[HN Gopher] Show HN: Netrinos - A keep it simple Mesh VPN for sm...
___________________________________________________________________
Show HN: Netrinos - A keep it simple Mesh VPN for small teams
I'm the founder at Netrinos. I built a WireGuard-based mesh VPN
because remote access has always been a pain. After years of SSH
tunnels, IPsec headaches, and the ssh log horror movie, I wanted
something simpler: install, sign in, get work done. Netrinos
creates a LAN-like overlay network across your devices. Connections
are direct P2P via WireGuard, with no central server routing
traffic. Each device gets a stable IP and DNS name
(pc.you.netrinos.com). When direct connections fail, they fall back
to a relay server that's still encrypted end-to-end. We can't see
your traffic. The most challenging problem to solve was NAT
traversal. UDP hole punching works most of the time. The rest is a
cocktail of symmetric NAT, CGNAT, and serial NATs. We use STUN-
style discovery and relay fallback for the edge cases. I was
surprised by how unreliable low-end ISP routers really are, and how
much technical wizardry it takes to hide that behind a clean,
simple UX. Our stack is a Go backend for client and server,
WireGuard kernel mode for Linux and Windows (macOS is userspace),
Wails.io for cross-platform UI. WireGuard does all the heavy
lifting. Go ties it all together. Popular use cases include: RDP
to home PCs, accessing NAS without exposing it, and SSH into
headless Linux boxes. One customer manages hundreds of IoT devices
in the field, eliminating the need to deal with customer routers.
We just released Pro with multi-user, access control, and remote
gateway routing. Personal is free (up to 100 devices). I'd love to
hear what you expect from a simple mesh VPN, what's missing from
current tools, and what's lacking from your remote access setup.
Use code HNPRO26 for a 30-day trial of Pro. https://netrinos.com
Author : pcarroll
Score : 75 points
Date : 2025-12-19 21:50 UTC (3 days ago)
(HTM) web link (netrinos.com)
(TXT) w3m dump (netrinos.com)
| dewey wrote:
| What's the main differentiator between Tailscale and Netrinos?
|
| Edit: Just found this post https://netrinos.com/blog/tailscale-
| alternatives-2025, so it looks like main differentiator is
| pricing right now.
| felixg3 wrote:
| You again under the posts that tickle my fancy...
| sh3rl0ck wrote:
| One's banned in my hostel because of a stupid sysadmin.
|
| One isn't.
| bongodongobob wrote:
| Not allowing random VPN connections on a LAN is pretty
| standard. I've been surprised at how many people here are
| able to use tailscale and the like. Guessing it's just
| because there are likely smaller teams here that don't have
| any kind of managed network.
| antonvs wrote:
| Smaller teams, yes, but also it seems as though the SaaS
| explosion has led to many enterprises significantly
| relaxing the "hardness" of their network boundaries, at
| least when it comes to integration with companies whose
| services they depend on. I've seen Tailscale and tools like
| ngrok being approved to get into large enterprises who you
| might think wouldn't allow it. Some of these enterprises
| will set up a bastion in a DMZ to control that, but I've
| been surprised by how many don't do that.
|
| That relaxation tends to have ripple effects - once you
| allow tunneling tools in for one purpose - like SaaS
| integration - then it becomes more normalized and people
| start using it for other purposes.
| observationist wrote:
| Someone is making your IT team do extra work without a good
| understanding of their systems if they're banning tailscale
| or granting special network level access thinking that ip
| or mac address based profiling is secure.
|
| Your network should be zero trust. That means you want to
| treat every host that connects as if it's on the public
| internet; the corollary to that is you _should_ give your
| hosts access to the public internet, unrestricted, and
| treat your users like adults who don 't need micromanaging
| or constant surveillance (do sane logging, ofc.)
|
| If you need a host that's subject to continuous
| surveillance, design it as such and require remote access
| with MFA, and so on.
