6 ms·

I'm a fan of TS and have been a paying customer for work infra for almost a year now. It really is well put together and easy to use, but I do run up against so

I'm a fan of TS and have been a paying customer for work infra for almost a year now. It really is well put together and easy to use, but I do run up against some issues/complaints when diving deep that I hope they can work out: * The pricing tiers and included features by tier penalizes you in frustrating ways. The base plan is a reasonable $6/user/m, but if you want to use ACLs to control anything in a workable way, it jumps 3x to $18/u/m. Better solutions are available for that kind of money, and I shudder to imagine what the next tier ('call us') costs. * Subnet routing broke on Ubuntu (maybe other distros) recently, and there were no alerts, communication from TS, or TS tools to pinpoint/figure out what was going on. I stumbled on a solution (install subnet router on a Windows box), and from there I searched and found others with that issue. Lost half a day in emergency mode over that! * Better tooling to determine why it's falling back to DERP instead of direct for remote clients. DERP relays should be an absolute last resort to provide connectivity for Business-plan-level customers (very slow), and the way TS works just assumes any connectivity is fine. Overall, the simplicity and abstraction of complex VPN networking is wonderful, but if you have issues or advanced needs, you are immediately thrust into the low-level UDP/NAT/STUN world you were trying to avoid. At that point, you're better off using a traditional VPN (WG, OpenVPN, or heaven forbid, IPSec), because it ends up being more straightforward (not easier) without the abstractions and easy-button stuff.

smashed 2y ago
> * Better tooling to determine why it's falling back to DERP instead of direct for remote clients. DERP relays should be an absolute last resort to provide connectivity for Business-plan-level customers (very slow), and the way TS works just assumes any connectivity is fine. Tailscale touts all the perf benefits of the wireguard protocol but in practice between the userland wireguard that seems to be used all the time on all platform (even linux) and the over reliance on DERP, it has none of the performance benefits of the real thing.
- miki123211 2y ago
  They also seem to be needlessly doing DERP over TCP in some cases where UDP would actually work.
- diegs 2y ago
  I thought they vastly improved user-space wireguard performance? https://tailscale.com/blog/more-throughput https://tailscale.com/blog/more-throughput Not sure if the kernel implementation pulled ahead again, I don't really follow these things. Also not defending tailscale, I respect them but I agree they are a one size fits some solution.
atomicnumber3 2y ago
>$6/user/m, but if you want to use ACLs to control anything in a workable way, it jumps 3x to $18/u/m. It's market segmentation, needing ACLs is a sign you're at least an SMB, and to a business of nearly any actual size, the difference between $6/user and $18/user is 0.
- dexterdog 2y ago
  Um, it's 3x the cost to get one feature. By your logic they should be charging $100/user/mo for the feature since that must also be the same. This is typical "enterprise" nonsense pricing and it will absolutely drive some adopters to look elsewhere.
  - dewey 2y ago
    It's a perfectly valid part of a pricing strategy to drive people away if they are not the customers you want.
    - nativeit 2y ago
      Namely, customers too stupid to know how to use something else, and/or customers you’ve managed to lock-in sufficiently to make them too scared to do so. I guess that’s a good strategy if you hate what you do and the people you do it for.
  - nativeit 2y ago
    I have been using ZeroTier for a few years with great success. It’s not an Enterprise, but for my lil’ shop I get 100 endpoints for $0.10/ea/month, and that includes all features.
- wkat4242 2y ago
  Uh I work for an enterprise of tens of thousands of users and $18 a month is not nothing for us. In fact considering the discounts we get at our size that would be so high we'd never consider it. We don't even use windows enterprise for the same reason, we have legacy office 365 plans and lifetime windows licenses without the M365 addons because it saves is a few bucks per head. At our size, a few bucks a head quickly add up to millions per year. Microsoft keeps trying to dissuade us and they even pretend office 365 plans don't exist anymore ("office 365 is now microsoft 365") but they do: https://www.microsoft.com/en-us/microsoft-365/enterprise/office-365-e3 https://www.microsoft.com/en-us/microsoft-365/enterprise/off... . The same with their Copilot stuff. 30$ is a non starter. Our users want it but nope (and we did a trial in one big team and only 10% actually bothered to use it after the first month so I think it's more the idea of it that want rather than the actual product) We don't use Tailscale but $6 would be feasible where $18 would be a complete nonstarter. In fact our company is a lot more cost conscious than I am as a consumer.
