[HN Gopher] Tailscale is pretty useful
___________________________________________________________________
Tailscale is pretty useful
Author : marban
Score : 273 points
Date : 2025-03-05 19:09 UTC (3 hours ago)
(HTM) web link (blog.6nok.org)
(TXT) w3m dump (blog.6nok.org)
| laidoffamazon wrote:
| I love tailscale, but the performance overhead on file transfer
| (my primary use case for it) is very real.
|
| Samba transfers take a 15 megabyte per second hit over tailscale
| even with a fairly fast CPU on both ends (Ryzen 3600 and Ryzen
| 7900X3D) on my local network
| homebrewer wrote:
| Try netbird, it's the same idea but with support for using
| kernel-mode WireGuard when one of the peers is able to connect
| to another one directly without doing NAT tricks (so either
| both peers are on the same subnet, or at least one of them has
| a public IP).
| SteveNuts wrote:
| In my experience Samba is just a slow protocol due to its
| chattiness.
| RamRodification wrote:
| Samba is not a protocol. It's an implementation of dozens of
| services and a dozen protocols, including SMB (Server Message
| Block).
| huang_chung wrote:
| This is just wrong. Tuned properly SMB is much faster than
| SFTP.
| renewiltord wrote:
| WG is quite fast. Can't be the limiter. Like this guy I've
| driven 1 G easily on 7950 and Epyc 9654. I think I did 10 G but
| I can't recall because at some point I just moved everything
| local and did 40 G. But I'm sure it would work on CPU on
| reasonable machine
|
| https://old.reddit.com/r/mikrotik/comments/112mo4v/is_there_...
| laidoffamazon wrote:
| Tailscale is using a user space implementation of WG on my
| Windows machine for obvious reasons - I am imagining that to
| be part of the bottleneck.
| dgacmu wrote:
| A very likely culprit is the packet encapsulation changing
| things for the worse. An informative test would be to
| tcpdump (wireshark, etc) the packet stream with and without
| tailscale. Look at packet sizes, etc.
|
| The overhead shouldn't be 15% but there could be some weird
| interaction with the link MTU for the VPN causing, e.g.,
| smaller packets to be sent with more overhead.
| bb88 wrote:
| They have a DERP server I guess. Your traffic might be going
| through one of those.
| vlovich123 wrote:
| 15 MiB/s is trivially handled by any CPU you're likely to run.
| Indeed 100 MiB/s seems reasonable. 15 MiB/s cap seems either
| the protocol being used is doing too many round trips (assuming
| the machines you're testing with are far apart) or the network
| that's being set up requires routing through Tailscale's infra
| for hole punching.
| immibis wrote:
| It sounds like the traffic gets routed through a Tailscale
| relay because all attempts at direct connection failed. A
| direct connection would have been as fast as a direct
| connection.
| laidoffamazon wrote:
| Not a cap. It's the delta. About 117megabytes a second
| measured by windows explorer to around 101.
|
| These are on my local network, connected to my switch over
| 1gig Ethernet.
| vlovich123 wrote:
| Ok a 12% differential on a LAN is kind of surprising. I
| wonder what Tailscale could possibly doing that would be
| causing this issue because aside from the control plane I
| don't believe they're in the data path all that much. Maybe
| WireGuard on Windows isn't as optimized as it is on Linux?
|
| https://www.reddit.com/r/linux/comments/9bnowo/wireguard_be
| n... from 7 years ago is about trying to get it running at
| 10Gbps speeds.
| baq wrote:
| IME it adds about (at least) 1ms of latency over local
| networks. You should be able to use a different dns suffix
| to use the LAN interface instead of Tailscale.
| huang_chung wrote:
| You likely have network misconfiguration like MTU issue. Don't
| blame Samba if you cannot configure properly.
| nsbk wrote:
| It is indeed! I used to connect to a Synology NAS as remote
| backup location through Tailscale and the transfers would peak
| at around 5 MB/s.
|
| Now I mount the NAS volumes to a host at the same location and
| sftp to it. It's still dog slow at 30MB/s but that's the NAS
| limitation.
|
| Direct access to the NAS can also be achieved via Subnet
| Routers
|
| https://tailscale.com/kb/1019/subnets
| jaxtracks wrote:
| The features here seem to be fairly standard with most the
| WireGuard based VPNs these days. For example, I use Nord for my
| use-case which is very similar to the author's. This allows me to
| rsync my home directory between my laptop, tablet, phone's Termux
| env, and desktop (all running Linux) to maintain configuration
| parity and file locality regardless of where I turn these devices
| on, so long as they have internet.
|
| Does Tailscale have features that set it apart now that other
| VPNs have gotten the private mesh thing down pretty well?
| yjftsjthsd-h wrote:
| What other VPNs do mesh networking? I only know of zerotier
| (proprietary) and nebula (FOSS except that the Android app is
| proprietary)
| johnmaguire wrote:
| Shameless plug, but some of the Nebula team (including
| myself) works on https://www.defined.net/ (proprietary
| managed Nebula networks.)
|
| Also, ZeroTier is "open-source ish." They use the BSL license
| for most of their code (https://www.zerotier.com/blog/on-the-
| gpl-to-bsl-transition/) and I believe you can self-host
| (https://docs.zerotier.com/selfhost/)
| yjftsjthsd-h wrote:
| > Shameless plug, but some of the Nebula team (including
| myself) works on https://www.defined.net/ (proprietary
| managed Nebula networks.)
|
| My one objection to Nebula is that its Android app is
| proprietary, and your response is to plug the even more
| proprietary way to run it?
|
| > Also, ZeroTier is "open-source ish."
|
| So it's not FOSS.
| johnmaguire wrote:
| Sorry, I wasn't aware you had objections to proprietary
| products! After all, this was a thread about Tailscale
| and alternatives. :) Many people find it painful to setup
| a VPN network and prefer a managed solution (e.g.
| Tailscale instead of Wireguard.) Likewise, people have
| different understandings of what exactly FOSS means and
| I'm not deeply familiar with the BSL, so I'm not sure
| whether it would meet your needs.
|
| Best of luck in your search! Maybe take a look at Tinc or
| Yggdrasil.
