3 ms·

I've been a fan of Tailscale since encountering it for the first time at a previous job at a small startup. Someone asked if anyone had a Linux machine when we

by saghm 2mo ago

I've been a fan of Tailscale since encountering it for the first time at a previous job at a small startup. Someone asked if anyone had a Linux machine when we were all testing out something, and I mentioned I had a personal Linux desktop but wasn't sure how to connect it to the VPN for access, and it turned out that the solution was just literally running two commands in the terminal after installing tailscale from the repos. Compared to my first job where connecting to the VPN from Linux required hours of mucking around with openswan (or was it strongswan? so many swans...) and trial and error with various config files, it was unfathomably straightforward.

graemep 2mo ago
With a desktop its usually possible from the network setting GUI? Worked like that last time I needed to use a VPN for access to a corporate network.
- throwway120385 2mo ago
  Some of the NetworkManager VPN plugins have weird side-effects. Like the one for OpenVPN force-disables split tunnel configurations and there's no way to turn that off, meaning that all traffic routes through the VPN even if you'd rather only send stuff for certain destination addresses through.
- saghm 2mo ago
  Based on the experience that I (and other coworkers, including on other distros) had, whatever configurations our VPN needed did not seem to work out of the box on network manager.
  - miki123211 2mo ago
    A lot of this is just weird Linux on the desktop weirdness. On Windows and Mac, VPN config is usually just installing a client, signing in, and then it all basically works. Sometimes you don't even need the client and can set it up in settings.
    - saghm 2mo ago
      Those are pretty much all first-party clients though, right? I'm not sure that "some companies don't provide a Linux client for their software" is something I'd characterize as "Linux desktop weirdness". My point here is that Tailscale seems to have actually put time and effort into making a Linux client that's a breeze to use, whereas most of the other VPNs I've used for work have not.
inigyou 2mo ago
That strongswan thing is the kind of design HN praises about open protocols by IRC (just the other day...) but in practice is so flexible it can't keep itself upright and it's unusable in practice. Meanwhile tailscale or wireguard, by being actually opinionated, avoids needing much configuration at both ends.
- gmac 2mo ago
  Yes — configuring strongSwan as a bog-standard VPN server was so hard to fathom I made GitHub repo for it [1]. To be fair, some of the complexity comes from OS support that seems specifically designed to make secure setups difficult, presumably at the behest of various Three Letter Agencies. I have now mostly switched to Wireguard for this, which is much more sane [2]. [1] https://github.com/jawj/IKEv2-setup https://github.com/jawj/IKEv2-setup [2] https://github.com/jawj/wireguard-setup https://github.com/jawj/wireguard-setup
  - deleted 2mo ago
    [deleted]

by saghm 2mo ago

graemep 2mo ago

With a desktop its usually possible from the network setting GUI? Worked like that last time I needed to use a VPN for access to a corporate network.

throwway120385 2mo ago
Some of the NetworkManager VPN plugins have weird side-effects. Like the one for OpenVPN force-disables split tunnel configurations and there's no way to turn that off, meaning that all traffic routes through the VPN even if you'd rather only send stuff for certain destination addresses through.
saghm 2mo ago
Based on the experience that I (and other coworkers, including on other distros) had, whatever configurations our VPN needed did not seem to work out of the box on network manager.
- miki123211 2mo ago
  A lot of this is just weird Linux on the desktop weirdness. On Windows and Mac, VPN config is usually just installing a client, signing in, and then it all basically works. Sometimes you don't even need the client and can set it up in settings.
  - saghm 2mo ago
    Those are pretty much all first-party clients though, right? I'm not sure that "some companies don't provide a Linux client for their software" is something I'd characterize as "Linux desktop weirdness". My point here is that Tailscale seems to have actually put time and effort into making a Linux client that's a breeze to use, whereas most of the other VPNs I've used for work have not.

inigyou 2mo ago

That strongswan thing is the kind of design HN praises about open protocols by IRC (just the other day...) but in practice is so flexible it can't keep itself upright and it's unusable in practice. Meanwhile tailscale or wireguard, by being actually opinionated, avoids needing much configuration at both ends.

gmac 2mo ago
Yes — configuring strongSwan as a bog-standard VPN server was so hard to fathom I made GitHub repo for it [1]. To be fair, some of the complexity comes from OS support that seems specifically designed to make secure setups difficult, presumably at the behest of various Three Letter Agencies. I have now mostly switched to Wireguard for this, which is much more sane [2]. [1] https://github.com/jawj/IKEv2-setup https://github.com/jawj/IKEv2-setup [2] https://github.com/jawj/wireguard-setup https://github.com/jawj/wireguard-setup
- deleted 2mo ago
  [deleted]