[HN Gopher] Tailscale Peer Relays is now generally available
___________________________________________________________________
Tailscale Peer Relays is now generally available
Author : sz4kerto
Score : 277 points
Date : 2026-02-18 16:46 UTC (6 hours ago)
(HTM) web link (tailscale.com)
(TXT) w3m dump (tailscale.com)
| tda wrote:
| I just set this up the other day, and I got my ping to drop from
| 16 to 10ms, and my bandwidth tripled, when connecting from a
| remote natted site to a matter desktop my house. Together with
| Moonlight/Sunshine I can now play Windows games on my Linux
| desktop from my MacBook, with 50mbps/10ms streaming. So far so
| good!
|
| Not a single port forwarded, I just set my router up as peer
| node.
| arjie wrote:
| What hardware do you use on the networking side?
| tda wrote:
| Nothing special, an edgerouter that allows installing
| tailscale
| aborsy wrote:
| There are several ports open (you dont open them, Tailscale
| does), including for peer relay. Some are vpn ports, but the
| ports for relay servers are not for VPN so my guess is that the
| software that listens to those ports is a lot less secure
| (compared to Wireguard or OpenVPN).
| tda wrote:
| Yes my router has open ports, but it does not do any port
| forwarding. So I can 'directly' connect any device behind my
| router without my router needing to know any specifics of
| which device that is. And I don't need to do any port
| forwarding of anything on my network and thus expose them to
| the whole internet; I just expose them to the users of my
| tailscale network (only me)
| toomuchtodo wrote:
| Does your router not support UPNP for dynamic port
| punching?
| bityard wrote:
| UPnP allows literally any random piece of software inside
| your network to open and forward arbitrary ports on your
| firewall. Bad idea!
| toomuchtodo wrote:
| Within my risk appetite on trusted network segments. I
| have bigger issues if malware is operational within the
| trust boundary, it can do what it needs using outbound
| connections just fine (recon, lateral movement, etc).
| Your risk appetite might differ.
| nickburns wrote:
| Neat use case. But in fairness, you've simply 'offloaded' NAT
| traversal/port forwarding to automagic helper protocols over
| which you have no control even if you wanted it.
| FrenchTouch42 wrote:
| May want to give Apollo a try:
| https://github.com/ClassicOldSong/Apollo (re Sunshine)
| stavros wrote:
| Why?
| tietjens wrote:
| It handles virtual displays better in case you want your pc
| screen to be off while streaming. There might be other
| reasons.
| stavros wrote:
| Oh nice, virtual displays is a feature I've been wanting,
| thanks!
| jak6jak wrote:
| That seems really exciting! If you wanted to share game
| streaming to a general public would they have to install
| tailscale on their device/login? How does that work? Am I right
| in assuming that tailscale is built mostly for sharing
| resources with people you trust instead of the general public?
| behnamoh wrote:
| How does Tailscale make money? I really like their service but
| I'm worried about a rug pull in the future. Has anyone tried
| alternative FOSS solutions?
|
| Also, sometimes it seems like I get rate limited on Tailscale.
| Has anyone had that experience? This usually happens with
| multiple SSH connections at the same time.
| tiernano wrote:
| It's free for up to 3 users. After that you need to start
| paying.
| criddell wrote:
| I have a family of 4 so I pay and it's still crazy cheap.
| I've wonder how sustainable it is.
| prodigycorp wrote:
| I love tailscale but you may be right, it's entering that
| acquisition zone that'll inevitably bum everyone out.
|
| Salesforce, stay away from it!
| politelemon wrote:
| Dearest Salesforce, Apple, Oracle, and IBM. Please look
| elsewhere for acquisitions to ruin for everyone. Cheers.
| tomxor wrote:
| I have the same fears. Last year they have publicly stated
| they are not interested in acquisition [0]
|
| > Pennarun confirmed the company had been approached by
| potential acquirers, but told BetaKit that the company
| intends to grow as a private company and work towards an
| initial public offering (IPO).
|
| > "Tailscale intends to remain independent and we are on a
| likely IPO track, although any IPO is several years out,"
| Pennarun said. "Meanwhile, we have an extremely efficient
| business model, rapid revenue acceleration, and a long runway
| that allows us to become profitable when needed, which means
| we can weather all kinds of economic storms."