| vizzier wrote:
| Probably the closest to tailscale, optionally selfhosted, and
| using wireguard meshing would be https://netbird.io/
| wkat4242 wrote:
| There's zerotier, nebula like others have managed and also a
| few more older and fringey ones like tinc and hamachi that
| basically invented the same concept 10+ years before the
| rest.
| Spooky23 wrote:
| The beauty of it is that you control it. And even scale it to
| console stuff. For my use, that's desirable.
|
| That said, I can totally see where a less DIY solution. VPNs
| fundamentally aren't novel and there's nothing wrong with Nord
| and similar products. (Although I don't put any stock in the no
| logging claims)
| baq wrote:
| It just works, literally. I haven't tried nord, but I've got
| clients on Mac, Linux, windows, rpis, it all just works. I used
| to run pivpn, but the key exchange magic Tailscale employs is
| so much simpler and it somehow works on networks blocking
| unknown packets like the pivpn I had set up on some random udp
| port.
| Hikikomori wrote:
| How is it on Android? Tried different vpns to access my
| pihole but its really slow at resolving sometimes.
| baq wrote:
| Android is the only major OS I haven't tried, but given its
| Linux roots I'd assume it's first tier.
| genewitch wrote:
| I use it on android to talk to my synology and a proxmox
| server at my house from anywhere.
|
| It comes in handy from time to time. I run a "public"
| subsonic server but I don't have most of my own productions
| on it, but I can open VLC on android and go to a bookmarked
| share and play it all there.
|
| Also stuff like NVR camera feeda I can look at over
| tailscale, too. No "cloud" storage needed.
|
| I wish there was an easy reliable way to do this that
| didn't involve a for-profit; but until awful things happen
| I am fine using this for low-friction, trivial network
| access.
| porridgeraisin wrote:
| It's great for my limited usecase (SSHing/HTTPing to my
| laptop/computer)
| codethief wrote:
| I've used it on Android to stream the occasional video or
| song from my Jellyfin server while using mobile data. Not
| bad at all, plus they finally seem to have gotten their
| battery drain issues under control.
|
| Recently, as I have been traveling through the Middle East
| and East Africa, I have also used Tailscale on my phone to
| protect myself on public wifis and to work around MitM
| attempts, see my other comment further up.
| zrail wrote:
| Maybe not if all you're doing is hooking some nodes together.
| That said, I have personally used these Tailscale features that
| with a quick glance I don't see Meshnet having:
|
| - ephemeral nodes are super useful for things like attaching a
| GitHub action runner or a fly.io instance to your tailnet
|
| - Tailscale's ACL system has a ton of capabilities
|
| - getting corporate buy-in is possible, vs trying to get a
| business to buy into Nord meshnet for actual workloads
| dawnerd wrote:
| I was all on board with WireGuard myself but couldn't get smb
| working reliably. Saw someone say they're had better
| performance with tailscale and sure enough I can actually use
| it. It's not perfect or anything but quite amazing considering
| it's still just WireGuard under the hood. Whatever magic
| configs they have, good job
| minton wrote:
| I had no idea Nord offered that and we've used them for years.
| Trumpi wrote:
| I was once in South Africa and needed to look up my prescriptions
| in the CVS app. I had lost my pills and needed to show a local
| pharmacist what I needed. CVS geoblocked me. Luckily I had a
| TailScale exit node running at home, which solved the problem.
| deuschelandian wrote:
| When I was in Germany - Capital One blocked access to my
| account unless I confirmed via SMS or tapping my card. Both of
| which I didn't have with me.
|
| Tunnelling into my home machine I was able to access the
| account and transfer money I needed.
|
| Sure a VPN might be able to do this too but it's nice being
| able to exit via a connection you control.
|
| I can also watch Plex movies without exposing ports.
| codethief wrote:
| Another data point: I was at Doha airport recently and logged
| into their public WiFi. Unfortunately, they seemed to be
| MitM'ing certain connections, mostly to well-known domains.
| To work around this, I tried setting up Mullvad (which I had
| used occasionally in the past) but they downgraded
| Mullvad.net to HTTP, too. Thankfully, I had Tailscale already
| set up and I could easily book their Mullvad package and add
| Mullvad as an exit node to my Tailnet. Problem solved.
| HPsquared wrote:
| Alternative: OpenVPN server on your router.
| gabeio wrote:
| > OpenVPN server on your router.
|
| Honestly I would suggest wireguard on your router before
| openvpn.
| danudey wrote:
| I was on a cruise ship a few weeks ago and realized that,
| instead of being throttled, a lot of sites were completely
| blocked. Very irritating. They also do DPI on the cruise ship
| network so that VPN clients like OpenVPN are blocked regardless
| of port.
|
| Without a laptop handy, I had to use my iPhone to set up a
| droplet running Ubuntu, then install vray onto it and configure
| it to run on port 443. vray uses "standard" SSL to tunnel
| connections, so to DPI it just looks like normal HTTPS traffic
| and I was able to pass traffic through the firewall when I
| needed to access something that was blocked. It makes me wonder
| if TailScale would also bypass their analysis, or if it would
| be blocked as well.
|
| (I didn't abuse this to the detriment of the network, and I did
| pay for the "streaming package" on sea days when I had a lot of
| traffic to run)
| abdullahkhalids wrote:
| Tor Browser should have worked with the right bridge or
| proxy.
| kdmtctl wrote:
| Wireguard is easy to block. Some VPN providers do implement
| an obfuscation layer for it, but Tailscale uses plain WG, so
| if WG is blocked, you will get no connection. Control plane
| would still work, though.
| ydnaclementine wrote:
| > it's no longer possible thanks to a cursed thing called CGNAT
|
| as someone who does publicly expose services that have auth, why
| does CGNAT make exposing ports publicly bad?
| jjcob wrote:
| It makes it impossible, because your modem/router no longer has
| a public IP that you can connect to from the internet.
| ThePowerOfFuet wrote:
| Not bad, impossible; it is NAT over which you have no control
| and thus cannot forward ports.
| jen729w wrote:
| FYI my ISP (Aussie Broadband) will put you on a non-CGNAT
| subnet if you call and ask.
|
| Tailscale is a better idea.
