3 ms·

What's the actual win here? Avoiding relay latency in the rare cases Tailscale can't punch through NAT? If that's it, a $3 VPS running Headscale seems simpler.

What's the actual win here? Avoiding relay latency in the rare cases Tailscale can't punch through NAT? If that's it, a $3 VPS running Headscale seems simpler. The complexity feels like you're optimizing for the 5% case while adding permanent vendor lock in. What am I missing?

throwaway678339 11mo ago
I don't think you are missing anything. They have a bunch of half baked features like this that aren't as robust as real security vendors and lock you in just like you said.
josteink 11mo ago
Maybe I’m misunderstanding something… But are you accusing someone of promoting vendor lock-in (cloudflare) while at the same time promoting vendor lock-in (tailscale)? If you’re ok with vendor lock-in, shouldn’t you in theory be ok with any vendor?
- bingo-bongo 11mo ago
  Headscale is the not-vendor-login version of Tailscale.
  - uneekname 11mo ago
    Sort of. Many tailscale clients you would use with headscale are closed source.
- fragmede 11mo ago
  No. Not all vendors are equal. We can treat ProtonMail differently then Gmail, for example. Looking at what's gone down with VMware, definitely don't get in bed with Broadcom.
killingtime74 11mo ago
For many homelabbers, just being cheap and avoiding the $3 VPS, that's it
- comrh 11mo ago
  I dont even pay anything, my tiny homelab is completely covered by the free tier
  - kohbo 11mo ago
    What provider still has decent free tier?
    - antonkochubey 11mo ago
      Oracle. 4 vCPU, 24 GB RAM, 200 GB SSD. It’s arm64 but nowadays that doesn’t really matter.
      - gear54rus 11mo ago
        Which region were you able to create this in? They seem to be out of capacity all the time in EU.
        jnsaff2 11mo ago
        I have read that you need to write a script to constantly bombard their API in order to get one. I presume you'd be fighting other scripts.
        petronic 11mo ago
        What worked for me was handing them a credit card and transitioning myself out of the free tier. (I'd use the free credits they offer prior to doing this - they give you something like $300 immediately on signup.) The always-free infra remains free, you just have the chance of incurring a bill if you make selections that aren't free or exceed block storage/egress (200GB/10TB) limits of the always-free tier. Leaving the free/trial tier gives you access to a much larger pool of instances. I never successfully deployed an A1 instance prior to becoming a "paying" customer - now I've done it hundreds of times without ever having an issue. I've been running a small k0s cluster and a standalone webserver for months while incurring about $2.50 - $3 in spending each month, primarily from being slow to remove instance snapshots sitting in block storage. Even things that are oddly expensive on AWS - like NAT - are free on Oracle. There are zero gotchas.
k_bx 11mo ago
$3 VPS running Headscale is not simpler since you won't be able to run both headscale and tailscale on your end user machines, I don't recommend it. The solution we've found is running a white IP container (or VPS) which looks like regular Wireguard outside, while inside it "forwards" to your existing tailscale network. I don't remember if we use https://github.com/gravitl/netmaker https://github.com/gravitl/netmaker or https://github.com/juhovh/tailguard https://github.com/juhovh/tailguard Also see: https://tailscale.com/blog/peer-relays-beta https://tailscale.com/blog/peer-relays-beta
zrail 11mo ago
Tailscale has what they call Peer Relays now to help solve this problem: https://tailscale.com/blog/peer-relays-beta https://tailscale.com/blog/peer-relays-beta
codethief 11mo ago
What does Headscale have to do with NAT hole punching? I believe what you actually mean is setting up a relay, see the link in https://news.ycombinator.com/item?id=45948806 https://news.ycombinator.com/item?id=45948806 .

throwaway678339 11mo ago

I don't think you are missing anything. They have a bunch of half baked features like this that aren't as robust as real security vendors and lock you in just like you said.

josteink 11mo ago

Maybe I’m misunderstanding something… But are you accusing someone of promoting vendor lock-in (cloudflare) while at the same time promoting vendor lock-in (tailscale)? If you’re ok with vendor lock-in, shouldn’t you in theory be ok with any vendor?

bingo-bongo 11mo ago
Headscale is the not-vendor-login version of Tailscale.
- uneekname 11mo ago
  Sort of. Many tailscale clients you would use with headscale are closed source.
fragmede 11mo ago
No. Not all vendors are equal. We can treat ProtonMail differently then Gmail, for example. Looking at what's gone down with VMware, definitely don't get in bed with Broadcom.

killingtime74 11mo ago

For many homelabbers, just being cheap and avoiding the $3 VPS, that's it

comrh 11mo ago
I dont even pay anything, my tiny homelab is completely covered by the free tier
- kohbo 11mo ago
  What provider still has decent free tier?
  - antonkochubey 11mo ago
    Oracle. 4 vCPU, 24 GB RAM, 200 GB SSD. It’s arm64 but nowadays that doesn’t really matter.
    - gear54rus 11mo ago
      Which region were you able to create this in? They seem to be out of capacity all the time in EU.
      - jnsaff2 11mo ago
        I have read that you need to write a script to constantly bombard their API in order to get one. I presume you'd be fighting other scripts.
      - petronic 11mo ago
        What worked for me was handing them a credit card and transitioning myself out of the free tier. (I'd use the free credits they offer prior to doing this - they give you something like $300 immediately on signup.) The always-free infra remains free, you just have the chance of incurring a bill if you make selections that aren't free or exceed block storage/egress (200GB/10TB) limits of the always-free tier. Leaving the free/trial tier gives you access to a much larger pool of instances. I never successfully deployed an A1 instance prior to becoming a "paying" customer - now I've done it hundreds of times without ever having an issue. I've been running a small k0s cluster and a standalone webserver for months while incurring about $2.50 - $3 in spending each month, primarily from being slow to remove instance snapshots sitting in block storage. Even things that are oddly expensive on AWS - like NAT - are free on Oracle. There are zero gotchas.

k_bx 11mo ago

$3 VPS running Headscale is not simpler since you won't be able to run both headscale and tailscale on your end user machines, I don't recommend it. The solution we've found is running a white IP container (or VPS) which looks like regular Wireguard outside, while inside it "forwards" to your existing tailscale network. I don't remember if we use https://github.com/gravitl/netmaker https://github.com/gravitl/netmaker or https://github.com/juhovh/tailguard https://github.com/juhovh/tailguard Also see: https://tailscale.com/blog/peer-relays-beta https://tailscale.com/blog/peer-relays-beta

zrail 11mo ago

Tailscale has what they call Peer Relays now to help solve this problem: https://tailscale.com/blog/peer-relays-beta https://tailscale.com/blog/peer-relays-beta

codethief 11mo ago

What does Headscale have to do with NAT hole punching? I believe what you actually mean is setting up a relay, see the link in https://news.ycombinator.com/item?id=45948806 https://news.ycombinator.com/item?id=45948806 .