3 ms·

> * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are

> * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are likely running with reduced security since that's a huge part of the appeal. This is exactly the situation BeyondCorps/Zero Trust was created to avoid. Tunneling services[0] are more of a Zero Trust approach, but they can't match the seamlessness of Tailscale once a node is connected to the tailnet. At the very least there's ACLs so you can tag devices and restrict access down to specific ports and protocols based on either user identity or device tag. At my org we use tailscale much like a VPN, to give users access to a few internal web apps, and with ACLs those users can only hit the webserver on 443 and nothing else to that node. This way the web server itself has no ports exposed on the host, ufw deny all incoming. I can't answer if the VPN model is really the way to go, long term - probably not, but for our use case Tailscale has been absolutely perfect, and we accepted the tradeoffs were worth it over a more "complete" zero-trust approach, and the complexities that come along with it. What Tailscale doesn't solve is access to the data that web app serves if the user's machine is compromised, as tailscale is just determining "can the user hit the webserver on port 443?" and does nothing to evaluate the state of the user's host. I guess that's all to say, I/we don't see Tailscale as a zero-trust solution, but more or less a more convenient VPN with easier to use ACLs. Cloudflare Tunnel and the likes are much better suited to implementing a zero trust approach. I think there's still value though. A zero trust approach is the correct way for most organizations, but there's still a big niche for Tailscale especially for small-medium orgs and self-hosters/homelabbers.

wkat4242 2y ago
Tailscale is not just more convenient but also more efficient if your VPN meshes a lot ( not all traffic going to the same place). Because nodes can establish connections directly. A traditional VPN can't do that. This is the main reason I use a mesh vpn (though not tailscale)
- guerby 2y ago
  Out of curiosity which one and why?
frenchtoast8 2y ago
> What Tailscale doesn't solve is access to the data that web app serves if the user's machine is compromised, as tailscale is just determining "can the user hit the webserver on port 443?" and does nothing to evaluate the state of the user's host. Tailscale has some cybersecurity integrations to configure access depending on the device posture. For example, blocking access to a webserver if the device is out of date, or if malware is detected, or if the firewall is disabled, etc. But I don't use any of those integrations and can't speak to them.
- jychang 2y ago
  I don't think most users use those integrations, they're mostly just a feature bullet point.
  - ehutch79 2y ago
    SO those features are unusable?
    - joneskoo 2y ago
      Most users (tailnets) are not an enterprise. Most users not using a feature doesn’t mean it’s not useful or valuable.
- cjcampbell 2y ago
  The posture implementation is quite easy to work with. There’s a growing list of integrations, and you can also roll your own with the posture API. I’ve used Kolide so far and will be integrating with Kandji on another tailnet. They also have Intune, JAMF, Crowdstrike, and SentinelOne. The same posture API can be used to restrict access to devices in your inventory or to set up just-in-time access to a sensitive asset. For the latter, you can use a Slack app provided by Tailscale or integrate with an identity governance workflow to set a posture attribute with a limited TTL. Your tailscale policy just needs to condition the relevant access on the attribute.

wkat4242 2y ago

Tailscale is not just more convenient but also more efficient if your VPN meshes a lot ( not all traffic going to the same place). Because nodes can establish connections directly. A traditional VPN can't do that. This is the main reason I use a mesh vpn (though not tailscale)

guerby 2y ago
Out of curiosity which one and why?

frenchtoast8 2y ago

> What Tailscale doesn't solve is access to the data that web app serves if the user's machine is compromised, as tailscale is just determining "can the user hit the webserver on port 443?" and does nothing to evaluate the state of the user's host. Tailscale has some cybersecurity integrations to configure access depending on the device posture. For example, blocking access to a webserver if the device is out of date, or if malware is detected, or if the firewall is disabled, etc. But I don't use any of those integrations and can't speak to them.

jychang 2y ago
I don't think most users use those integrations, they're mostly just a feature bullet point.
- ehutch79 2y ago
  SO those features are unusable?
  - joneskoo 2y ago
    Most users (tailnets) are not an enterprise. Most users not using a feature doesn’t mean it’s not useful or valuable.
cjcampbell 2y ago
The posture implementation is quite easy to work with. There’s a growing list of integrations, and you can also roll your own with the posture API. I’ve used Kolide so far and will be integrating with Kandji on another tailnet. They also have Intune, JAMF, Crowdstrike, and SentinelOne. The same posture API can be used to restrict access to devices in your inventory or to set up just-in-time access to a sensitive asset. For the latter, you can use a Slack app provided by Tailscale or integrate with an identity governance workflow to set a posture attribute with a limited TTL. Your tailscale policy just needs to condition the relevant access on the attribute.