| joshstrange wrote:
| My ISP (USA, Metronet) will give you a static IP (instead of
| their CGNAT) for $10/mo which I happily pay.
|
| Tailscale is great but direct is always better IMHO.
| tass wrote:
| Other replies explained the why, though cgnat wouldn't be a
| problem if you also had ipv6.
|
| Luckily for me I have a regular ip4 address but if that ever
| changed I'd be out of luck unless my isp (quantum fibre)
| implemented a proper ipv6 solution.
| aodin wrote:
| I have Quantum Fiber in Colorado and enabled IPv6 on the old
| CenturyLink C4000XG modem following these directions:
| https://www.centurylink.com/home/help/internet/modems-and-
| ro...
| simonw wrote:
| I used Tailscale the other week to solve a problem where a
| government website was blocking me from scraping it from GitHub
| Actions... so I ran an exit node on an Apple TV on my homework
| and configure the GitHub Actions worker to use that instead.
| Worked great! https://til.simonwillison.net/tailscale/tailscale-
| github-act...
| djsjajah wrote:
| You could have also self-hosted the GitHub Actions runner which
| might have been easier as long as you had something to run the
| runner on.
| sixothree wrote:
| I have nothing but performance issues with tailscale. On both my
| iPhone and my iPad it _destroys_ my battery. It uses some 40+
| hours of background time in just a few days. On my PC whenever I
| come back home and tailscale was running, everything is out of
| memory and not running correctly.
|
| That's my experience. I wish it was better.
| zimpenfish wrote:
| > On both my iPhone and my iPad it _destroys_ my battery.
|
| On my iPhone, I've not even noticed any battery problems whilst
| running Tailscale 24/7. Are you running it with an exit node
| that funnels all traffic? I've just got it active for my nodes
| which might be why it's basically doing nothing.
| bb88 wrote:
| I think for simple cases, it's great. If you have remote boxes
| somewhere that needs administration, it's awesome.
|
| If you have more complex cases, the IPTables/Netfilter rules make
| it vastly more difficult to manage, particularly if you're
| running docker-compose (or anything using IPTables rules) on the
| same box and trying to troubleshoot the packets coming out of
| docker and going into tailscale.
|
| And then trying to figure out what tailscale is doing with your
| packets is not great as well. They've also broken features I
| relied upon with a minor release.
|
| Their nat traversal doesn't always work, as sometimes I get
| connected to a DERP server, so that limits the network speeds
| across the internet.
|
| I blame CG-NAT quite a bit -- it's really why we can't have nice
| things these days -- and I get tailscale is trying to fix a bunch
| of that. But the reality is, I just want an interface just like
| eth0 or wl0, not an IT infrastructure to move my packets across.
| EVa5I7bHFq9mnYK wrote:
| I remember Hamachi did the same as Tailscale in the 90s, we used
| it to play virtual LAN DOOM. Greed killed it.
| pushcx wrote:
| I remember XBConnect and GameSpy for playing Xbox Halo 1 over
| the internet. I think a couple were invented for every big game
| or console before 2010 or so.
|
| Tailscale doesn't really address connecting to strangers,
| though.
| dugmartin wrote:
| The Hamachi UI and UX were great. I was very sad when it got
| bloated and then killed like a beached whale. I just looked and
| I guess it lives on as a whalezombie at https://vpn.net/.
| adamors wrote:
| Hamachi was amazing, one of the best, most focused apps I've
| ever used. We were kids but it was still easy to use. Then they
| were bought by LogMeIn and was killed unceremoniously.
|
| Also, it's old but not 90s old: https://swapped.cc/#!/hamachi
| released in 2004 actually.
| kdmtctl wrote:
| This is ZeroTier territory. Not as polished as Tailscale, but
| provides L2 like Himachi and has been bulletproof for years
| already.
| tsujamin wrote:
| The tailscale.com/tsnet package in Go [1] is really useful if
| you've not looked at it before: you can make single binary HTTP
| or whatever servers that are only exposed inside your tailnet.
|
| Their golink project [2] is a good example (and useful itself),
| but I've used it to build "peer to peer" comms for one
| application, and to host an API and Svelte SPA to control some
| other things in a tailnet.
|
| [1] https://pkg.go.dev/tailscale.com/tsnet
|
| [2] https://github.com/tailscale/golink
| xlii wrote:
| How difficult it is to use? Right now I'm working on
| orchestrating dev-local service clusters here I bind plenty of
| hosts to mimick real world. I'm using proxy tunneling to punch
| in but I'd love to have Tailscale endpoint which I could use to
| connect external devices (like mobile clients or non-technical
| stakeholders for show and tell).
| aranw wrote:
| I've been using Tailscale for awhile now and even developed a
| few internal apps using tsnet as well but I had no idea about
| golink and it's awesome. Thanks for sharing that!
| b_fiive wrote:
| If you're a rust fan we make a similar library, that's all-in
| on "p2p-QUIC", with pre-baked protocols to import on top:
| https://github.com/n0-computer/iroh
| apitman wrote:
| See also OpenZiti: https://openziti.io/
| gabeio wrote:
| You don't actually need tsnet for that. tailscale cli itself
| running the subcommand serve will allow you to share a specific
| port on your machine either with your tailnet or use funnel and
| share it out to the internet.
|
| I pulled tsnet out of my go application and switched entirely
| to `tailscale serve` and just use the header that adds to auth
| my family into apps I write. I love it.
| behnamoh wrote:
| related: https://aplaceofmind.notion.site/Tales-of-my-Tailscale-
| Usage...
| iamdamian wrote:
| I'm curious to hear well-informed reasons from this crowd for why
| we can trust Tailscale given the non-self-hosted part of the
| architecture? Does it come down to Tailnet locks [1], not
| worrying that Tailscale will be compromised, not worrying that
| your home network is worth compromising, or something else?
|
| [1]: https://tailscale.com/kb/1226/tailnet-lock
| sgc wrote:
| Use headscale: https://headscale.net/stable/
| haswell wrote:
| What are the primary downsides of self-hosting this? The top
| issues that come to mind:
|
| 1. Maintaining high availability
|
| 2. Dealing with patches/upgrades
|
| But I'm also really curious how likely a self-hosted instance
| is to be an attack vector potentially more dangerous than
| using something like Tailscale.