ErigmolCt 2y ago
I really hope with this funding they can improve observability and give more love to power users who occasionally need to dig deeper without going full bare metal
rjgray 2y ago
Do you mind sharing the better solutions you'd consider at the higher price point?
- cbzbc 2y ago
  zerotier maybe?
  - alexjurkiewicz 2y ago
    There's nothing about ZeroTier's solution which deserves a higher price point than Tailscale. As a long-time user, ZT's administration UI is much worse and the product has been essentially unchanged for a decade. Better solutions would be things that make the VPN invisible, rather than 'easy'. Tools such as Teleport, IOW.
- fakebizprez 2y ago
  exactly. there is none.
lkuty 2y ago
"Subnet routing broke on Ubuntu (maybe other distros) recently" Do you have more infos on this one? I use Debian and that would be a major problem for me.
- johnmoberg 2y ago
  possibly referring to https://github.com/tailscale/tailscale/issues/13863 https://github.com/tailscale/tailscale/issues/13863 which broke subnet routing for us
fidotron 2y ago
> Overall, the simplicity and abstraction of complex VPN networking is wonderful, but if you have issues or advanced needs, you are immediately thrust into the low-level UDP/NAT/STUN world you were trying to avoid. This is my experience too. I actually came to believe the TS dream of device based VPN as opposed to AP or router based is the wrong thing because it gets confused by subnets and subnet routing so often, but also that the big security problem on networks is bad devices which it's not going to help you with unless you can wrap them up anyway. That's one of the reasons I started playing with AP to AP real time video like https://github.com/atomirex/umbrella https://github.com/atomirex/umbrella which is a nightmare case from the TS pov. The intention is to eventually wrap clients up on separate networks so they can only see each other via the (locally run) relay.
PLG88 2y ago
Agreed. This is why imho Tailscale does not scale very well. Awesome for home labs and small orgs as a VPN replacement, but not enterprise scale with abstrations that actually remove complexity. I wrote about it in this blog - https://netfoundry.io/vpns/tailscale-and-wireguard-versus-netfoundry-and-openziti/ https://netfoundry.io/vpns/tailscale-and-wireguard-versus-ne...
lo0dot0 2y ago
> NAT/STUN world you were trying to avoid The clean way to build this is with firewall configuration, opening ports, and static IPs. NAT/STUN and dynamic IPs are just a hack and I don't understand why people pretend this is an acceptable solution for professional networking. Working around an infrastructure that isn't a natural law but can be changed at our will seems like a big waste of time.
- supermatt 2y ago
  > I don't understand why people pretend this is an acceptable solution for professional networking Because it IS acceptable for many cases. Many businesses don't operate in such a way as to have centralised infrastructure solely for providing internal networking, nor would they want to add the additional administrative or unnecessary routing overhead. Even locations that would traditionally be considered highly centralised often have some form of dynamic network fabric as an overlay. Pretty much the entirety of cloud infrastructure runs on such systems, and they seem to do OK.
  - lo0dot0 2y ago
    Dynamic IP addresses typically also have a forced disconnect at a regular interval. Not really what I want to host services on.
    - supermatt 2y ago
      That seems like even more reason to use an overlay - it abstracts all that instability away and gives you a consistent, secure network regardless of what the underlying IPs are doing. Obviously peers can have static IPs too if you think that makes them more stable to routing changes (it doesn't).
      - lo0dot0 2y ago
        Do you really think that a tailscale VPN is necessary to deal with link failures? It is not BGP and SD-WAN or MPLS l2 VPN can do that.
hashworks 2y ago
> I shudder to imagine what the next tier (cal us') costs. There is no enterprise tier, instead you pay for any additional features you need. I.e. log streaming is 2$/month/user and SSH recording is 3$/month/user.
snapplebobapple 2y ago
I switched to netburd and havent looked back. Jetbird android cliwnt is pretty usable