|
| Give your end users as much freedom as possible, and only
| constrict it where necessary, or you're going to
| incentivize shadow IT, unintended consequences, and a whole
| lot of unnecessary make-work that doesn't contribute to
| security.
|
| Unrestricted access forces change management, design
| choices, and policy to confront each user and device for
| the attack vector they are, and to behave accordingly.
| panarky wrote:
| And then a few of those users who you treated like adults
| who don't need surveillance make a private network among
| themselves and other nodes in Russia and China to
| exfiltrate the corporation's most sensitive intellectual
| property, serve as a bridge for state-sponsored bad
| actors to bypass your firewall, and tunnel command-and-
| control traffic through your "unrestricted" egress, and
| now your zero-trust philosophy has created a zero-
| accountability blind spot that your IR team discovers
| eighteen months later during a breach investigation.
| idiotsecant wrote:
| If your threat is _state sponsored bad actors_ you 've
| already failed. OK, great you blocked VPNs. Now they
| tunneled their vpn through as HTTPS. You successfully
| annoyed all your legit users and completely failed to
| stop the real problem.
| hugo1789 wrote:
| What's the alternative--locking down all legitimate users
| and still losing the data anyway?
|
| Network controls alone don't stop exfiltration. HDMI/DP
| can move data faster than most consumer NICs. Does the
| system account for that scenario?
| observationist wrote:
| Then you've failed in security infrastructure, policy,
| and enforcement, _and_ you 've infantilized your users
| and wasted a bunch of IT time on checking boxes. The real
| power move in that case would be ensuring some third
| party vendor checked the boxes for you, so that your ass
| gets sufficiently covered and you have a narrative that
| goes something like "well, we did everything you're
| supposed to, those pesky superhackers are just soooo
| devious and skilled that they can get anywhere!"
|
| The actual fix for things like that is to ensure that
| your sensitive data is properly protected, and things
| that you don't want exfiltrated aren't put into scenarios
| where exfiltration is possible. If you need to compromise
| on security for practicality, then make those exceptions
| highly monitored with multiple people involved in custody
| and verification. Zero trust means you don't give any of
| your users or host devices any trust at all, and modern
| security software can require multiple party approvals
| and MFA.
|
| You can use a phone to scan documents as you scroll
| through them, or mitm hardware devices that appear to be
| part of a cable, or all sorts of sneaky shenanigans, and
| it's a never-ending arms race, so you have to decide what
| level of convenience is worth what level of risk and make
| policies enforceable and auditable. In some cases that
| might mean SCIF level security with metal detectors and
| armed guards, in other cases it might mean ensuring a
| good password policy for zip files shared via email.
|
| Inconveniencing users by limiting web access and doing
| the TSA style performative security thing is
| counterproductive. This doesn't mean you give them
| install rights, or you don't log web activity, or run
| endpoint malware scanning, or have advanced unusual
| activity monitoring on the network and so forth. It just
| means if Sally from accounting wants to go shopping for
| ugly christmas sweaters for staff on Etsy, she doesn't
| have to fill out forms in triplicate and wait 3 months
| while the IT department gets approvals and management has
| meetings and the third party security vendor does a
| policy review and assessment before signing off on it, or
| telling her no.
| c0balt wrote:
| About that, we actually tried (with support from the
| network team) to open a small VPN Fron our office for some
| mobile devices as part of an event installation. Just plain
| wireguard on a public IP.
|
| After two weeks of back and forth the wireguard packets
| were still being discarded somewhere by a firewall/router
| thanks to "deny VPNs by default". Tailscale got through
| those immediately though by using their relays + one of the
| workarounds for standard wireguard ports being blocked.
| Point being, the service provided by a mature solution like
| Tailscale for punching through networks is surprisingly
| effective even for corporate-level networks.
| pcarroll wrote:
| Would you mind revealing which one is banned? I wonder what
| they are using to make that determination.
