5 ms·

Show HN: Netrinos – A keep it simple Mesh VPN for small teams

93 points by pcarroll 10mo ago

I'm the founder at Netrinos. I built a WireGuard-based mesh VPN because remote access has always been a pain. After years of SSH tunnels, IPsec headaches, and the ssh log horror movie, I wanted something simpler: install, sign in, get work done. Netrinos creates a LAN-like overlay network across your devices. Connections are direct P2P via WireGuard, with no central server routing traffic. Each device gets a stable IP and DNS name (pc.you.netrinos.com). When direct connections fail, they fall back to a relay server that's still encrypted end-to-end. We can't see your traffic. The most challenging problem to solve was NAT traversal. UDP hole punching works most of the time. The rest is a cocktail of symmetric NAT, CGNAT, and serial NATs. We use STUN-style discovery and relay fallback for the edge cases. I was surprised by how unreliable low-end ISP routers really are, and how much technical wizardry it takes to hide that behind a clean, simple UX. Our stack is a Go backend for client and server, WireGuard kernel mode for Linux and Windows (macOS is userspace), Wails.io for cross-platform UI. WireGuard does all the heavy lifting. Go ties it all together. Popular use cases include: RDP to home PCs, accessing NAS without exposing it, and SSH into headless Linux boxes. One customer manages hundreds of IoT devices in the field, eliminating the need to deal with customer routers. We just released Pro with multi-user, access control, and remote gateway routing. Personal is free (up to 100 devices). I'd love to hear what you expect from a simple mesh VPN, what's missing from current tools, and what's lacking from your remote access setup. Use code HNPRO26 for a 30-day trial of Pro. https://netrinos.com https://netrinos.com

