4 ms·

I traced my traffic through a home Tailscale exit node

gsmiznith 7mo ago
Interesting article; do you have any details on the performance differences?
- stonecharioteer 7mo ago
  Differences between openvpn and tailscale exit nodes? I can run some tests this weekend.
devilbunny 7mo ago
Tailscale has another interesting feature that I figured out entirely by accident: while the SSO planes (at least using Apple as SSO, rather than your own) may be blocked, the data planes and actual control planes usually are not. If your device is connected to your tailnet before joining a given WiFi, it will stay connected afterward. The guest WiFi at work blocks OpenVPN connections, but established Tailscale slips by. I haven't tried straight Wireguard because I don't consider Tailscale having timing and volume data on me to be all that valuable to them, and they do mitigate the double-NAT situation. I do run a private peer relay for my tailnet but not a full DERP server, nor do I run Headscale. Obviously, your personal security concerns play a role here, but I'm not doing anything I wouldn't do straight from my home network, so I see no reason to make my life harder. If you need that level of security, you need a different solution.
- stonecharioteer 7mo ago
  Wait, tailscale survives connecting to a locked down wifi? That's insane. I remember not being able to use NordVPN at work. I'd just switch to 4G back then. But if you can't initiate a tailscale connection when connected to the office wifi, what does that mean?
  - devilbunny 7mo ago
    Initiate while on mobile connection or tethered to one (or just leave it connected from home), use while on that WiFi. EDIT: I figured this out because I brought my laptop from home to do a few things while at work that needed it. I noticed that my Tailscale connection (initially established at home) was working just fine. That's when I realized that it was the initial authentication that was blocked, not the service. My phone is usually on my tailnet and my iPad is always on it (and using my home exit node), as a result. Using the exit node has a modest but noticeable effect on battery life, but just being connected is maybe 2% of battery a day. Negligible.
  - blactuary 7mo ago
    When I work at the local coffee shop I cannot SSH to my remote servers for work on their wifi, but if I connect to Tailscale and use my exit node at home I can. Lifesaver
  - zrail 7mo ago
    I think this is mostly a Wireguard thing and not specifically a Tailscale thing. Wireguard does what they call "cryptokey routing" where if you prove you possess a key that the other peer knows, you get the traffic (subject to firewall, allowed IPs list, etc etc). Wireguard stores the most recent address:port that it heard from a particular cryptokey on, but it natively lets peers roam, as long as only one roams at a time.
- gpm 7mo ago
  While waiting for someone in the hospital I recently played the fun game of "how can I work around their firewall stopping me from connecting to tailscale" that they kindly provided. It was just blocking new connections. Via SNI. Tailscale's control plane turn out not to care if SNI is sent. Tailscale's app let you set a custom control plane... like a local proxy that forwards connections to tailscale's servers without setting SNI.
  - devilbunny 7mo ago
    This may very well be the system in use. I've seen this effect in several places, not just my work. Of note: I do not work in the tech sphere. I suspect that this particular loophole may be used by IT personnel to be able to tell the management "yes, we block VPN use" while letting them continue to use their own VPNs. I see no reason to complain.
    - gpm 7mo ago
      I suspect there's less thought put into it than that. There's probably a firewall vendor that has a product that does SNI inspection for blocking things like pornhub and the product comes with a list of sites that includes VPN control planes.
      - devilbunny 7mo ago
        Well, yeah, they didn't roll their own. Offhand, I forget the product, but it's definitely off the shelf. My point being that surely some of them have noticed the same thing I have, and it hasn't been stopped. I'm not going to raise the issue either way.
        dylan604 7mo ago
        > I'm not going to raise the issue either way. Except, you kinda just did
        devilbunny 7mo ago
- mrsssnake 7mo ago