|
| Nothing is set in stone, after all it's VC backed. I have a
| strong aversion to becoming dependent upon proprietary
| services, however i have chosen to integrate TS into my
| infrastructure, because the value and simplicity it provides
| is worth it. I considered the various copy cat services and
| pure FOSS clones, but TS are the ones who started this space
| and are the ones continuously innovating in it, I'm onboard
| with their ethos and mission and have made use of apenwarrs
| previous work - In other words, they are the experts, they
| appear to be pretty dedicated to this space, so I'm putting
| my trust in them... I hope I'm right!
|
| [0] https://betakit.com/corporate-vpn-startup-tailscale-
| secures-...
| nerdsniper wrote:
| Would be curious if a partial decompilation and short
| static analysis would yield any reliable info about what
| they might be collecting.
| omnimus wrote:
| Just note i doubt Tailscale were first popular vpn manager
| as i remember many hobby users are Zerotier converts and
| also much older products like Hamachi.
|
| Tailscale have build great product around wireguard (which
| is quite young) and they have great marketing and docs. But
| they are hardly first VPN service - they might not even be
| the most popular one.
| tomxor wrote:
| Yes, I ambiguously said "started this space"... and to be
| honest even in the most generous interpretation that's
| probably incorrect, maybe ZeroTier started "this space",
| in that it had NAT busting mesh networking first.
|
| As far as I understand Tailscale brought NAT busting mesh
| networking to wireguard + identity first access control,
| and reduced configuration complexity. I think they were
| the first to think about it from an end to end user
| perspective, and each feature they add definitely has
| this spin on it. It makes it feel effortless and
| transparent (in both the networking use sense and
| cryptography sense)... So i suppose that's what I mean by
| started, TS was when it first really clicked for a larger
| group of people, it felt right.
| tietjens wrote:
| Might be time to learn me some Wireguard.
| evmar wrote:
| They wrote a blog post addressing this concern:
| https://tailscale.com/blog/free-plan
| riknos314 wrote:
| The Tl;Dr here is that the cost to them of operating the free
| tier is lower than what they estimate their Customer
| Acquisition Cost would be without a free tier, so the free
| tier generates better leads/conversions to their paid
| products at a lower cost than traditional sales and
| marketing.
|
| As long as these economics continue to hold they'd be stupid
| to discontinue the free tier.
| wat10000 wrote:
| All it takes is for the decision-maker who gets the credit
| for cutting costs by removing the free tier to be a
| different person from the one who gets the blame for higher
| customer acquisition costs. Not saying it'll happen, just
| that it being a bad move isn't a guarantee.
| eleventyseven wrote:
| But it isn't 'economics' as there is no actual data or
| science here, just a wild guess about what customer
| acquisition might currently cost. All it takes to rug pull
| is some exec speculating that 'the economics' have changed.
| dagi3d wrote:
| Acquisition cost can definitely be calculated. I'm pretty
| sure they know how many customers do convert into paying
| users from their free tier and how much does it cost to
| get them through other channels
| erikpukinskis wrote:
| Any mature SaaS company will have exact measurements of
| acquisition costs. This is advertising, sales staff, etc.
|
| This is one the the most fundamental components of SaaS
| accounting, it's absolutely not a "wild guess".
| roughly wrote:
| > But it isn't 'economics' as there is no actual data or
| science here, just a wild guess
|
| Welcome to economics.
| hashstring wrote:
| Makes me wonder.
|
| Say 5% of the free tier users converts to a paying customer
| within 5 years. And user growth is constant. Then over
| time, you will get a much larger free tier user base,
| compared to your paying customers (in absolute numbers). At
| some point, it must become tempting to charge all free tier
| users a little bit to continue, because the group got so
| big, so there is a lot that can be earned there.
|
| Is this wrong, or should we expect this?
| tokioyoyo wrote:
| Cloudflare still operates like this.
| gz5 wrote:
| OpenZiti (Apache 2.0):
|
| https://github.com/openziti/ziti
| bityard wrote:
| This is a secure mesh network, but it appears to be for
| embedding into applications, not a "private VPN" like
| Tailscale, or do I misunderstand?
| nsbk wrote:
| At this point Tailscale is working so well and I'm so happy
| with it that I'm afraid it's time to start migrating to
| Headscale [0] for my home network. The rag pull may just be too
| painful otherwise!