dewey 10mo ago
What's the main differentiator between Tailscale and Netrinos? Edit: Just found this post https://netrinos.com/blog/tailscale-alternatives-2025 https://netrinos.com/blog/tailscale-alternatives-2025, so it looks like main differentiator is pricing right now.
- felixg3 10mo ago
  You again under the posts that tickle my fancy…
- sh3rl0ck 10mo ago
  One's banned in my hostel because of a stupid sysadmin. One isn't.
  - bongodongobob 10mo ago
    Not allowing random VPN connections on a LAN is pretty standard. I've been surprised at how many people here are able to use tailscale and the like. Guessing it's just because there are likely smaller teams here that don't have any kind of managed network.
    - antonvs 10mo ago
      Smaller teams, yes, but also it seems as though the SaaS explosion has led to many enterprises significantly relaxing the "hardness" of their network boundaries, at least when it comes to integration with companies whose services they depend on. I've seen Tailscale and tools like ngrok being approved to get into large enterprises who you might think wouldn't allow it. Some of these enterprises will set up a bastion in a DMZ to control that, but I've been surprised by how many don't do that. That relaxation tends to have ripple effects - once you allow tunneling tools in for one purpose - like SaaS integration - then it becomes more normalized and people start using it for other purposes.
    - observationist 10mo ago
      Someone is making your IT team do extra work without a good understanding of their systems if they're banning tailscale or granting special network level access thinking that ip or mac address based profiling is secure. Your network should be zero trust. That means you want to treat every host that connects as if it's on the public internet; the corollary to that is you should give your hosts access to the public internet, unrestricted, and treat your users like adults who don't need micromanaging or constant surveillance (do sane logging, ofc.) If you need a host that's subject to continuous surveillance, design it as such and require remote access with MFA, and so on. Give your end users as much freedom as possible, and only constrict it where necessary, or you're going to incentivize shadow IT, unintended consequences, and a whole lot of unnecessary make-work that doesn't contribute to security. Unrestricted access forces change management, design choices, and policy to confront each user and device for the attack vector they are, and to behave accordingly.
- Daniel_31 10mo ago
  [dead]
felixg3 10mo ago
I really like your fair differentiation and feature comparison vs Tailscale, netbird etc. Love to see the ecosystem of wireguard based services growing into different business segments, i.e. you targeting SMBs/small teams. Not for me, but legitimate use case and product :)
- subscribed 10mo ago
  Exactly, same sentiment here.
Can_K 10mo ago
Full disclaimer: huge Linux fanboy here. Not really related to the product itself, but your landing page design looks close to the official Microsoft style which I dont have the best memories of.. It might be intentional to show the "seamless integration" to Windows users but my penguin loving soul got scared!
- pcarroll 10mo ago
  Thanks for that feedback. I share your feelings about Linux. It never occurred to us that it would be reminiscent of old MS days. We were going for "clean and uncluttered". If it makes you feel better, all core development for Netrinos is done on Linux. Then, the code is adapted to work on macOS and Windows. Almost all of the code is cross-platform, including the UI. Only the implementation details are platform specific. e.g. Linux uses nftables. MacOS uses pfctl. Windows, we had to write our own packet filter to avoid touching the often misconfigured Windows Firewall.
tjfl 10mo ago
The GitHub link on your website is 404 (https://github.com/netrinosnetwork https://github.com/netrinosnetwork)
- indianmouse 10mo ago
  Yep. Stating Github and providing a non existent Github link is a serious redflag which brings trust issues. Either provide the Github (for whatever reasons) or remove the link from your website. I am assuming it is closed source. Personally I don't trust new VPN solutions without published source code! Alternatives: Tailscale with Headscale or better Self-hosted Netbird if one is a itty-bitty IT savvy. Netbird (self-hosted) offers a lot lot more with the self-hosted solution. - SSO - Independent networks - Superb policies / ACLs - Keybased onboarding - auto-expiration and a lot more like integrations and what not! Tough to beat the Netbird Open source offering if one tends to spent a little time and effort (though not everyone's cup of coffee!) Such can look at tailscale's offering since the free version of Tailscale offers more than what is offered here and all the client applications are open source and constantly updated. If pricing is going to the only difference, (at a high level, everything under the hood looks similar - wireguard based, zero config, p2p mesh, port forwarding etc etc.,) bring a lot more trust by offering an open source version like others.
- mythoughtsexact 10mo ago
  https://headscale.net/stable/ https://headscale.net/stable/
nickorlow 10mo ago
Seems similar in purpose to https://vpncloud.ddswd.de/ https://vpncloud.ddswd.de/
- nickorlow 10mo ago
  (above is very easy to use and works very well w/ my experience) Only downsides are no mobile support & seems to be somewhat abandoned
wolrah 10mo ago
The "No IT Department" part of your marketing immediately turns me off because that's actively encouraging "shadow IT". We all get that sometimes companies have IT policies which are outdated and get in the way, but that's a problem for someone up the chain to solve. A team or department deciding to just start doing their own thing with something like this which isn't managed by or even known about by the official company IT is at best a path to future problems if not an immediate compliance problem.
- boplicity 10mo ago
  Compliance, "up the chain", "department", "the official company IT", etc... These are all things that the target audience either doesn't have, or doesn't want. If the above words are important to you, then you're probably not in the target market.
- YJfcboaDaJRDw 10mo ago
  [dead]
- idiotsecant 10mo ago
  IT is sometimes dysfunctional and management doesn't care.
- mbreese 10mo ago
  Or it’s a small enough company without an IT department. Think of an SMB where you might know you need to do something (like connect a new store location to the server in your main location’s closet), but don’t know how or can’t afford to hire an IT person full time. This is probably the main market for this. Then once you get more buy in, experience, and reputation, this VPN could stay to see larger clients. That’s at least how I’d expect to see this grow.
ImPleadThe5th 10mo ago
Can anyone explain to me (someone not so network security savvy) if there are any privacy or security concerns using a wire guard provider like this? As I understand it, with traditional VPNs, you basically have to trust third-party audits to verify the VPN isn't logging all traffic and selling it. Does the WireGuard protocol address theses issues? Or is there still the same risk as a more traditional VPN provider?
- jscd 10mo ago
  This is not providing the same functionality as a "traditional VPN," in the sense that it does not do anything to your traffic going to the wider internet. With popular VPN services, they are an encrypted tunnel for all your internet traffic (some use the same protocol, WireGuard), but at the end of the tunnel they decrypt the message and send it to whatever website you requested, which is exactly what can cause those privacy issues you describe. In this case, though, it creates an encrypted tunnel _only between your own devices_. This allows you to connect to all your devices, home desktop, phone, laptop, as if they were on the same network, allowing you to do fairly sensitive things like remote desktop without having to expose your machine to the public internet or deal with firewall rules in the same way. Assuming this project is legitimate, then the only traffic this service would even touch would be those between your own devices, nothing related to public internet requests. And, on top of that, the requests should be encrypted the entire way, inaccessible to any devices other than the ones sending and receiving the requests. There are many caveats and asterisks I could add, but I think that's a fairly straightforward summary.