  My work guest WiFi network allows only IPv4 HTTPS on port 443 and their their own DNS. Everything else, including ICMP (ping) is blocked. Tailscale barely works as any persistant connection is dropped after 2-3 minutes. Called this out and the security team said noone complains, that there is no use case and they do not want to deal with security risks. And the ossification continues.
  - dheera 7mo ago
    A TCP over websockets VPN would be fairly simple to write, or ask an AI to write for you
  - justsomehnguy 7mo ago
    > IPv4 HTTPS on port 443 TCP or TCP and UDP? SSTP can work if they don't look at the traffic too hard.
  - lostlogin 7mo ago
    > Called this out and the security team said noone complains Classic. And this probably works do every complaint. You need an irritated executive.
comrade1234 7mo ago
Tailscale is interesting. It's built on top of wiregaurd but is different in that it creates a mesh of vpn connections between your devices, rather than just a connection from client to server. I haven't used it because I use witeguard the traditional way and haven't needed a mesh of devices. Also I haven't taken time to investigate the private company offering it and what sorts of my information is vulnerable if I use it.
- socalgal2 7mo ago
  This is my question too... It's concerning to me that everyone one seems to be using tailscale (and maybe cloudflare access) and that I don't see mention of open source alternatives. I'm sure for some network experts the alternatives are obvious? Setup a server somewhere publically available that runs ??? and have it be your auth/rendezvous server. people complain about github being proprietary but I haven't seen much complaint about tailscale being proprietary. I assume I'm just being overly paranoid? It's certainly convenient to just sign up and have things just work.
  - giobox 7mo ago
    There is a well documented opensource alternative to Tailscale - Headscale. The tailscale client is already opensource, Headscale is opensource drop in replacement for the control server which isn't, and fully compatible with Tailscale clients: https://github.com/juanfont/headscale https://github.com/juanfont/headscale If you can be bothered running the headscale container, you generally don't need to pay for tailscale. It's been pretty well supported and widely used for a number of years at this point. Tailscale even permit their own engineers to contribute to headscale, as the company sees it as complimentary to the commercial offering.
    - kurante 7mo ago
      > Headscale is ... drop in replacement I've been really happy with headscale, but I wouldn't call it a complete drop in replacement as I would with vaultwarden. Some features (e.g. Mullvad integration, ACL tests, etc) are missing. Upgrading also requires upgrading every minor version or you run into db migration issues, but that comes with the territory of running your own instance. I would recommend folks look up if headscale suits their needs (like it did for me for many years) before switching over.
mightyham 7mo ago
Genuinely curious: is Tailscale actually providing any values to this use case beyond what you get from a raw Wiregaurd exit node with port forwarding instead of Tailscale's NAT traversal? I've never used Tailscale, but I have a Wiregaurd setup on my home server for the same purpose as described in the article, and I've never had any issues with it. Edit: Noticed some sibling comments asking effectively the same thing as me. I've been meaning to write a blog post covering the basic networking knowledge needed to DIY with just Wiregaurd. My impression is that many people don't realize just how easy it is or don't have the requisite background information.
- nighthawk454 7mo ago
  It has plenty of useful control plane features out of the box. Nothing much you _couldn’t_ do yourself but you don’t have to. Or with Headscale as the self-hosted open-source version
- f33d5173 7mo ago
  Dynamic IP addresses.
  - ectospheno 7mo ago
    Update your DNS when it changes. Pretty trivial.
    - f33d5173 7mo ago
      Yeah I tried writing a script for that, but at a certain point using an off the shelf tool that does everything is easier.
- pkulak 7mo ago