|
| [0]: https://headscale.net/
| sureglymop wrote:
| I've been smoothly running headscale on a hetzner vps for
| many months now. Works without issues (note that it does lack
| some features still).
| ErneX wrote:
| Same here.
| vizzier wrote:
| > Also, sometimes it seems like I get rate limited on
| Tailscale.
|
| As I understand it if everything is working properly you should
| end up with a peer to peer wireguard connection after initial
| connection using tailscales infrastructure. ie, there should be
| nothing to rate limit. There are exceptions depending on your
| network environment where you need one of the relays noted in
| this post.
|
| As for opensource alternatives:
|
| https://github.com/juanfont/headscale can replace tailscales
| initial coordination servers
|
| and https://netbird.io/ seemed to be a rapidly developing full
| stack alternative.
| arsome wrote:
| Headscale also offers a relay server of its own.
| eurg wrote:
| Companies pay for it. And except for their DERP servers, free
| users don't cost them much.
| thecapybara wrote:
| I self-host a few apps and use Tailscale to access them
| remotely. It's worked well, so I recommended it as a possible
| solution to allow employees at my company to remotely access
| some on-prem resources while remote, and that's being
| considered. If we go with that, then that'd be Tailscale making
| money from me using the free plan.
| dimatura wrote:
| Our company pays for the premium business plan, $18/mo/user.
| You have to pay for at least the lower tier plan once your team
| grows beyond a handful of people. And there's several quite
| useful features (though maybe not essential) on the premium
| plan like serve/funnel and SSH.
|
| On the other hand, I do wonder about zerotier. before tailscale
| we used zerotier for a few years, and during the first 3-4
| years we paid nothing because as far as I can recall there was
| nothing extra that we needed that paying would've gotten us.
| Eventually we did upgrade to add more users, and it cost
| something like $5/mo (total, not per user).
| gpm wrote:
| I've used serve/funnel on the tailscale free tier...
| definitely agree that the team size limit seems like it would
| move companies to the paid plan though.
| dimatura wrote:
| I think how it works usually is that they let you use the
| features from higher tier plans than the one you're on;
| once you use them enough they send you an email asking to
| upgrade. That's what happened to us and I've seen other
| users mention it. Not sure how I felt about it, OTOH maybe
| it was less friction than explicitly subscribing for some
| "2 weeks free trial" or whatever but OTOH it did feel weird
| and unexpected. Anyway, we felt the extra features were
| worth it so ended up paying.
| tamimio wrote:
| Zerotier is not the same as tailscale although both can be
| used to do the same, but under the hood both are
| fundamentally different, ZT is layer2 like switch, so it's
| like an Ethernet meanwhile TS is built on top of wireguard
| and is layer3. ZT allows broadcast/multicast and has own
| protocol, TS don't. I use both among others, and ZT since
| around 2019, I found it reliable in some cases in IoT world
| while TS had better throughput in usual applications.
| dimatura wrote:
| Yeah, they're not direct replacements. I think both models
| have have their pros and cons. In fact I tried both around
| when covid shutdowns started (server being in the office,
| me at home), and liked zerotier better; it was faster, and
| a more generous free tier. But now tailscale has won out
| for a couple of reasons; the main one, it's simply less
| flaky for us on macOS, especially for devs working
| overseas. No idea why and maybe there's simple fixes (that
| don't involve repeated connections/disconnections,
| hopefully). The other, tailscale has a few extra things
| that are nicer and easy to use like identity-based ACLs,
| funnel/serve, magicDNS, ssh management, etc.
| lysace wrote:
| How do you handle the do-before-thinking devs? Or the kinda
| low-to-mid performing devs? Most companies has one or a few
| of those, right? They help the company machine go around by
| doing the somewhat boring stuff over and over again.
|
| Tailscale in a company/developer env seems awesome when you
| know what you are doing and (potentially) terrifying
| otherwise.
|
| Does someone set up detailed ACLs for what's allowed? How
| well does that work?
| madeofpalk wrote:
| > How do you handle the do-before-thinking devs?
|
| Isn't that exactly what tailscale is built to accommodate -
| zero trust?
|
| You set up ACLs and other permissions to not allow people
| to do more than the damage you can tolerate.