| Imustaskforhelp wrote:
| They are most likely referring to tailscale in my opinion.
| felixg3 wrote:
| I really like your fair differentiation and feature comparison vs
| Tailscale, netbird etc.
|
| Love to see the ecosystem of wireguard based services growing
| into different business segments, i.e. you targeting SMBs/small
| teams.
|
| Not for me, but legitimate use case and product :)
| Can_K wrote:
| Full disclaimer: huge Linux fanboy here.
|
| Not really related to the product itself, but your landing page
| design looks close to the official Microsoft style which I dont
| have the best memories of..
|
| It might be intentional to show the "seamless integration" to
| Windows users but my penguin loving soul got scared!
| pcarroll wrote:
| Thanks for that feedback. I share your feelings about Linux. It
| never occurred to us that it would be reminiscent of old MS
| days. We were going for "clean and uncluttered".
|
| If it makes you feel better, all core development for Netrinos
| is done on Linux. Then, the code is adapted to work on macOS
| and Windows. Almost all of the code is cross-platform,
| including the UI. Only the implementation details are platform
| specific.
|
| e.g. Linux uses nftables. MacOS uses pfctl. Windows, we had to
| write our own packet filter to avoid touching the often
| misconfigured Windows Firewall.
| tjfl wrote:
| The GitHub link on your website is 404
| (https://github.com/netrinosnetwork)
| indianmouse wrote:
| Yep. Stating Github and providing a non existent Github link is
| a serious redflag which brings trust issues.
|
| Either provide the Github (for whatever reasons) or remove the
| link from your website. I am assuming it is closed source.
|
| Personally I don't trust new VPN solutions without published
| source code!
|
| Alternatives: Tailscale with Headscale or better Self-hosted
| Netbird if one is a itty-bitty IT savvy.
|
| Netbird (self-hosted) offers a lot lot more with the self-
| hosted solution. - SSO - Independent networks - Superb policies
| / ACLs - Keybased onboarding - auto-expiration and a lot more
| like integrations and what not!
|
| Tough to beat the Netbird Open source offering if one tends to
| spent a little time and effort (though not everyone's cup of
| coffee!)
|
| Such can look at tailscale's offering since the free version of
| Tailscale offers more than what is offered here and all the
| client applications are open source and constantly updated.
|
| If pricing is going to the only difference, (at a high level,
| everything under the hood looks similar - wireguard based, zero
| config, p2p mesh, port forwarding etc etc.,) bring a lot more
| trust by offering an open source version like others.
| mythoughtsexact wrote:
| https://headscale.net/stable/
| nickorlow wrote:
| Seems similar in purpose to https://vpncloud.ddswd.de/
| nickorlow wrote:
| (above is very easy to use and works very well w/ my
| experience)
|
| Only downsides are no mobile support & seems to be somewhat
| abandoned
| wolrah wrote:
| The "No IT Department" part of your marketing immediately turns
| me off because that's actively encouraging "shadow IT".
|
| We all get that sometimes companies have IT policies which are
| outdated and get in the way, but that's a problem for someone up
| the chain to solve. A team or department deciding to just start
| doing their own thing with something like this which isn't
| managed by or even known about by the official company IT is at
| best a path to future problems if not an immediate compliance
| problem.
| boplicity wrote:
| Compliance, "up the chain", "department", "the official company
| IT", etc...
|
| These are all things that the target audience either doesn't
| have, or doesn't want. If the above words are important to you,
| then you're probably not in the target market.
| idiotsecant wrote:
| IT is sometimes dysfunctional and management doesn't care.
| mbreese wrote:
| Or it's a small enough company without an IT department.
|
| Think of an SMB where you might know you need to do something
| (like connect a new store location to the server in your main
| location's closet), but don't know how or can't afford to hire
| an IT person full time. This is probably the main market for
| this. Then once you get more buy in, experience, and
| reputation, this VPN could stay to see larger clients. That's
| at least how I'd expect to see this grow.