- pcarroll 10mo ago
  To clarify, one of the big advantages of a Mesh VPN is that the traffic does not flow through the VPN provider at all. WireGuard encrypts the traffic from device interface to device interface. The connections are point-to-point and not hub-and-spoke. This is both faster and more secure. If a direct connection cannot be established due to a very restrictive firewall or a messed-up ISP modem, it will fall back to a relay server. But in that case, the relay relays the traffic, but it does not have the keys to read it. You can learn more here: https://www.wireguard.com/ https://www.wireguard.com/ TL;DR WireGuard itself is a relatively small project at roughly 4,000 lines of code. It has been thoroughly audited and is even built into the Linux kernel.
ImPleadThe5th 10mo ago
Naive question here: with WireGuard VPN, does all traffic route through the VPN or only those packets bound for the other devices in the mesh?
- pcarroll 10mo ago
  WireGuard itself can be configured to work either way. Our target market is smaller teams and people with limited IT skills. So, we chose not to send all traffic through the vpn. The only traffic going through the VPN is traffic to and from your other devices (in your account). Internet access is still through your default network. In the Pro version, you can route specific destinations through other peers, also belonging to you. An example use case here would be accessing your web banking while on vacation in a distant country. You would route your bank website through your home connection. Similarly, our access control is only restricting traffic that comes from your devices on the wireguard network. We do not interfere with the settings of your own personal firewall.
  - ImPleadThe5th 10mo ago
    Thanks for taking the time to answer! I think I'll be giving this a shot for some upcoming projects.
- infogulch 10mo ago
  For WireGuard in general, you provide it an AllowedIPs config which is a list of CIDR ranges that should be routed across the link. That could be `0.0.0.0/0` (aka everything), a single subnet, a union of several, or even individual IPs. This config is technically symmetric between the endpoints, though a prototypical implementation of "individual clients enable the VPN to access the internal network" may limit the "client" AllowedIPs to an individual address.
nodesocket 10mo ago
I use Twingate both for personal use (my home) and to access AWS EC2 servers (no public ips) and really love it. Very polished, easy setup. How does Netrinos compare?
- pcarroll 10mo ago
  We do have some comparisons on our site... https://netrinos.com/compare https://netrinos.com/compare Thanks
cboyardee 10mo ago
[dead]
focusgroup0 10mo ago
>We use STUN-style discovery and relay fallback How does your relay compare to Tailscale's (DERP)?
- deleted 10mo ago
  [deleted]
- pcarroll 10mo ago
  We implement STUN and TURN functionality natively in WireGuard rather than using separate protocols. Netrinos uses a central rendezvous server that participates in WireGuard handshakes solely to collect your devices' public endpoints and share that information with your other devices. When a device roams to a new location, the server learns the new endpoint and updates the other devices in your account. When direct P2P fails, Netrinos connections fall back to a relay server. The relay is a WireGuard peer, but it can only relay traffic between peers in your account. All customer accounts are strictly firewalled from each other. If you want more control, you can enable a device in your account as a relay server with a checkbox in the app. This could be a home PC with a stable connection or a low-cost cloud server.
Daniel_31 10mo ago
[dead]
Daniel_31 10mo ago
[dead]
windexh8er 10mo ago
Well, I wish you the best with this - but I really don't understand the target market. The obvious competitor here is Tailscale. But let's say, reasons, and Tailscale isn't an option. Then you go down the path... TwinGate, Teleport, Netbird, Pomerium, Netmaker, ZeroTier, etc... Even the initial pricing and free tier are you're up against are going to mostly be a deal breaker compared to what's out there. Trusting a VPN provider is a lot. If you're running the control plane - why should I trust Netrinos?
- atmosx 10mo ago
  Isn’t that true for any new service out there? What’s the market for a search engine? And yet kagi.com is a thing.
  - dewey 10mo ago
    That's a very weird comparison...as the market for a search engine is basically every internet user. A networking overlay for technical users is a much smaller market.
    - atmosx 10mo ago
      You mean that going against Google is easier than going against a small company like Tailscale? I doubt it.
- j45 10mo ago
  Kind of confusing to expect zero competition for a valid opportunity, then you're a category founder with an uphill battle to educate the customer for free, fail, and let the next co swoop in.
  - windexh8er 10mo ago
    I never said there shouldn't be competition. What I implied is that Netrinos looks to be deficient in features and also has no market trust. My question was sincere: why should I trust them? This is a VPN.
mrbluecoat 10mo ago
Any plans for Exit Node capability (traditional egress VPN)?
- pcarroll 10mo ago
  Pro has that. We call it a Gateway. See: https://netrinos.com/help/gateways-routing https://netrinos.com/help/gateways-routing You can also have multiple gateways and send traffic through different locations. e.g. You can access a NAS on one site and a website through another.
drcongo 10mo ago
I only use Tailscale for two features - one is having every machine on the network use a logical name of the pattern {projectname}-{environment} ie: `ssh me@hn-prd` and the other is exit nodes. I couldn't work out from your site if either of these two things is doable here.
- pcarroll 10mo ago
  Each device on your account gets a private static IP address in the network 100.x.x.x. The name is static as long as the device lives on your account. Each also gets a friendly DNS name in the form device.account.2ho.ca (try finding a short domain these days). So yes, you can... $ ssh user@server.myaccount.2ho.ca C:\ net use S: \\server.myaccount.2ho.ca\Home etc.
  - Grimblewald 10mo ago
    Well, given you can set your vpn server to also relay dns requests, and have that same server resolve any *.myspecialtld requests makes that a breeze. I run a whole invite only "internet" of sorts doing this with a plain wireguard server (video streaming, webmail, chatbot, personal websites, forums etc) finding a short domain is easy as pie.
  - drcongo 10mo ago
    Ah, that's a shame - my OCD loves the short, domainless names we get on Tailscale.
    - pcarroll 10mo ago
      Maybe I should look into that... there are a few different ways to do it, and none of them are all that hard. - i just put it in the roadmap
      - drcongo 10mo ago
        Amazing. Is there somewhere we can view / follow the roadmap?
anonzzzies 10mo ago
Is there something like tailgate (or this) with only cli (I much dislike tailgate gui stuff on mac/win, on mobile its kind of needed) and you own small connection gateway on your own vps? I know tailgate has an open source implementation but I could not get that working while bored at the airport so that's not simple enough (the thing is enormous as well while it should just 'handshake' and that's it right?).
- pcarroll 10mo ago
  Netrinos can be entirely cli on all 3 platforms. If you install the OpenSSH server on Windows, you can manage Netrinos in a terminal, just like on Linux or Mac. e.g. https://netrinos.com/cdn/images/screens/windows-terminal.png https://netrinos.com/cdn/images/screens/windows-terminal.png https://netrinos.com/cdn/images/screens/linux-terminal.png https://netrinos.com/cdn/images/screens/linux-terminal.png On a trip to Europe last year, I tried it from the Air Canada in-flight WiFi somewhere over Iceland. I was able to RDP to my desktop at home, then RDP right back to my laptop on the plane. Performance wasn't great. And it's not a terribly useful use case. But it did work. Wireguard deserves a lot of credit there. No ports were opened on my home end. And who knows what the plane has for NAT.
Daniel_31 10mo ago
[dead]
pcarroll 10mo ago
Thanks to everybody who participated. This has been an excellent discussion and has resulted in some interesting ideas to pursue.