| huslage wrote:
| You own your attack surface at that point.
| Tailscale/Headscale is a matchmaker and key broker for the
| most part, the clients almost always (barring NAT issues)
| connect directly to one another. The normal security
| considerations apply as with running any service.
| eddieroger wrote:
| > 1. Maintaining high availability
|
| In my experience as a poor sysadmin (as in, bad), you don't
| /need/ HA for Headscale because the clients are pretty
| resilient. I've had my instance go down for a little bit
| and it's fine. Stale and new connections aren't, obviously,
| but it will work well enough that you won't realize
| Headscale itself has gone down until a while after it did.
| stego-tech wrote:
| Call me Cappy Paranoid, but I fall into the camp of "You should
| _never_ trust a service provider, _ever_ ," and build
| infrastructure accordingly; I believe this falls into an
| extreme interpretation of "zero trust".
|
| So while also implementing Tailnet locks and other security
| measures to constrict traffic flow, I'd also consider going a
| step further by only permitting server or resource access based
| on _client_ certificate validation (in other words, a client
| that 's missing a trusted certificate is rejected from even
| attempting to initiate AuthN); that way even if your Tailscale
| network is compromised somehow, untrusted clients and endpoints
| can't make inroads into your infrastructure as easily.
|
| Is that a gigantic PITA to implement? Oh heck, you betcha it
| is, and I doubt 99% of folks need to go that far with their
| homelabs or home services. Still, that'd be my approach to zero
| trust - trusting Tailscale only so far as enabling virtual
| networking, but _not_ blindly trusting traffic coming over that
| network at any point.
| oDot wrote:
| Yes. The best way to avoid trouble is build redundancies to
| it, rather than refine the troublesome part to no end
| tjoff wrote:
| Then why go with tailscale in the first place?
|
| There is slacks nebula and other options that are completely
| self-hosted from the start.
|
| Feels like such a weird hype around tailscale.
| stego-tech wrote:
| I feel like a lot of hype around Tailscale is because it
| vastly simplifies VPNs and their associated networking,
| especially for businesses, startups, or homelabs where the
| focus might be elsewhere or specific talent is unavailable.
| The problem arises when folks don't quite understand _why_
| specific decisions are being made, or use the product in
| nonstandard (or even negative) ways. I 've seen stories of
| folks deploying Tailscale on every machine in their LAN,
| thinking that secures their traffic; using it to cross
| boundaries in the firewall or router between secure and
| insecure VLANs; and using it to connect to servers in lieu
| of a proper router or firewall with appropriate ACLs.
|
| Tailscale is an excellent piece of software, provided it's
| implemented in a way to _emphasize_ security, and not
| _weaken_ it. In OPs case, being used as an accessibility
| aide to a system that couldn 't be secured any other way
| while preserving external access (in their case due to
| CGNAT) was an excellent use of Tailscale.
| haswell wrote:
| Yeah, I mentally sum this up as the "Just Works" factor.
| As a happy Tailscale user, it's easy to see why it's so
| popular.
|
| I do think this simplicity is exactly what contributes to
| those weird and non-standard configurations.
| stego-tech wrote:
| > I do think this simplicity is exactly what contributes
| to those weird and non-standard configurations.
|
| This is why I am confident I will always have employment
| in IT. As I make things simpler for others to use, they
| in turn will find new and innovative ways of making my
| eyes bleed from cursed workflows that once again require
| professional intervention for simplicity, efficiency, and
| security.
| xienze wrote:
| > I feel like a lot of hype around Tailscale is because
| it vastly simplifies VPNs and their associated networking
|
| Tailscale is based on Wire Guard, isn't it? Now there's a
| piece of software that truly made VPNs simple. I have a
| tunnel back into my LAN by way of an EC2 instance and all
| it took was two super simple config files on each
| machine.
| throwawaymaths wrote:
| have you ever managed a tailnet? it's so easy.
| kajecounterhack wrote:
| They have nice clients (e.g. for MacOS, Tizen). Ofc
| headscale is a thing, but if you have a company, it's also
| nice to have someone to yell at if your mission-critical
| tailnet suddenly b0rks.
|
| Imo they don't charge all that much relative to their
| value, depending on who you're asking.
| HPsquared wrote:
| If you can't trust service providers, you probably also can't
| trust software suppliers.
| stego-tech wrote:
| I mean, yes? It's why Zero Trust is growing as an
| operations model. Supply chain attacks, vendor hostility,
| zero days being hoarded by nations and bad actors for
| exploit, the list goes on.
|
| You emphatically cannot trust vendors, suppliers, users,
| software, systems, or governments. Ergo, your
| infrastructure should be built with an appropriate risk
| assessment in mind, and have proper safeguards in place
| where feasible. That's just good OpSec.
| codetrotter wrote:
| > Is that a gigantic PITA to implement? Oh heck, you betcha
| it is
|
| I use my own self-hosted Wireguard VPN server. I agree with a
| lot of what you were saying about client certificates etc.
| And I plan to eventually do that sort of thing on some of my
| services in my own Wireguard VPN too.
|
| But in terms of Tailscale, if you are going to set up all
| kinds of client certificate things that will take a lot of
| time and effort, why not self-host Wireguard also?
|
| Setting up a Wireguard server is super simple. The only
| couple of things that complicate it a tiny bit is opening up
| a port for it for inbound connections if you host it from
| your home connection rather than a rented server, and
| managing the Wireguard public keys that are allowed to
| connect.
|
| But if you are going to do a whole client certificate setup
| on top anyway, the work of setting up your own Wireguard VPN
| is small in comparison.
|
| Unless like OP your ISP has put CGNAT on you.
| stego-tech wrote:
| > But in terms of Tailscale, if you are going to set up all
| kinds of client certificate things that will take a lot of
| time and effort, why not self-host Wireguard also?
|
| Already do! I tried Tailscale initially, but ultimately
| decided to put in the effort of a proper Wireguard setup.
| It's how my personal devices always get back to my home
| LAN, and then exit to the internet; it's also how I make
| sure every DNS lookup hits the Pi-Hole, for domain blocking
| wherever I am.