| ImPleadThe5th wrote:
| Can anyone explain to me (someone not so network security savvy)
| if there are any privacy or security concerns using a wire guard
| provider like this?
|
| As I understand it, with traditional VPNs, you basically have to
| trust third-party audits to verify the VPN isn't logging all
| traffic and selling it. Does the WireGuard protocol address
| theses issues? Or is there still the same risk as a more
| traditional VPN provider?
| jscd wrote:
| This is not providing the same functionality as a "traditional
| VPN," in the sense that it does not do anything to your traffic
| going to the wider internet. With popular VPN services, they
| are an encrypted tunnel for all your internet traffic (some use
| the same protocol, WireGuard), but at the end of the tunnel
| they decrypt the message and send it to whatever website you
| requested, which is exactly what can cause those privacy issues
| you describe.
|
| In this case, though, it creates an encrypted tunnel _only
| between your own devices_. This allows you to connect to all
| your devices, home desktop, phone, laptop, as if they were on
| the same network, allowing you to do fairly sensitive things
| like remote desktop without having to expose your machine to
| the public internet or deal with firewall rules in the same
| way.
|
| Assuming this project is legitimate, then the only traffic this
| service would even touch would be those between your own
| devices, nothing related to public internet requests. And, on
| top of that, the requests should be encrypted the entire way,
| inaccessible to any devices other than the ones sending and
| receiving the requests.
|
| There are many caveats and asterisks I could add, but I think
| that's a fairly straightforward summary.
| pcarroll wrote:
| To clarify, one of the big advantages of a Mesh VPN is that the
| traffic does not flow through the VPN provider at all.
| WireGuard encrypts the traffic from device interface to device
| interface. The connections are point-to-point and not hub-and-
| spoke. This is both faster and more secure.
|
| If a direct connection cannot be established due to a very
| restrictive firewall or a messed-up ISP modem, it will fall
| back to a relay server. But in that case, the relay relays the
| traffic, but it does not have the keys to read it.
|
| You can learn more here: https://www.wireguard.com/
|
| TL;DR WireGuard itself is a relatively small project at roughly
| 4,000 lines of code. It has been thoroughly audited and is even
| built into the Linux kernel.
| ImPleadThe5th wrote:
| Naive question here: with WireGuard VPN, does all traffic route
| through the VPN or only those packets bound for the other devices
| in the mesh?
| pcarroll wrote:
| WireGuard itself can be configured to work either way.
|
| Our target market is smaller teams and people with limited IT
| skills. So, we chose not to send all traffic through the vpn.
| The only traffic going through the VPN is traffic to and from
| your other devices (in your account). Internet access is still
| through your default network.
|
| In the Pro version, you can route specific destinations through
| other peers, also belonging to you. An example use case here
| would be accessing your web banking while on vacation in a
| distant country. You would route your bank website through your
| home connection.
|
| Similarly, our access control is only restricting traffic that
| comes from your devices on the wireguard network. We do not
| interfere with the settings of your own personal firewall.
| ImPleadThe5th wrote:
| Thanks for taking the time to answer! I think I'll be giving
| this a shot for some upcoming projects.
| infogulch wrote:
| For WireGuard in general, you provide it an AllowedIPs config
| which is a list of CIDR ranges that should be routed across the
| link. That could be `0.0.0.0/0` (aka everything), a single
| subnet, a union of several, or even individual IPs. This config
| is technically symmetric between the endpoints, though a
| prototypical implementation of "individual clients enable the
| VPN to access the internal network" may limit the "client"
| AllowedIPs to an individual address.
| nodesocket wrote:
| I use Twingate both for personal use (my home) and to access AWS
| EC2 servers (no public ips) and really love it. Very polished,
| easy setup. How does Netrinos compare?
| pcarroll wrote:
| We do have some comparisons on our site...
