NAS devices can also run Docker containers these days)
- parasubvert 2y ago
  Tailscale isn’t really a VPN, it’s an OSI layer 5 for the TCP/IP world. It makes connectivity as easy as 90s LAN parties were. I use Tailscale - so I can do remote tech support on my 81 year old mother’s computer - So I can remote in to my desktop from anywhere with my mobile phone or iPad or Vision Pro or Steam Deck if I need a file or need to print something - watching streaming media from my home network when I’m travelling (and avoiding VPN blocks because my home computer isn’t on a known VPN network) And the best part is none of this required almost any configuration beyond (a) installing the software, (b) checking the “allow exit node” box on my home computer, (c) sharing my mom’s computer onto my tailnet. It really is just useful with minimal fuss.

wkat4242 2y ago

Beyondcorp was mainly created to advocate cloud services and to minimise the (legit) worry off CIOs to see all their data in services connected to the entire internet. I still think VPN has a good usecase. It's great extra layer of defense and also a nice way to disclose access to devices at different locations. I don't use tailscale as it's too commercial for me but I use another VPN mesh service. Of course you still need to secure your endpoints properly.

PLG88 2y ago
Even Google admits BeyondCorp could not replace all their VPN needs... I wrote a Reddit post on it a while back - https://www.reddit.com/r/zerotrust/comments/1bfb7od/thoughts_on_googles_beyondcorp_and_the_long_tail/ https://www.reddit.com/r/zerotrust/comments/1bfb7od/thoughts...

reubenmorais 2y ago

> * Can it expand into the layman market? Maybe it's more enthusiast than layman, and I guess it's also not much of a market, but in the video arrrchival space it's pretty widespread, with people running e.g. Jellyfin behind Tailscale.

gz5 2y ago

I think you nailed it. TS is great but is in a middle ground niche with more targeted alternatives squeezing it from both sides: 1. If you actually need strong security, you are likely to go with open source zero trust or their commercial versions. 2. If you don't need strong security, you will often view VPN an insurance policy (TS simplifies but is still more difficult than 'do nothing'). So you end up with a relatively narrow band of 'use cases' like NAT traversal; semi-privacy; access to private IP hosted services. Enough to sustain a venture funded company?

godelski 2y ago

> set up a private network between all your ~~Google-signed-in~~ devices. I've been doing something like this as a fun side project. Idea is to get everything to pass through piholes and have both clear and VPN exit nodes. So then I can send some pis to people and we can create an internal network to share things like files, movies, streaming services, whatever. It also can increase security, especially making it easier for people like my parents when I need to fix their computers and I can just block malware for them, to some degree at least. It's also been very useful debugging stuff in my home network while I'm out somewhere else. And I can access any of my anywhere. I'm out traveling? Still got all my movies and stuff. One big issue is Apple, who doesn't seem to respect DNS and VPNs, especially local network access... the other aspect is that it makes some ssh automation annoying because they will change things, such as getting the name of the current ssid (wtf?!). So I can't just make a conditional in my config to go through TS instead of local network based on that

nulbyte 2y ago
> So I can't just make a conditional in my config to go through TS instead of local network based on that Tailscale can do hairpinning, so you may find you don't need a conditional config.
- godelski 2y ago
  Thanks I'll look into that. Though part of my gripe is just not having this in general. I can want to work on a certain machine I don't open and if I'm on an internal network but if external I want to do a proxy jump. The ssid is the most obvious and consistent way to determine this, at least to me. Anyone got another idea?

VikingCoder 2y ago

I personally feel like paid DERP is unfortunately the way of the future.

apitman 2y ago
I think paid DERP could be an excellent model, especially since it lends itself well to small local companies that offer service for 5-10USD/mo. I'm mostly concerned about whether the DERP protocol can scale in that way.
- VikingCoder 2y ago
  I think if there's revenue, they will revise and scale. I suspect it'll be more complicated than a flat subscription, which is unfortunate. I think it'll be a combination of bytes and number of connections.

LeoPanthera 2y ago

> install a VPN app on all their devices I run it on my router, providing access to the entire subnet, so it doesn't have to be all your devices.

apitman 2y ago
That's a useful tool. But you lose all the Tailscale security features like ACLs in that case right? And configuring a router also isn't something most people can/will do.

derefr 2y ago

> If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are likely running with reduced security since that's a huge part of the appeal. This is exactly the situation BeyondCorps/Zero Trust was created to avoid. In addition to the ACLs mentioned by the sibling, a tailnet is not quite a plain-old VPN overlay network, in that each device on a tailnet gets assigned a predictable, durable LAN IP address based on the credentials that device is logged into Tailscale with. Which means that, for at least the "personal" devices (laptops, phones, tablets), you can configure your servers on a tailnet to do something that's less finicky than full-on credential-based auth, but still more secure in practice than no auth: namely, host-based authentication — which should be a reasonable 1:1 proxy for user authentication (assuming the constraints from the previous paragraph.) To put that in concrete terms: on a tailnet, a user's SSH credential for a given server can simply be the fact that the user is able to originate the connection from the expected LAN IP address of the user's workstation. Except that instead of that LAN + the user's workstation living in a physical building, they're both virtual, and the user's physical workstation (of the moment) must provide credentials to bind to the tailnet IP that allows it to present itself as the virtual workstation.