| nickburns wrote:
| Zerconf [?] zero trust. The difference could not be more
| material in this context.
| tonyplee wrote:
| If both sides of your ssh tunnel (pub,private keys) are
| under your control, in theory, that's "zero trust".
|
| Unless one considers the meta data such as src/dest IP
| are visible to Tailscale sw.
|
| Right?
| nickburns wrote:
| 'Zero trust' has a technical definition that's not really
| relevant here. See:
| https://en.wikipedia.org/wiki/Zero_trust.
|
| The concept is separate from 'zero config'
| (https://en.wikipedia.org/wiki/Zero-
| configuration_networking), which Tailscale's low
| technical barrier to entry evokes.
| Aurornis wrote:
| Tailscale is a perfect example of using a free tier to become
| popular with developers, who then evangelize the product to
| their employers. The employers pay for business scale plans.
| zephen wrote:
| I wonder about this.
|
| The hoops you have to jump through to be on two different
| tailnets might dissuade some home users from even bringing it
| up at work.
| baq wrote:
| Home users being on multiple tailnets is serious power user
| territory
| mrsssnake wrote:
| Free personal tier is basically a cheap advertisement for them.
| You try Tailscale personally and get used to it, then it is
| very likely you would want to deploy it at your work seeing the
| benefits scaling even more with more people. And then they make
| money.
| QuercusMax wrote:
| 1000%. Tailscale is the first VPN I've used that makes my
| life easier, and I'm using it for personal access to my
| selfhosted servers at home. I will definitely recommend it to
| companies I work for in the future.
| Lammy wrote:
| > How does Tailscale make money?
|
| They spy on your network behavior by default, so free users are
| still paying with their behavioral data. See
| https://tailscale.com/docs/features/logging
|
| "Each Tailscale agent in your distributed network streams its
| logs to a central log server (at log.tailscale.com). This
| includes real-time events for open and close events for every
| inter-machine connection (TCP or UDP) on your network."
|
| They know what you're doing, when, from where, to where, on
| your supposedly "private" network. It's possible to opt out on
| Windows, on *nix systems, and when using the non-GUI client on
| macOS by enabling the FUD-named "TS_NO_LOGS_NO_SUPPORT" option:
| https://tailscale.com/docs/features/logging#opt-out-of-clien...
|
| It is not currently possible to opt out on iOS/Android clients:
| https://github.com/tailscale/tailscale/issues/13174
|
| For an example of how invasive this is for the average user,
| this person discovered Tailscale trying to collect ~18000 data
| points per week about their network usage based on the number
| of blocked DNS requests for `log.tailscale.com`:
| https://github.com/tailscale/tailscale/issues/15326
| nickburns wrote:
| Pretty much this. DNS, SNI, and otherwise plaintext traffic
| sniffing. That together with user/device 'fingerprinting' (a
| much more amorphous concept), and that's why such-and-such
| thing you were just talking about with so-and-so pops up on
| your screen/feed/whatever, sometimes only minutes later.
|
| I highly doubt any of this can actually be opted-out of. How
| else would they stay in business?
| namtim wrote:
| The `TS_NO_LOGS_NO_SUPPORT` option opts out of all log
| collection, and says in the name why it is collected in the
| first place. Tailscale has support for all users, including
| free, and having access to logs has to be how they can
| provide free support. Having quick access to logs reduces
| the time it takes to handle tickets, so they can help more
| people quickly and don't need to limit support to only
| paying users.
|
| The core client code is open source, feel free to inspect
| it yourself.
| nickburns wrote:
| The client may be open source. But the service is
| obviously not.
|
| Don't let that deter you from trusting whomever you
| choose, though.
| jzelinskie wrote:
| I'd love to have someone else chime in on this because I did
| some spelunking and am not sure if this comment is true.
|
| I checked my DNS logs and saw zero attempts to resolve
| `log.tailscale.com` having ran tailscale for many years (I
| added it to a blocklist anyway). From their admin panel, it
| appears "networking logging" requires paying for Premium[0],
| so it's not being used for free users (or Personal Pro).