smashed 2y ago

> * Better tooling to determine why it's falling back to DERP instead of direct for remote clients. DERP relays should be an absolute last resort to provide connectivity for Business-plan-level customers (very slow), and the way TS works just assumes any connectivity is fine. Tailscale touts all the perf benefits of the wireguard protocol but in practice between the userland wireguard that seems to be used all the time on all platform (even linux) and the over reliance on DERP, it has none of the performance benefits of the real thing.

miki123211 2y ago
They also seem to be needlessly doing DERP over TCP in some cases where UDP would actually work.
diegs 2y ago
I thought they vastly improved user-space wireguard performance? https://tailscale.com/blog/more-throughput https://tailscale.com/blog/more-throughput Not sure if the kernel implementation pulled ahead again, I don't really follow these things. Also not defending tailscale, I respect them but I agree they are a one size fits some solution.

atomicnumber3 2y ago

>$6/user/m, but if you want to use ACLs to control anything in a workable way, it jumps 3x to $18/u/m. It's market segmentation, needing ACLs is a sign you're at least an SMB, and to a business of nearly any actual size, the difference between $6/user and $18/user is 0.

dexterdog 2y ago
Um, it's 3x the cost to get one feature. By your logic they should be charging $100/user/mo for the feature since that must also be the same. This is typical "enterprise" nonsense pricing and it will absolutely drive some adopters to look elsewhere.
- dewey 2y ago
  It's a perfectly valid part of a pricing strategy to drive people away if they are not the customers you want.
  - nativeit 2y ago
    Namely, customers too stupid to know how to use something else, and/or customers you’ve managed to lock-in sufficiently to make them too scared to do so. I guess that’s a good strategy if you hate what you do and the people you do it for.
- nativeit 2y ago
  I have been using ZeroTier for a few years with great success. It’s not an Enterprise, but for my lil’ shop I get 100 endpoints for $0.10/ea/month, and that includes all features.
wkat4242 2y ago
Uh I work for an enterprise of tens of thousands of users and $18 a month is not nothing for us. In fact considering the discounts we get at our size that would be so high we'd never consider it. We don't even use windows enterprise for the same reason, we have legacy office 365 plans and lifetime windows licenses without the M365 addons because it saves is a few bucks per head. At our size, a few bucks a head quickly add up to millions per year. Microsoft keeps trying to dissuade us and they even pretend office 365 plans don't exist anymore ("office 365 is now microsoft 365") but they do: https://www.microsoft.com/en-us/microsoft-365/enterprise/office-365-e3 https://www.microsoft.com/en-us/microsoft-365/enterprise/off... . The same with their Copilot stuff. 30$ is a non starter. Our users want it but nope (and we did a trial in one big team and only 10% actually bothered to use it after the first month so I think it's more the idea of it that want rather than the actual product) We don't use Tailscale but $6 would be feasible where $18 would be a complete nonstarter. In fact our company is a lot more cost conscious than I am as a consumer.

ErigmolCt 2y ago

I really hope with this funding they can improve observability and give more love to power users who occasionally need to dig deeper without going full bare metal

rjgray 2y ago

Do you mind sharing the better solutions you'd consider at the higher price point?

cbzbc 2y ago
zerotier maybe?
- alexjurkiewicz 2y ago
  There's nothing about ZeroTier's solution which deserves a higher price point than Tailscale. As a long-time user, ZT's administration UI is much worse and the product has been essentially unchanged for a decade. Better solutions would be things that make the VPN invisible, rather than 'easy'. Tools such as Teleport, IOW.
fakebizprez 2y ago
exactly. there is none.

lkuty 2y ago

"Subnet routing broke on Ubuntu (maybe other distros) recently" Do you have more infos on this one? I use Debian and that would be a major problem for me.

johnmoberg 2y ago
possibly referring to https://github.com/tailscale/tailscale/issues/13863 https://github.com/tailscale/tailscale/issues/13863 which broke subnet routing for us

fidotron 2y ago

> Overall, the simplicity and abstraction of complex VPN networking is wonderful, but if you have issues or advanced needs, you are immediately thrust into the low-level UDP/NAT/STUN world you were trying to avoid. This is my experience too. I actually came to believe the TS dream of device based VPN as opposed to AP or router based is the wrong thing because it gets confused by subnets and subnet routing so often, but also that the big security problem on networks is bad devices which it's not going to help you with unless you can wrap them up anyway. That's one of the reasons I started playing with AP to AP real time video like https://github.com/atomirex/umbrella https://github.com/atomirex/umbrella which is a nightmare case from the TS pov. The intention is to eventually wrap clients up on separate networks so they can only see each other via the (locally run) relay.

PLG88 2y ago

Agreed. This is why imho Tailscale does not scale very well. Awesome for home labs and small orgs as a VPN replacement, but not enterprise scale with abstrations that actually remove complexity. I wrote about it in this blog - https://netfoundry.io/vpns/tailscale-and-wireguard-versus-netfoundry-and-openziti/ https://netfoundry.io/vpns/tailscale-and-wireguard-versus-ne...

lo0dot0 2y ago

> NAT/STUN world you were trying to avoid The clean way to build this is with firewall configuration, opening ports, and static IPs. NAT/STUN and dynamic IPs are just a hack and I don't understand why people pretend this is an acceptable solution for professional networking. Working around an infrastructure that isn't a natural law but can be changed at our will seems like a big waste of time.

supermatt 2y ago
> I don't understand why people pretend this is an acceptable solution for professional networking Because it IS acceptable for many cases. Many businesses don't operate in such a way as to have centralised infrastructure solely for providing internal networking, nor would they want to add the additional administrative or unnecessary routing overhead. Even locations that would traditionally be considered highly centralised often have some form of dynamic network fabric as an overlay. Pretty much the entirety of cloud infrastructure runs on such systems, and they seem to do OK.
- lo0dot0 2y ago
  Dynamic IP addresses typically also have a forced disconnect at a regular interval. Not really what I want to host services on.
  - supermatt 2y ago
    That seems like even more reason to use an overlay - it abstracts all that instability away and gives you a consistent, secure network regardless of what the underlying IPs are doing. Obviously peers can have static IPs too if you think that makes them more stable to routing changes (it doesn't).
    - lo0dot0 2y ago
      Do you really think that a tailscale VPN is necessary to deal with link failures? It is not BGP and SD-WAN or MPLS l2 VPN can do that.

hashworks 2y ago

> I shudder to imagine what the next tier (cal us') costs. There is no enterprise tier, instead you pay for any additional features you need. I.e. log streaming is 2$/month/user and SSH recording is 3$/month/user.

snapplebobapple 2y ago

I switched to netburd and havent looked back. Jetbird android cliwnt is pretty usable