|
| I emphatically recommend learning WireGuard (and to a
| lesser degree, VPN Concentration) when practical and
| possible. Until then, Tailscale is an excellent product.
| xmichael909 wrote:
| Why wouldn't you just not use Tailscale? What you are
| describing here is, ....
| porridgeraisin wrote:
| If you really want to host the control server yourself, you can
| use this open source implementation of it at
| https://github.com/juanfont/headscale
| some-guy wrote:
| I use Tailscale a lot. I don't fully trust anybody but I trust
| them more than I trust myself to set it up properly.
| phito wrote:
| Yeah, I don't understand how it is so prevalent in the self-
| hosted community. I would never install this on my server, just
| use wireguard/openvpn ...
|
| edit: okay, CGNAT
| gabeio wrote:
| > Yeah, I don't understand how it is so prevalent in the
| self-hosted community.
|
| Not just CGNAT but not having _any_ external ports open can
| be a beautiful thing. I used to have an ssh port (not on the
| standard 22) and the amount of auth attempts back then was
| insane. I now have a full firewall zero open ports but,
| thanks to tailscale, I can still safely access my machines
| while not being at home with zero unauthorized attempts.
|
| And since I am a security person, I use the tailscale lock
| feature so not even tailscale themselves can add nodes to my
| network. Even if they had a breach.
|
| I am a very happy customer.
| Carrok wrote:
| If you're using only key-auth and have password auth
| disabled, I'm not sure why unauthorized attempts are a
| problem.
| GauntletWizard wrote:
| I trust Tailscale with my network traffic. I also trust a $50
| cheap chinese 10G switch that I bought off amazon with a
| terrible and surely insecure management interface. Which is to
| say - I don't, but I don't need to trust it far.
|
| I do have enough trust in their client that's installed on my
| machine to believe that it's not actively malicious. I do trust
| that I can find my other devices, and trust tailscale to keep a
| list of them, and not randomly add other devices that I don't
| know, but I don't have perfect trust of that. All my internal
| services are still E2E encrypted over the Wireguard link; They
| run HTTPS with an internal cert authority. There's not ports
| open on them that shouldn't be, and while it's possible that
| one of them still gets popped, it's much less likely.
| mbesto wrote:
| The data sent from one node to another doesn't pass through
| TS's infra.
|
| I basically just see Tailscale as an auth paradigm for managing
| wireguard keys.
| harrall wrote:
| For me, Tailscale is worth the trouble of not maintaining my
| own Wireguard setup.
|
| Everything on my home network is set up as if it were public-
| facing. But mostly that's because you will find my deployments
| all look the same and have for 20 years, except I added Docker
| to it 10 years ago and maybe now deploy to K8s (at work)... No
| reason to have 2 deployment strategies and make one of them
| less secure... just do the same thing everywhere.
| thomastjeffery wrote:
| In other words (they do get to this point right away), port
| forwarding is pretty useful, and most of us don't have it
| anymore.
|
| I'm sick and tired of the way ISPs treat us. It's literally
| written into my lease what company I will pay for internet, and
| how much I will pay them. It is _not_ , however, written in my
| lease _how fast the connection will be_. Not only am I unable to
| forward ports, I can 't even change my own WiFi password! Sure, I
| could make a fuss and probably obtain access to my router, but it
| isn't worth the hassle.
|
| But why is there a hassle to begin with? How in the hell is it in
| anyone's interest to keep me from configuring my own router? I
| can come up with plenty of authoritative bullshit answers to this
| question, but they are all authoritative bullshit. I think that's
| the real answer: we have systemically built our society to
| operate on authoritative bullshit. _sigh_
|
| Tailscale is a usable workaround, but it shouldn't exist. It
| shouldn't _need to_ exit. I just want to be able to host a
| server. Is that really so much to ask?
| sfRattan wrote:
| The authoritative bullshit isn't what society is running on,
| it's what society is giving as an excuse for enshittification
| that enriches interested parties.
|
| Your landlord (I'm guessing based on having seen it before)
| gets kickbacks from the ISP to force all tenants onto a
| specific (probably overpriced) Internet plan. The interest in
| keeping you from configuring your own router is in allowing the
| ISP's enshittifying further monetization tactics to proceed
| unopposed. The two big ones I've seen in this kind of setup
| are:
|
| Using DNS enforced by the router to gather data and place ads
| on any 404 error.
|
| Sharing _their WiFi network that you lease_ with the ISP 's
| other customers nearby.
| yegle wrote:
| CGNAT _can_ make it easier to access your server.
|
| If your Internet provider and your mobile provider is the same
| company, they could put all your connected devices in the same IP
| block within the CGNAT IP range.
|
| Now, not only you can access your device at home while away using
| your cellphone, you can also connect to your partner's phone with
| the same IP address at (or away from) home.
|
| Some Internet providers in China very recently started providing
| this service, e.g.
| https://www.chiphell.com/thread-2666772-1-1.html (in Chinese). In
| addition to the convenience of accessing your home server while
| on the go, they also make the traffic within the CGNAT free.
| genewitch wrote:
| Lol I will be seriously surprised if at&t offers this, but I
| can see the tmo starlink thing potentially doing it.
|
| I signed up for the tmo beta even though I am not a tmo
| subscriber. Now I have a cool thing to test, can I access my
| behind-starlink stuff from my cellphone?
| klabb3 wrote:
| Easier than what? You mean it can in these special cases become
| like not having a CGNAT?
|
| > they also make the traffic within the CGNAT free
|
| So.. both data caps and breaking the principle of net
| neutrality?
| yegle wrote:
| Easier than asking family members to install a new software,
| then ask them to share their "node" to you.
|
| Imagine you can remote desktop connect to your parents'
| computer after their phone call.
|
| The data cap is on your cell service (the US also has that).
| Net neutrality is debatable given the traffic is between my
| own devices so presumably no one gets hurt (think of
| accessing and streaming from your NAS at home).