spr-alex 2y ago

we've got a tailscale integration that takes care of the security concerns. set policy to decide what can talk out to the tailscale node and what the tailscale gateway is granted access to. this is especially important when you can't run a tailscale client on the devices you want to connect https://github.com/spr-networks/spr-tailscale https://github.com/spr-networks/spr-tailscale

Andrew_nenakhov 2y ago

> I wonder if the average person will ever be willing to install a VPN app on all their devices. Of course the average person will be willing to install a VPN app: all it takes is a bit of internet censorship, blocking access to their favourite services, and some geofencing, where services limit access to them based on IP address. Just ask people from China, Russia, Ukraine, Turkey, UK, Germany, etc.

hn_throwaway_99 2y ago
But what you're referring to as a "VPN app" is something very different than what the parent poster is referring to with respect to what Tailscale is. When you use services like NordVPN, Mullvad, Surfshark, etc., you're just installing a VPN client, and you're basically just using them as a reverse proxy to hide your IP address (present it as coming from another country). That is the use case you are talking about. Tailscale is very different. It is about setting up your own VPN so that you can access devices from your home or wherever from the Internet at large in a secure manner.
- JFingleton 2y ago
  Indeed. VPNs were originally created to allow secure remote connections to and between LANs. The whole privacy thing is a by-product, and they're not that great at it. Tor exists and is far better at providing privacy.
  - Andrew_nenakhov 2y ago
    Tor is far to easily blocked, and given that a great number of nodes are compromised, it is likely it is far worse at providing privacy than some self-hosted vpn on some cheap hosting.
- Dylan16807 2y ago
  > But what you're referring to as a "VPN app" is something very different than what the parent poster is referring to with respect to what Tailscale is. Does that matter? It still shows willingness to install.

PLG88 2y ago

Great insights, I think you will like OpenZiti, Anders, which is included in your list for both itself and zrok, which we built on top. Directly answering your concerns: - Deny by default and least privilege model means getting access to a node does not give you access to all services on the overlay. This includes SDKs so that only embedded apps are authorised, the apps have no listening ports on underlay and are literally unattackable via conventional IP-based tooling, all conventional network threats are immediately useless. - Its open source nature means its being adopted by companies to create more powerful ecosystems. - The overlay, while looking similar to DERP, uses individual service encryption and routing with flow control and smart routing (I know people who get much much better performance as a result). - Our SDK includes a 'clientless' endpoint for the browser called BrowZer - https://blog.openziti.io/introducing-openziti-browzer https://blog.openziti.io/introducing-openziti-browzer. All users need to do it log into their IdP and everything else is done automatically, without involvement from the user. - We don't build on Wireguard, which provides much more flexibility.

concerndc1tizen 2y ago
How does OpenZiti compare to Nebula? What does it do better/worse, and are the use cases different?
- PLG88 2y ago
  I will preface by saying I am not a Nebula expert, and it may have changed since I last looked. Similarities: - Fully open source, using CAs as strong identities (rather than relying on SSO from third parties), completely self-hosted (with 3rd party SaaS options), and providing scalable, performant overlay networking. Differences: - OpenZiti is focused on connecting services based on zero trust principles. In contrast, Nebula focuses on connecting machines – e.g., you can authorize only a single port without needing to set up ACLs or firewall rules. - OpenZiti does not require inbound ports or hole punching, it builds outbound only connections via an overlay which looks sort of similar to DERP (but better with app specific encryption, routing, flow control, smart routing etc). This overlay also removes need for complex FW rules, ACLs, public DNS, L4 loadbalancers, etc. - As alluded to above, truly private, zero trust DNS entries with unique naming – if you wanted to call your service "my.secret.service", you can do that; it does not force you to have a valid Top Level Domain. - OpenZiti includes SDKs (along with appliance or host based tunnels) to bring overlay networking and zero trust principles directly into your application. - FOSS Nebula does not include "provisioning new clients with identities", as this person pointed out in our public forum - https://openziti.discourse.group/t/using-openziti-in-distributed-surveillance-system/2135 https://openziti.discourse.group/t/using-openziti-in-distrib...

qudat 2y ago

For prototyping web services I’ve been using https://tuns.sh https://tuns.sh which uses a managed version of dish. What’s great is there’s nothing to install locally since it uses ssh port forwarding to function.

Valien 2y ago

Psst...did you say browsers? https://github.com/tailscale/ts-browser-ext https://github.com/tailscale/ts-browser-ext super experimental but really cool