93 points by pcarroll 10mo ago

dewey 10mo ago

What's the main differentiator between Tailscale and Netrinos? Edit: Just found this post https://netrinos.com/blog/tailscale-alternatives-2025 https://netrinos.com/blog/tailscale-alternatives-2025, so it looks like main differentiator is pricing right now.

felixg3 10mo ago
You again under the posts that tickle my fancy…
sh3rl0ck 10mo ago
One's banned in my hostel because of a stupid sysadmin. One isn't.
- bongodongobob 10mo ago
  Not allowing random VPN connections on a LAN is pretty standard. I've been surprised at how many people here are able to use tailscale and the like. Guessing it's just because there are likely smaller teams here that don't have any kind of managed network.
  - antonvs 10mo ago
    Smaller teams, yes, but also it seems as though the SaaS explosion has led to many enterprises significantly relaxing the "hardness" of their network boundaries, at least when it comes to integration with companies whose services they depend on. I've seen Tailscale and tools like ngrok being approved to get into large enterprises who you might think wouldn't allow it. Some of these enterprises will set up a bastion in a DMZ to control that, but I've been surprised by how many don't do that. That relaxation tends to have ripple effects - once you allow tunneling tools in for one purpose - like SaaS integration - then it becomes more normalized and people start using it for other purposes.
  - observationist 10mo ago
    Someone is making your IT team do extra work without a good understanding of their systems if they're banning tailscale or granting special network level access thinking that ip or mac address based profiling is secure. Your network should be zero trust. That means you want to treat every host that connects as if it's on the public internet; the corollary to that is you should give your hosts access to the public internet, unrestricted, and treat your users like adults who don't need micromanaging or constant surveillance (do sane logging, ofc.) If you need a host that's subject to continuous surveillance, design it as such and require remote access with MFA, and so on. Give your end users as much freedom as possible, and only constrict it where necessary, or you're going to incentivize shadow IT, unintended consequences, and a whole lot of unnecessary make-work that doesn't contribute to security. Unrestricted access forces change management, design choices, and policy to confront each user and device for the attack vector they are, and to behave accordingly.
Daniel_31 10mo ago
[dead]