| apitman wrote:
| This is actually pretty interesting
| stego-tech wrote:
| I've harped on some Tailscale implementations before for what I
| perceived to be nonsensical or bad approaches, but this one is an
| excellent example of its capabilities. In no particular order:
|
| * It's not reliant on port forwarding at your firewall
|
| * It can get around bad ISP habits, like CGNAT or a lack of IPv6
| (or IPv4)
|
| * As the OP points out, it's broadly compatible with various
| forms of exit nodes
|
| Straightforward and to-the-point. Great writeup.
| smy20011 wrote:
| I use tailscale to build my personal podcast that include local
| weather and stocks I interested in. Running the whole pipeline on
| a steamdeck and use tailscale to securely delivery the generated
| podcast to my phone.
| yjftsjthsd-h wrote:
| How are you going from weather and stock information to a
| podcast? Is there some sort of TTS step there?
| frotaur wrote:
| See notebookLM, as an example
| smy20011 wrote:
| Yeah, fully local LLM+TTS setup.
|
| Use jupyter notebook to fetch the stock and weather info and
| feed that into a local LLM and convert that to speech using
| opensource TTS.
|
| https://github.com/smy20011/MorningRadio
| necessary wrote:
| What is the delivery mechanism?
| smy20011 wrote:
| Local server.
|
| https://github.com/smy20011/MorningRadio
| forty wrote:
| Does it have "entry nodes" ? For exemple if I wanted to receive
| emails on my server while my home connection does not have an
| open port 25.
| anderiv wrote:
| Tailscale Funnel could likely do this.
| forty wrote:
| Funnel looks cool but apparently it doesn't help for non
| https traffic https://www.reddit.com/r/Tailscale/comments/1cy
| v6vf/wow_5_st...
| Duralias wrote:
| They don't host anything like that, DERP servers are, aside
| from Funnel, internal to the tailscale network.
|
| But you can proxy traffic using a VPS really easily, which is
| basically the reverse of exit nodes.
| yamrzou wrote:
| Is there an alternative to Tailscale with a lower memory
| footprint? I wanted to run Tailscale on a small router, but it
| failed due to out-of-memory (OOM) issues.
| caconym_ wrote:
| Wireguard?
| yamrzou wrote:
| Wireguard doesn't do NAT traversal on its own, which is,
| IMHO, the killer feature of Tailscale.
| NexRebular wrote:
| Maybe Nebula? You can do one yaml config file with all the
| certificates and firewall rules making it easy to script device
| provisioning too.
| yamrzou wrote:
| I'm mainly looking for a solution that punches through NAT
| the way Tailscale does.
| NexRebular wrote:
| Nebula has NAT punching as well[1]. Or does Tailscale do
| even more magic on it?
|
| [1] https://nebula.defined.net/docs/config/punchy/
| yamrzou wrote:
| It seems to have relays which is interesting. For
| comparison, here is Tailscale's article on how they do
| NAT traversal: https://tailscale.com/blog/how-nat-
| traversal-works/
| ash wrote:
| Have you tried "Smaller binaries" instruction?
| https://tailscale.com/kb/1207/small-tailscale
| yamrzou wrote:
| No, thank you. I'll try it.
| erulabs wrote:
| Tailscale also allows you to issue valid TLS certificates
| (`tailscale cert`), which is crazy useful for certain local
| development tasks, EG developing SSO for a mobile application
| where the SSO provider mandates TLS and the mobile devices dont
| easily allow you to bypass self-signed certificates. They keep
| piling on awesome features, big fan.
|
| The Tailscale k8s operator is also great.
| 9dev wrote:
| I use these certificates for almost any management UI of
| internal services that would go unencrypted for convenience
| otherwise, even for Postgres servers. It's really versatile.
| high_byte wrote:
| tailscale to expose a port is such overkill. just use ngrok for
| that.
| textlapse wrote:
| Also, their building up on top of a 'platform' is wonderful:
| funnel, exit nodes, sharing, ssh, drive etc.
|
| I wonder if they can figure out a way to distribute compute
| eventually via their network (not just clunky ssh): 'my' storage
| is already shared with 'my' nodes, why not 'my' compute? :)
|
| Seems like a great company/business.
| ezekg wrote:
| > I have used Tailscale only for personal reasons so far, using
| the free tier; they have enterprise plans for enterprise use
| cases that I have no idea about.
|
| Does anybody know of any good materials on the enterprise use
| cases and configs? e.g. blogs, screencasts, etc.
| CharlesW wrote:
| This seems like a good place to start:
| https://tailscale.com/blog/patterns-from-the-field-use-cases
| ezekg wrote:
| I guess more specifically, I've been looking for material on
| k8s machine-to-machine networking using Tailscale.
| lakomen wrote:
| Talos has something about Wireguard, but I never used it in
| the k8s context
| porridgeraisin wrote:
| I use it extensively as well.
|
| - My home PC, my laptop, and my phone are the participants.
|
| - My home PC is connected to a GPU, and runs a colab runtime,
| SSHD, as well as a simple http file server in $HOME (actually,
| C:/Users/username, its windows)
|
| - My laptop doesn't have an NVIDIA GPU, so it just runs SSHD and
| a file server.
|
| - My phone serves nothing, but has an SSH client, and a http
| client obviously.
|
| There is simple hostname based DNS setup by tailscale
| automatically, so I can just go to http://laptop:8000 to access
| all my files, or just ssh to username@computer
|
| Accessing everything from everywhere is absolutely great. And
| this is all on their free tier.
|
| Unrelated to tailscale, I use parsec for a similar solution for
| remote desktop, their "machine level user" feature allows me to
| initiate remote desktop from certain client devices directly.
|
| Too smooth.
| etra0 wrote:
| I work +1000km away from home, and I work by shifts, tailscale
| has helped me a lot on running stuff back at home.
|
| I was even able to stream my games through the tunnel with a
| (decent enough) latency of 27ms with variance of 2ms.
|
| Admittedly, I could buy a gaming laptop, but I don't want to
| carry a heavy laptop 4 times a month :P
| ramses0 wrote:
| See also Nebula:
|
| https://nebula.defined.net/docs/
|
| https://nebula.defined.net/docs/guides/quick-start/
|
| ...I believe 100% open source. You can basically hub between
| different devices (including iOS/Android) that are identified via
| certs. Recommended to have one or more public "lighthouses" so
| anything that can reach a lighthouse can reach any of your other
| servers (maybe kindof "syncthing for vpn/overlay-network?").