  If you're just doing hub-and-spoke anyway, yeah, you can do it yourself. I did for years. But holy smokes, is it a PITA to manually copy keys around to devices; especially when they might not even be yours. I have my Tailscale account hooked up to my self-hosted identity server and now it's just a matter of logging in on whatever device I want to be on the network. Plus, I have the option of spinning up a random EC2 box whenever I want and instantly joining it to the network with basically no fuss.
MysticOracle 7mo ago
Tailscale tangential use case! :) I was looking for remote access software to help family with their PC and came across RustDesk(https://rustdesk.com/ https://rustdesk.com/) but it needs a server. Found out it can work without a server if you have Tailscale installed. No fees for any of this and works on many platforms. Tutorial for Rustdesk + Tailscale setup for remote desktop access: https://www.youtube.com/watch?v=27apZcZrwks https://www.youtube.com/watch?v=27apZcZrwks
- jbverschoor 7mo ago
  How does it compare to jump desktop
- stonecharioteer 7mo ago
  Oh lovely. How is your experience with RustDesk? Is it better than VNC?
  - raihansaputra 7mo ago
    my experience with RustDesk + Tailscale is really good. when i only needed windows remote devices, the Windows Remote Desktop over Tailscale is great. I used RustDesk for access to macOS and Android devices (all over Tailscale) and works great too. No complaints really. Much less hassle to setup than Parsec (latency isn't as good though), and way snappier than AnyDesk through their network. Great tool enabled by Tailscale.
  - znnajdla 7mo ago
    +1 for RustDesk over Tailscale. It works even better than Screens for macOS.
  - KronisLV 7mo ago
    Been using it for a while, older versions had memory leaks with multiple monitors (or virtual monitors too), nowadays seems better. Supports various video encoders, various bitrate settings, allows sharing clipboard (though still has an annoying bug where sometimes copying something new into the clipboard doesn't work and only 2nd attempt works) and the relay is also easy to setup and host, in addition to it being free! Honestly my favorite software in this space since RealVNC decided they want to be greedy (and since VNC / RDP kinda sucks in my experience).
miyuru 7mo ago
I noticed the same, I had nodes on 2 different ISPs. On one ISP inbound IPv6 was blocked at router, while on other IPv6 was fully allowed. Tailscale detected this is automatically created the tunnel from the blocked one to the other. I was super impressed, as this was handled automatically.
okr 7mo ago
I use tailscale and mullvad vpn for a list of exit nodes i can choose from to work around restrictions, but also bad routing. Like, when in asia and the route is to europe, sometimes it adds weird hops, while when i use an exit-node in Japan, i know, i have perfect routing to Japan and from there perfect routing to europe. But the Mullvad VPN exit nodes often runs into problems like cloudflare blocking. So i am looking for alternative, not well known providers for exit-nodes. Sometimes i even dream of sending my europe traffic via the internal aws network via regions, but hey...
- OJFord 7mo ago
  > problems like cloudflare blocking. [...] Sometimes i even dream of sending my europe traffic via the internal aws network via regions I'd bet you'd see a lot of blocking coming from AWS IP pools too.
- jon_adler 7mo ago
  I set up a Debian vps, installed Tailscale with ufw and fail2ban. I use this as my exit node. Costing around 2 euros per month. No blocking so far.
  - okr 7mo ago
    Thank you. I pay like 10 euro per month. For tailscale with Mullad VPN, which has like 50 countries setup with several exit-nodes in each country. But with blocking. :)
- tristor 7mo ago
  > Sometimes i even dream of sending my europe traffic via the internal aws network via regions, but hey... It's more work, but you can definitely do this. Inter-region traffic still carries egress charges though, so be aware of that in advance. This is a very common pattern in enterprise networking when building cloud-based SDWAN topologies: branch a,b,c connect to hub-1 in us-east-2; branch d,e,f connect to hub-2 in us-west-2; dc1 connects to hub-1 in us-east-2; dc2 connects to hub-2 in us-west-2; services in dc1 and dc2 can reach each other for DR and clients in branch f can reach services hosted in dc1. Underlying all of these SDWAN technologies is essentially basic site-to-site VPN tunnels. Most still use IPSEC, although Wireguard is also used sometimes.