felixg3 10mo ago

I really like your fair differentiation and feature comparison vs Tailscale, netbird etc. Love to see the ecosystem of wireguard based services growing into different business segments, i.e. you targeting SMBs/small teams. Not for me, but legitimate use case and product :)

subscribed 10mo ago
Exactly, same sentiment here.

Can_K 10mo ago

Full disclaimer: huge Linux fanboy here. Not really related to the product itself, but your landing page design looks close to the official Microsoft style which I dont have the best memories of.. It might be intentional to show the "seamless integration" to Windows users but my penguin loving soul got scared!

pcarroll 10mo ago
Thanks for that feedback. I share your feelings about Linux. It never occurred to us that it would be reminiscent of old MS days. We were going for "clean and uncluttered". If it makes you feel better, all core development for Netrinos is done on Linux. Then, the code is adapted to work on macOS and Windows. Almost all of the code is cross-platform, including the UI. Only the implementation details are platform specific. e.g. Linux uses nftables. MacOS uses pfctl. Windows, we had to write our own packet filter to avoid touching the often misconfigured Windows Firewall.

tjfl 10mo ago

The GitHub link on your website is 404 (https://github.com/netrinosnetwork https://github.com/netrinosnetwork)

indianmouse 10mo ago
Yep. Stating Github and providing a non existent Github link is a serious redflag which brings trust issues. Either provide the Github (for whatever reasons) or remove the link from your website. I am assuming it is closed source. Personally I don't trust new VPN solutions without published source code! Alternatives: Tailscale with Headscale or better Self-hosted Netbird if one is a itty-bitty IT savvy. Netbird (self-hosted) offers a lot lot more with the self-hosted solution. - SSO - Independent networks - Superb policies / ACLs - Keybased onboarding - auto-expiration and a lot more like integrations and what not! Tough to beat the Netbird Open source offering if one tends to spent a little time and effort (though not everyone's cup of coffee!) Such can look at tailscale's offering since the free version of Tailscale offers more than what is offered here and all the client applications are open source and constantly updated. If pricing is going to the only difference, (at a high level, everything under the hood looks similar - wireguard based, zero config, p2p mesh, port forwarding etc etc.,) bring a lot more trust by offering an open source version like others.
mythoughtsexact 10mo ago
https://headscale.net/stable/ https://headscale.net/stable/

nickorlow 10mo ago

Seems similar in purpose to https://vpncloud.ddswd.de/ https://vpncloud.ddswd.de/

nickorlow 10mo ago
(above is very easy to use and works very well w/ my experience) Only downsides are no mobile support & seems to be somewhat abandoned

wolrah 10mo ago

The "No IT Department" part of your marketing immediately turns me off because that's actively encouraging "shadow IT". We all get that sometimes companies have IT policies which are outdated and get in the way, but that's a problem for someone up the chain to solve. A team or department deciding to just start doing their own thing with something like this which isn't managed by or even known about by the official company IT is at best a path to future problems if not an immediate compliance problem.

boplicity 10mo ago
Compliance, "up the chain", "department", "the official company IT", etc... These are all things that the target audience either doesn't have, or doesn't want. If the above words are important to you, then you're probably not in the target market.
YJfcboaDaJRDw 10mo ago
[dead]
idiotsecant 10mo ago
IT is sometimes dysfunctional and management doesn't care.
mbreese 10mo ago
Or it’s a small enough company without an IT department. Think of an SMB where you might know you need to do something (like connect a new store location to the server in your main location’s closet), but don’t know how or can’t afford to hire an IT person full time. This is probably the main market for this. Then once you get more buy in, experience, and reputation, this VPN could stay to see larger clients. That’s at least how I’d expect to see this grow.