|
| I've dorked around with it a little bit, but it's rare enough
| that I need access to my home network while out that I haven't
| doubled down on proper cert, key management, rotation, etc.
| finnjohnsen2 wrote:
| Tailscale is Canadian from what I can see, and not american.
| Which is a plus these days.
| andix wrote:
| Absolutely. We aren't allowed to introduce new services from US
| companies anymore. It's just too risky right now, who knows
| what's going to happen next in this trade war. What's happening
| to Canada and Mexico can happen to any country.
| CharlesW wrote:
| Networking SmartFriends: Is port forwarding intrinsically a bad
| idea (as compared to using Tailscale Funnel) from a security
| perspective if I want to expose, say, a Plex server running on my
| NAS to the outside world?
| arsome wrote:
| It's largely equivalent here - you're just exposing something
| via a tunnel rather than directly via your home IP.
|
| That could have benefits, for example, if you're concerned
| about a DDoS attack on that service taking your home internet
| out, you may be able to work around it like this. But it won't
| mitigate a gaping hole in the underlying service which you're
| still exposing.
|
| It could also have drawbacks, like limited bandwidth and higher
| latency, which would make it highly unsuitable for something
| like a game server.
| 9dev wrote:
| We're using Tailscale for our internal network, and it's amazing.
| We're a team distributed across multiple countries, and with
| Tailscale, it's like we're sitting in a single office, connected
| to the same router. And on top of that, we get centrally managed
| ACLs for everyone, TLS certificates, and SSO with Microsoft
| accounts. Amazing stuff!
|
| My main gripe, though, is DNS. It's great to be able to reach
| prod-db-1, prod-db-2, and prod-db-3, tag them as ,,db" and create
| a rule to allow TCP on db:5432. however, it's annoying that all
| of this is supported, but not the obvious extension - DNS records
| for the _tags_ , so I can point apps to a group of servers
| belonging to the same tag.
| cess11 wrote:
| Similar to how you would use keepalived to get a virtual IP and
| broker between addresses under it?
| 9dev wrote:
| Yes, but with all the benefits of Tailscale nodes--automatic
| DNS resolution, ACLs, and TLS certificates out of the box,
| and so on. The building blocks are all there, it's just that
| nobody has built the feature yet.
| bcye wrote:
| I noticed that limitation quickly too. My solution was to just
| point A records on my domain to the tailscale internal ip and
| use the let's encrypt wildcard certificate my registrar
| (porkbun) provides out of the box.
| MasterYoda wrote:
| Is there any simple FOSS alternative to tailscale that you can
| self-host?
|
| The only thing I need is to simply connect to the home network
| and I dont want to need to open and forward ports etc in routers
| and firewalls for it to work, just something simple plug and play
| and is secure.
| mfro wrote:
| It's functionally just a VPN. Selfhosting wireguard or openvpn
| is not particularly difficult.
| knowaveragejoe wrote:
| It uses Wireguard, sure, but it's using a coordination
| service to give you a effectively a flat network mesh instead
| of hub and spoke.
| wkat4242 wrote:
| No it's not the same as normal wireguard with some 'just
| works' config sauce. Devices can connect directly and also
| find the best way to do it. For example two devices in the
| same office will create a direct path between them without
| having to go through the off-site vpn server.
|
| At this mesh vpn is really good.
| duskwuff wrote:
| Yes - https://headscale.net/
|
| Fully compatible with Tailscale client binaries; it just
| replaces the control server.
| knowaveragejoe wrote:
| > The only thing I need is to simply connect to the home
| network and I dont want to need to open and forward ports etc
| in routers and firewalls for it to work, just something simple
| plug and play and is secure
|
| That's tailscale, basically. Install on devices and they can
| magically talk to each other across the internet with no other
| configuration.
|
| If you really want to, you can run headscale and manage the
| coordination plane yourself as well.
|
| https://github.com/juanfont/headscale
| elevation wrote:
| Tailscale is becoming less useful as network providers become
| hostile to it.
|
| Last week I noticed McDonalds guest wifi is blocking new
| connections over the tailscale control ports. It will pass
| wireguard mesh traffic for established sessions, but their
| firewall rules prevent you from establishing new ones.
| crims0n wrote:
| It was for that reason OpenVPN set up in SSL mode over TCP 443
| was king, a few years ago most firewalls could not distinguish
| it from regular TLS encrypted web traffic. These days with
| application layer "next gen" firewalls though, a zealous
| network administrator can distinguish between the two and block
| just the VPN connection if they so choose.
| smackeyacky wrote:
| My favourite use of tailscale:
|
| I have a bluetooth gateway (Cassia X1000) in my workshop where I
| normally develop. I was at home doing some Android work at one
| point rather than at the workshop and needed to test some new
| Cassia functionality.
|
| Tailscale exit node in the workshop.
|
| Tailscale client on my linux dev laptop at home.
|
| Started up the android emulator via Android Studio, connected to
| the Cassia via the app being debugged, debugged what I needed to,
| shipped it.
|
| At the time it seemed like actual magic had happened.
| andix wrote:
| And it's Canadian. Cool. We have a policy now that doesn't allow
| us to bring in new services from US companies.
| andix wrote:
| Downvotes on this comment, nice. It's about reducing exposure
| in a possible trade war.
| apitman wrote:
| Tailscale is one of my favorite companies. They're clearly on to
| something. Here's a great post by their CTO explaining a lot of
| the motivation and vision behind it:
| https://crawshaw.io/blog/remembering-the-lan
|
| IMO the main outstanding questions/concerns are:
|
| * Is the VPN model really the way to go? If someone gets their
| hands on one of your Tailscale nodes, they can access every
| service on your tailnet, which are likely running with reduced
| security since that's a huge part of the appeal. This is exactly
| the situation BeyondCorps/Zero Trust was created to avoid.
| Tunneling services[0] are more of a Zero Trust approach, but they
| can't match the seamlessness of Tailscale once a node is
| connected to the tailnet.