Interesting article; do you have any details on the performance differences?

stonecharioteer 7mo ago
Differences between openvpn and tailscale exit nodes? I can run some tests this weekend.

Tailscale has another interesting feature that I figured out entirely by accident: while the SSO planes (at least using Apple as SSO, rather than your own) may be blocked, the data planes and actual control planes usually are not. If your device is connected to your tailnet before joining a given WiFi, it will stay connected afterward. The guest WiFi at work blocks OpenVPN connections, but established Tailscale slips by. I haven't tried straight Wireguard because I don't consider Tailscale having timing and volume data on me to be all that valuable to them, and they do mitigate the double-NAT situation. I do run a private peer relay for my tailnet but not a full DERP server, nor do I run Headscale. Obviously, your personal security concerns play a role here, but I'm not doing anything I wouldn't do straight from my home network, so I see no reason to make my life harder. If you need that level of security, you need a different solution.

stonecharioteer 7mo ago
Wait, tailscale survives connecting to a locked down wifi? That's insane. I remember not being able to use NordVPN at work. I'd just switch to 4G back then. But if you can't initiate a tailscale connection when connected to the office wifi, what does that mean?
- devilbunny 7mo ago
  Initiate while on mobile connection or tethered to one (or just leave it connected from home), use while on that WiFi. EDIT: I figured this out because I brought my laptop from home to do a few things while at work that needed it. I noticed that my Tailscale connection (initially established at home) was working just fine. That's when I realized that it was the initial authentication that was blocked, not the service. My phone is usually on my tailnet and my iPad is always on it (and using my home exit node), as a result. Using the exit node has a modest but noticeable effect on battery life, but just being connected is maybe 2% of battery a day. Negligible.
- blactuary 7mo ago
  When I work at the local coffee shop I cannot SSH to my remote servers for work on their wifi, but if I connect to Tailscale and use my exit node at home I can. Lifesaver
- zrail 7mo ago
  I think this is mostly a Wireguard thing and not specifically a Tailscale thing. Wireguard does what they call "cryptokey routing" where if you prove you possess a key that the other peer knows, you get the traffic (subject to firewall, allowed IPs list, etc etc). Wireguard stores the most recent address:port that it heard from a particular cryptokey on, but it natively lets peers roam, as long as only one roams at a time.
gpm 7mo ago
While waiting for someone in the hospital I recently played the fun game of "how can I work around their firewall stopping me from connecting to tailscale" that they kindly provided. It was just blocking new connections. Via SNI. Tailscale's control plane turn out not to care if SNI is sent. Tailscale's app let you set a custom control plane... like a local proxy that forwards connections to tailscale's servers without setting SNI.
- devilbunny 7mo ago
  This may very well be the system in use. I've seen this effect in several places, not just my work. Of note: I do not work in the tech sphere. I suspect that this particular loophole may be used by IT personnel to be able to tell the management "yes, we block VPN use" while letting them continue to use their own VPNs. I see no reason to complain.
  - gpm 7mo ago
    I suspect there's less thought put into it than that. There's probably a firewall vendor that has a product that does SNI inspection for blocking things like pornhub and the product comes with a list of sites that includes VPN control planes.
    - devilbunny 7mo ago
      Well, yeah, they didn't roll their own. Offhand, I forget the product, but it's definitely off the shelf. My point being that surely some of them have noticed the same thing I have, and it hasn't been stopped. I'm not going to raise the issue either way.
      - dylan604 7mo ago
        > I'm not going to raise the issue either way. Except, you kinda just did
        devilbunny 7mo ago
mrsssnake 7mo ago
My work guest WiFi network allows only IPv4 HTTPS on port 443 and their their own DNS. Everything else, including ICMP (ping) is blocked. Tailscale barely works as any persistant connection is dropped after 2-3 minutes. Called this out and the security team said noone complains, that there is no use case and they do not want to deal with security risks. And the ossification continues.
- dheera 7mo ago
  A TCP over websockets VPN would be fairly simple to write, or ask an AI to write for you
- justsomehnguy 7mo ago
  > IPv4 HTTPS on port 443 TCP or TCP and UDP? SSTP can work if they don't look at the traffic too hard.
- lostlogin 7mo ago
  > Called this out and the security team said noone complains Classic. And this probably works do every complaint. You need an irritated executive.

comrade1234 7mo ago

Tailscale is interesting. It's built on top of wiregaurd but is different in that it creates a mesh of vpn connections between your devices, rather than just a connection from client to server. I haven't used it because I use witeguard the traditional way and haven't needed a mesh of devices. Also I haven't taken time to investigate the private company offering it and what sorts of my information is vulnerable if I use it.

socalgal2 7mo ago
This is my question too... It's concerning to me that everyone one seems to be using tailscale (and maybe cloudflare access) and that I don't see mention of open source alternatives. I'm sure for some network experts the alternatives are obvious? Setup a server somewhere publically available that runs ??? and have it be your auth/rendezvous server. people complain about github being proprietary but I haven't seen much complaint about tailscale being proprietary. I assume I'm just being overly paranoid? It's certainly convenient to just sign up and have things just work.
- giobox 7mo ago
  There is a well documented opensource alternative to Tailscale - Headscale. The tailscale client is already opensource, Headscale is opensource drop in replacement for the control server which isn't, and fully compatible with Tailscale clients: https://github.com/juanfont/headscale https://github.com/juanfont/headscale If you can be bothered running the headscale container, you generally don't need to pay for tailscale. It's been pretty well supported and widely used for a number of years at this point. Tailscale even permit their own engineers to contribute to headscale, as the company sees it as complimentary to the commercial offering.
  - kurante 7mo ago
    > Headscale is ... drop in replacement I've been really happy with headscale, but I wouldn't call it a complete drop in replacement as I would with vaultwarden. Some features (e.g. Mullvad integration, ACL tests, etc) are missing. Upgrading also requires upgrading every minor version or you run into db migration issues, but that comes with the territory of running your own instance. I would recommend folks look up if headscale suits their needs (like it did for me for many years) before switching over.

mightyham 7mo ago

Genuinely curious: is Tailscale actually providing any values to this use case beyond what you get from a raw Wiregaurd exit node with port forwarding instead of Tailscale's NAT traversal? I've never used Tailscale, but I have a Wiregaurd setup on my home server for the same purpose as described in the article, and I've never had any issues with it. Edit: Noticed some sibling comments asking effectively the same thing as me. I've been meaning to write a blog post covering the basic networking knowledge needed to DIY with just Wiregaurd. My impression is that many people don't realize just how easy it is or don't have the requisite background information.