ImPleadThe5th 10mo ago

Can anyone explain to me (someone not so network security savvy) if there are any privacy or security concerns using a wire guard provider like this? As I understand it, with traditional VPNs, you basically have to trust third-party audits to verify the VPN isn't logging all traffic and selling it. Does the WireGuard protocol address theses issues? Or is there still the same risk as a more traditional VPN provider?

jscd 10mo ago
This is not providing the same functionality as a "traditional VPN," in the sense that it does not do anything to your traffic going to the wider internet. With popular VPN services, they are an encrypted tunnel for all your internet traffic (some use the same protocol, WireGuard), but at the end of the tunnel they decrypt the message and send it to whatever website you requested, which is exactly what can cause those privacy issues you describe. In this case, though, it creates an encrypted tunnel _only between your own devices_. This allows you to connect to all your devices, home desktop, phone, laptop, as if they were on the same network, allowing you to do fairly sensitive things like remote desktop without having to expose your machine to the public internet or deal with firewall rules in the same way. Assuming this project is legitimate, then the only traffic this service would even touch would be those between your own devices, nothing related to public internet requests. And, on top of that, the requests should be encrypted the entire way, inaccessible to any devices other than the ones sending and receiving the requests. There are many caveats and asterisks I could add, but I think that's a fairly straightforward summary.
pcarroll 10mo ago
To clarify, one of the big advantages of a Mesh VPN is that the traffic does not flow through the VPN provider at all. WireGuard encrypts the traffic from device interface to device interface. The connections are point-to-point and not hub-and-spoke. This is both faster and more secure. If a direct connection cannot be established due to a very restrictive firewall or a messed-up ISP modem, it will fall back to a relay server. But in that case, the relay relays the traffic, but it does not have the keys to read it. You can learn more here: https://www.wireguard.com/ https://www.wireguard.com/ TL;DR WireGuard itself is a relatively small project at roughly 4,000 lines of code. It has been thoroughly audited and is even built into the Linux kernel.

ImPleadThe5th 10mo ago

Naive question here: with WireGuard VPN, does all traffic route through the VPN or only those packets bound for the other devices in the mesh?

pcarroll 10mo ago
WireGuard itself can be configured to work either way. Our target market is smaller teams and people with limited IT skills. So, we chose not to send all traffic through the vpn. The only traffic going through the VPN is traffic to and from your other devices (in your account). Internet access is still through your default network. In the Pro version, you can route specific destinations through other peers, also belonging to you. An example use case here would be accessing your web banking while on vacation in a distant country. You would route your bank website through your home connection. Similarly, our access control is only restricting traffic that comes from your devices on the wireguard network. We do not interfere with the settings of your own personal firewall.
- ImPleadThe5th 10mo ago
  Thanks for taking the time to answer! I think I'll be giving this a shot for some upcoming projects.
infogulch 10mo ago
For WireGuard in general, you provide it an AllowedIPs config which is a list of CIDR ranges that should be routed across the link. That could be `0.0.0.0/0` (aka everything), a single subnet, a union of several, or even individual IPs. This config is technically symmetric between the endpoints, though a prototypical implementation of "individual clients enable the VPN to access the internal network" may limit the "client" AllowedIPs to an individual address.

nodesocket 10mo ago

I use Twingate both for personal use (my home) and to access AWS EC2 servers (no public ips) and really love it. Very polished, easy setup. How does Netrinos compare?

pcarroll 10mo ago
We do have some comparisons on our site... https://netrinos.com/compare https://netrinos.com/compare Thanks

cboyardee 10mo ago

[dead]

focusgroup0 10mo ago

>We use STUN-style discovery and relay fallback How does your relay compare to Tailscale's (DERP)?

deleted 10mo ago
[deleted]
pcarroll 10mo ago
We implement STUN and TURN functionality natively in WireGuard rather than using separate protocols. Netrinos uses a central rendezvous server that participates in WireGuard handshakes solely to collect your devices' public endpoints and share that information with your other devices. When a device roams to a new location, the server learns the new endpoint and updates the other devices in your account. When direct P2P fails, Netrinos connections fall back to a relay server. The relay is a WireGuard peer, but it can only relay traffic between peers in your account. All customer accounts are strictly firewalled from each other. If you want more control, you can enable a device in your account as a relay server with a checkbox in the app. This could be a home PC with a stable connection or a low-cost cloud server.