|
| * Can it expand into the layman market? I wonder if the average
| person will ever be willing to install a VPN app on all their
| devices. On the flipside, I could see TS partnering with someone
| like Google to integrate TS tightly with Android and set up a
| private network between all your Google-signed-in devices.
|
| * The relay system - DERP is nice, but it's primarily intended
| for signaling/fallback. It feels like CGNAT adoption is growing
| faster than IPv6 is, and I wouldn't be surprised if fewer and
| fewer p2p connections succeed over time[1]. DERP forces
| everything over a single TCP connection (HOL blocking), and I'm
| not sure it even has any flow control.
|
| * Use in web browsers - They got a demo of this working, but it's
| pretty involved. You have to compile the entire Tailscale Golang
| library to WebAssembly which is a large artifact, and it's DERP-
| exclusive.
|
| * Portability in general - Depending on WireGuard, as awesome as
| it is, is fairly limiting. You either need admin privileges to
| create the TUN device, or you need to run an entire TCP stack in
| userspace alongside your own WireGuard implementation. I'd be
| interested to see something like Tailscale implemented on top of
| WebTransport.
|
| [0]: https://github.com/anderspitman/awesome-tunneling
|
| [1]: https://tailscale.com/blog/how-nat-traversal-works
| jdolak wrote:
| On your first point, I've been using tailscale for a bit and
| its ACL feature addresses most of my concerns there. My laptop
| can ssh into any of my servers but not the other way around,
| and my servers cant talk to each other unless I set them to.
| thewebguyd wrote:
| > * Is the VPN model really the way to go? If someone gets
| their hands on one of your Tailscale nodes, they can access
| every service on your tailnet, which are likely running with
| reduced security since that's a huge part of the appeal. This
| is exactly the situation BeyondCorps/Zero Trust was created to
| avoid. Tunneling services[0] are more of a Zero Trust approach,
| but they can't match the seamlessness of Tailscale once a node
| is connected to the tailnet.
|
| At the very least there's ACLs so you can tag devices and
| restrict access down to specific ports and protocols based on
| either user identity or device tag.
|
| At my org we use tailscale much like a VPN, to give users
| access to a few internal web apps, and with ACLs those users
| can only hit the webserver on 443 and nothing else to that
| node. This way the web server itself has no ports exposed on
| the host, ufw deny all incoming.
|
| I can't answer if the VPN model is really the way to go, long
| term - probably not, but for our use case Tailscale has been
| absolutely perfect, and we accepted the tradeoffs were worth it
| over a more "complete" zero-trust approach, and the
| complexities that come along with it.
|
| What Tailscale doesn't solve is access to the data that web app
| serves if the user's machine is compromised, as tailscale is
| just determining "can the user hit the webserver on port 443?"
| and does nothing to evaluate the state of the user's host.
|
| I guess that's all to say, I/we don't see Tailscale as a zero-
| trust solution, but more or less a more convenient VPN with
| easier to use ACLs. Cloudflare Tunnel and the likes are much
| better suited to implementing a zero trust approach.
|
| I think there's still value though. A zero trust approach is
| the correct way for most organizations, but there's still a big
| niche for Tailscale especially for small-medium orgs and self-
| hosters/homelabbers.
| wkat4242 wrote:
| Tailscale is not just more convenient but also more efficient
| if your VPN meshes a lot ( not all traffic going to the same
| place). Because nodes can establish connections directly. A
| traditional VPN can't do that.
|
| This is the main reason I use a mesh vpn (though not
| tailscale)
| epscylonb wrote:
| Agree that they are on to something. I gave a tech talk about
| them a while ago at work and said that I think they are on the
| cusp of providing a consumer VPN product that appeals to
| mainstream consumers. The Apple of VPNs, everything "just
| works" and is easy to understand.
| hattmall wrote:
| Do mainstream consumers really need a VPN?
| wkat4242 wrote:
| Beyondcorp was mainly created to advocate cloud services and to
| minimise the (legit) worry off CIOs to see all their data in
| services connected to the entire internet.
|
| I still think VPN has a good usecase. It's great extra layer of
| defense and also a nice way to disclose access to devices at
| different locations.
|
| I don't use tailscale as it's too commercial for me but I use
| another VPN mesh service. Of course you still need to secure
| your endpoints properly.
| pierluc-works wrote:
| Does anyone have some insight why installing security/tailscale
| on freebsd is installing security/ca_root_nss which contains a
| very scary message?
|
| https://github.com/freebsd/freebsd-ports/blob/ec981e26cd3128...
| buybackoff wrote:
| I used to expose my workstation RDP directly but with a non-
| standard port. Then I became a "homelabber", and paranoid, and
| added a mix of nginx with basic auth in front of Guacamole. The
| UX in browser is so abysmal that I used it to configure direct
| RDP when I really needed to work remotely when traveling. Then I
| learned Tailscale and it is really liberating. Just direct RDP
| with negligible (for me) risks. I run OneDrive, JetBrains
| Toolbox, Podman just visible in the tray and what else as
| services, such as OpenVPN, etc. I keep Tailscale running only
| when I travel. I think paranoia should stop at some point, yet I
| still read the top comment about security/trust very attentively.
| ctm92 wrote:
| Tailscale is super awesome, I was amazed when I first set it up
| that it just worked out of the box. It can be set up by everyone
| without having to expose ports on the router (something that is
| often not even possible anymore due to CGNAT), so you get a lot
| of convenience without giving up security
| boldlybold wrote:
| Tailscale is great. I put my whole company on it shortly after
| joining (we had some servers with RDP exposed to the
| internet...). It has had ~0 problems in the last year, and non-
| technical people are able to use it with ease.
| etc-hosts wrote:
| I selfhost tailscale with headscale, I used a helm chart in a k8s
| cluster, works great.
|
| I ran into a corporate network recently that blocked the
| Tailscale DERP servers.
| globular-toast wrote:
| Is Tailscale useful if you _don 't_ have CGNAT? I solve the
| problem in the article using Wireguard on my router and a dyndns
| client.
|
| In a way I think all these solutions just keep enabling IPv4 to
| continue and that sucks. Does Tailscale offer anything in an IPv6
| world? Are they another company with an interest in stopping IPv6
| progress?
___________________________________________________________________
(page generated 2025-03-05 23:00 UTC)