|
| https://netrinos.com/compare
|
| Thanks
| focusgroup0 wrote:
| >We use STUN-style discovery and relay fallback
|
| How does your relay compare to Tailscale's (DERP)?
| pcarroll wrote:
| We implement STUN and TURN/DERP using native WireGuard rather
| than separate protocols.
|
| Netrinos uses a central rendezvous server that participates in
| WireGuard handshakes solely to collect your devices' public
| endpoints and share that information with your other devices.
| When a device roams to a new location, the server learns the
| new endpoint and updates the other devices in your account.
|
| When direct P2P fails, Netrinos falls back to a relay server.
| The relay is a WireGuard peer, but it does not have the keys to
| decrypt your traffic. Your devices negotiate keys directly with
| each other, so the relay just forwards opaque encrypted
| packets.
|
| If you are particularly security conscious, you can host your
| own relay server. Enable it with a checkbox in the app. This
| could be a home PC with a stable connection, or a $5 cloud
| server account.
|
| Updated: Original answer did not address DERP
| windexh8er wrote:
| Well, I wish you the best with this - but I really don't
| understand the target market.
|
| The obvious competitor here is Tailscale. But let's say, reasons,
| and Tailscale isn't an option. Then you go down the path...
| TwinGate, Teleport, Netbird, Pomerium, Netmaker, ZeroTier, etc...
|
| Even the initial pricing and free tier are you're up against are
| going to mostly be a deal breaker compared to what's out there.
|
| Trusting a VPN provider is a lot. If you're running the control
| plane - why should I trust Netrinos?
| atmosx wrote:
| Isn't that true for any new service out there? What's the
| market for a search engine? And yet kagi.com is a thing.
| j45 wrote:
| Kind of confusing to expect zero competition for a valid
| opportunity, then you're a category founder with an uphill
| battle to educate the customer for free, fail, and let the next
| co swoop in.
| 1vuio0pswjnm7 wrote:
| "Well, I wish you the best with this - but I really don't
| understand the target market."
|
| "After years of SSH tunnels, IPsec headaches, and the ssh log
| horror movie, I wanted something simpler: install, sign in, get
| work done."
|
| "Target market" could be the author
|
| There's no good reason to discourage people from writing
| overlays, unless one is doing so for commercial (i.e., anti-
| competitive) reasons
|
| A more interesting question might be, "In your opinion, what is
| unsatisfactory about XYZ that does essentially the same thing"
|
| For example, one might be a Layer 2 overlay whilst the other is
| Layer 3
|
| Maybe we'll never have web browser diversity (or meaningful
| competition) as the web browser has become an instrument of
| surveillance and advertising controlled by "Big Tech", but
| overlay diversity (and competition) is still a possibility
|
| If everyone thought IPsec and OpenVPN was "good enough" then
| Wireguard and Tailscale would not exist
|
| I still use an unpopular non-commercial L2 overlay from before
| Wireguard existed that is smaller and faster than anything else
| I have ever seen
|
| IMHO, the more overlays that exist, the better
| drcongo wrote:
| I have been down that path and found Twingate, Netbird,
| Netmaker and Zerotier lacking in one way or another, not tried
| those other two yet though.
| mrbluecoat wrote:
| Any plans for Exit Node capability (traditional egress VPN)?
| pcarroll wrote:
| Pro has that. We call it a Gateway. See:
|
| https://netrinos.com/help/gateways-routing
|
| You can also have multiple gateways and send traffic through
| different locations. e.g. You can access a NAS on one site and
| a website through another.
| drcongo wrote:
| I only use Tailscale for two features - one is having every
| machine on the network use a logical name of the pattern
| {projectname}-{environment} ie: `ssh me@hn-prd` and the other is
| exit nodes. I couldn't work out from your site if either of these
| two things is doable here.
___________________________________________________________________
(page generated 2025-12-22 23:00 UTC)