nighthawk454 7mo ago
It has plenty of useful control plane features out of the box. Nothing much you _couldn’t_ do yourself but you don’t have to. Or with Headscale as the self-hosted open-source version
f33d5173 7mo ago
Dynamic IP addresses.
- ectospheno 7mo ago
  Update your DNS when it changes. Pretty trivial.
  - f33d5173 7mo ago
    Yeah I tried writing a script for that, but at a certain point using an off the shelf tool that does everything is easier.
pkulak 7mo ago
If you're just doing hub-and-spoke anyway, yeah, you can do it yourself. I did for years. But holy smokes, is it a PITA to manually copy keys around to devices; especially when they might not even be yours. I have my Tailscale account hooked up to my self-hosted identity server and now it's just a matter of logging in on whatever device I want to be on the network. Plus, I have the option of spinning up a random EC2 box whenever I want and instantly joining it to the network with basically no fuss.

MysticOracle 7mo ago

Tailscale tangential use case! :) I was looking for remote access software to help family with their PC and came across RustDesk(https://rustdesk.com/ https://rustdesk.com/) but it needs a server. Found out it can work without a server if you have Tailscale installed. No fees for any of this and works on many platforms. Tutorial for Rustdesk + Tailscale setup for remote desktop access: https://www.youtube.com/watch?v=27apZcZrwks https://www.youtube.com/watch?v=27apZcZrwks

jbverschoor 7mo ago
How does it compare to jump desktop
stonecharioteer 7mo ago
Oh lovely. How is your experience with RustDesk? Is it better than VNC?
- raihansaputra 7mo ago
  my experience with RustDesk + Tailscale is really good. when i only needed windows remote devices, the Windows Remote Desktop over Tailscale is great. I used RustDesk for access to macOS and Android devices (all over Tailscale) and works great too. No complaints really. Much less hassle to setup than Parsec (latency isn't as good though), and way snappier than AnyDesk through their network. Great tool enabled by Tailscale.
- znnajdla 7mo ago
  +1 for RustDesk over Tailscale. It works even better than Screens for macOS.
- KronisLV 7mo ago
  Been using it for a while, older versions had memory leaks with multiple monitors (or virtual monitors too), nowadays seems better. Supports various video encoders, various bitrate settings, allows sharing clipboard (though still has an annoying bug where sometimes copying something new into the clipboard doesn't work and only 2nd attempt works) and the relay is also easy to setup and host, in addition to it being free! Honestly my favorite software in this space since RealVNC decided they want to be greedy (and since VNC / RDP kinda sucks in my experience).

miyuru 7mo ago

I noticed the same, I had nodes on 2 different ISPs. On one ISP inbound IPv6 was blocked at router, while on other IPv6 was fully allowed. Tailscale detected this is automatically created the tunnel from the blocked one to the other. I was super impressed, as this was handled automatically.

okr 7mo ago

I use tailscale and mullvad vpn for a list of exit nodes i can choose from to work around restrictions, but also bad routing. Like, when in asia and the route is to europe, sometimes it adds weird hops, while when i use an exit-node in Japan, i know, i have perfect routing to Japan and from there perfect routing to europe. But the Mullvad VPN exit nodes often runs into problems like cloudflare blocking. So i am looking for alternative, not well known providers for exit-nodes. Sometimes i even dream of sending my europe traffic via the internal aws network via regions, but hey...

OJFord 7mo ago
> problems like cloudflare blocking. [...] Sometimes i even dream of sending my europe traffic via the internal aws network via regions I'd bet you'd see a lot of blocking coming from AWS IP pools too.
jon_adler 7mo ago
I set up a Debian vps, installed Tailscale with ufw and fail2ban. I use this as my exit node. Costing around 2 euros per month. No blocking so far.
- okr 7mo ago
  Thank you. I pay like 10 euro per month. For tailscale with Mullad VPN, which has like 50 countries setup with several exit-nodes in each country. But with blocking. :)
tristor 7mo ago
> Sometimes i even dream of sending my europe traffic via the internal aws network via regions, but hey... It's more work, but you can definitely do this. Inter-region traffic still carries egress charges though, so be aware of that in advance. This is a very common pattern in enterprise networking when building cloud-based SDWAN topologies: branch a,b,c connect to hub-1 in us-east-2; branch d,e,f connect to hub-2 in us-west-2; dc1 connects to hub-1 in us-east-2; dc2 connects to hub-2 in us-west-2; services in dc1 and dc2 can reach each other for DR and clients in branch f can reach services hosted in dc1. Underlying all of these SDWAN technologies is essentially basic site-to-site VPN tunnels. Most still use IPSEC, although Wireguard is also used sometimes.