Daniel_31 10mo ago

[dead]

Daniel_31 10mo ago

[dead]

windexh8er 10mo ago

Well, I wish you the best with this - but I really don't understand the target market. The obvious competitor here is Tailscale. But let's say, reasons, and Tailscale isn't an option. Then you go down the path... TwinGate, Teleport, Netbird, Pomerium, Netmaker, ZeroTier, etc... Even the initial pricing and free tier are you're up against are going to mostly be a deal breaker compared to what's out there. Trusting a VPN provider is a lot. If you're running the control plane - why should I trust Netrinos?

atmosx 10mo ago
Isn’t that true for any new service out there? What’s the market for a search engine? And yet kagi.com is a thing.
- dewey 10mo ago
  That's a very weird comparison...as the market for a search engine is basically every internet user. A networking overlay for technical users is a much smaller market.
  - atmosx 10mo ago
    You mean that going against Google is easier than going against a small company like Tailscale? I doubt it.
j45 10mo ago
Kind of confusing to expect zero competition for a valid opportunity, then you're a category founder with an uphill battle to educate the customer for free, fail, and let the next co swoop in.
- windexh8er 10mo ago
  I never said there shouldn't be competition. What I implied is that Netrinos looks to be deficient in features and also has no market trust. My question was sincere: why should I trust them? This is a VPN.

mrbluecoat 10mo ago

Any plans for Exit Node capability (traditional egress VPN)?

pcarroll 10mo ago
Pro has that. We call it a Gateway. See: https://netrinos.com/help/gateways-routing https://netrinos.com/help/gateways-routing You can also have multiple gateways and send traffic through different locations. e.g. You can access a NAS on one site and a website through another.

drcongo 10mo ago

I only use Tailscale for two features - one is having every machine on the network use a logical name of the pattern {projectname}-{environment} ie: `ssh me@hn-prd` and the other is exit nodes. I couldn't work out from your site if either of these two things is doable here.

pcarroll 10mo ago
Each device on your account gets a private static IP address in the network 100.x.x.x. The name is static as long as the device lives on your account. Each also gets a friendly DNS name in the form device.account.2ho.ca (try finding a short domain these days). So yes, you can... $ ssh user@server.myaccount.2ho.ca C:\ net use S: \\server.myaccount.2ho.ca\Home etc.
- Grimblewald 10mo ago
  Well, given you can set your vpn server to also relay dns requests, and have that same server resolve any *.myspecialtld requests makes that a breeze. I run a whole invite only "internet" of sorts doing this with a plain wireguard server (video streaming, webmail, chatbot, personal websites, forums etc) finding a short domain is easy as pie.
- drcongo 10mo ago
  Ah, that's a shame - my OCD loves the short, domainless names we get on Tailscale.
  - pcarroll 10mo ago
    Maybe I should look into that... there are a few different ways to do it, and none of them are all that hard. - i just put it in the roadmap
    - drcongo 10mo ago
      Amazing. Is there somewhere we can view / follow the roadmap?

anonzzzies 10mo ago

Is there something like tailgate (or this) with only cli (I much dislike tailgate gui stuff on mac/win, on mobile its kind of needed) and you own small connection gateway on your own vps? I know tailgate has an open source implementation but I could not get that working while bored at the airport so that's not simple enough (the thing is enormous as well while it should just 'handshake' and that's it right?).

pcarroll 10mo ago
Netrinos can be entirely cli on all 3 platforms. If you install the OpenSSH server on Windows, you can manage Netrinos in a terminal, just like on Linux or Mac. e.g. https://netrinos.com/cdn/images/screens/windows-terminal.png https://netrinos.com/cdn/images/screens/windows-terminal.png https://netrinos.com/cdn/images/screens/linux-terminal.png https://netrinos.com/cdn/images/screens/linux-terminal.png On a trip to Europe last year, I tried it from the Air Canada in-flight WiFi somewhere over Iceland. I was able to RDP to my desktop at home, then RDP right back to my laptop on the plane. Performance wasn't great. And it's not a terribly useful use case. But it did work. Wireguard deserves a lot of credit there. No ports were opened on my home end. And who knows what the plane has for NAT.

Daniel_31 10mo ago

[dead]

pcarroll 10mo ago

Thanks to everybody who participated. This has been an excellent discussion and has resulted in some interesting ideas to pursue.