|
| Also, from looking at some source code (because the docs
| don't include this), I discovered you can disable logging for
| the macOS App Store client by doing: echo
| "TS_NO_LOGS_NO_SUPPORT=true" >
| ~/Library/Containers/io.tailscale.ipn.macos.network-
| extension/Data/tailscaled-env.txt
|
| [0]: https://login.tailscale.com/admin/logs/network
| zaphar wrote:
| There are a number of features and teamsizes that they provide
| where you have to pay money. Most company users are going to
| end up paying them money. But also their emphasis on P2P
| connections means their costs are quite low. It doesn't add
| much overhead to have the smallish number of personal users out
| there. They've talked about how having the free tier helps to
| force them keep those costs down in useful ways.
| dec0dedab0de wrote:
| Wouldn't the FOSS alternative be to simply use wireguard?
| iso1631 wrote:
| Most posters on HN barely know what a subnet is so it's not
| that simple
|
| There's two key features
|
| 1) Tunnel management
|
| Tailscale will configure your p2p tunnels itself - if you
| have 10 devices, to do that yourself you'd have to manage 90
| tunnels. Add another device and that goes upto 100. Remove a
| device and you have 9 other devices to update.
|
| 2) Firewall punching
|
| They provide an orchestration system which allows two devices
| both behind a nat or stateful firewall to communicate with
| each other without having to open holes in the firewall
| (because most firewalls will allow "established" connections
| - including measuring established UDP as "packet went from
| ipa:porta to ipb:portb 'outbound', thus until a timeout
| period any traffic from ipb:portb to ipa:porta will be let
| through (and natted as appropriate)".
|
| The orchestration sends traffic from ipa to ipb and ipb to
| ipa on known ports at the same time so both firewalls think
| the traffic is established. For nats which do source-port
| scrambling it uses the birthday paradox to get a matching
| stream.
|
| I believe you can run a similar headend using "headscale"
| yourself.
| NoiseBert69 wrote:
| Yes and no. It's much manual work to get WG to behave like
| Tailscale.
| newsoftheday wrote:
| I do, I use a VPS (at OCI free) to host Wireguard. My home
| systems (running my production web sites and email) are on my
| VPN and mine and my wife's phones. I hand configured it all
| but it wasn't difficult for me.
| Suffocate5100 wrote:
| Nebula is what we use. It's definitely not as convenient, but
| it's 100% self-ownable.
| allthetime wrote:
| Facilitating peer to peer connections is cheap.
|
| Just like cloudflare, a healthy free offering makes lots of
| happy/loyal users. Some of those users have business needs /
| use for the paid features and support.
| allthetime wrote:
| Facilitating peer to peer connections is cheap.
|
| Just like cloudflare, a healthy free offering makes lots of
| happy/loyal developer users. Some of those users have business
| needs / use for the paid features and support and will convince
| their managers to buy in.
| pkulak wrote:
| I pay $5 a month, and my company has a license for every
| employee.
| fdefitte wrote:
| If you're worried about a rug pull, you should be. Not because
| Tailscale is shady, but because that's just how VC-funded
| infrastructure works. The free tier exists to build lock-in,
| not out of generosity. Headscale exists but honestly it's a
| pain to run compared to just paying Tailscale $18/user. The
| real answer is: if it's critical infrastructure, you should be
| running Wireguard directly and owning the coordination layer
| yourself. Everything else is renting convenience.
| batrat wrote:
| It happened to others but there are also some very good
| examples like Veeam community edition which, IMO, is the best
| backup software. They had lots of discussions and even
| pressure from management to terminated, but the numbers made
| a lot of sense and they kept it. Tailscale is in disadvantage
| here because they are in a very crowded market and it will be
| very easy to slip into one corner and let way for others like
| netbird, netmaker, nebula(?), wireguard (like u said), etc.
| itissid wrote:
| I have my homenas set up with Node Proxy Manager container
| forwarding requests to different docker machines:ports e.g. I
| have some TTS/STT/LLM services locally hosted. To increase
| bandwidth to internet facing nodes, would you use this or some
| other simpler solution?
| tecleandor wrote:
| Is it a typo and it's the Nginx Proxy Manager?
| mikepurvis wrote:
| I assume so; I use the same thing with my Unraid box and then
| create the DNS entries in the unifi panel so I get
| jellyfin.lan, minecraft.lan, etc inside the house.
| itissid wrote:
| Oh yeah Nginx* not Node.
| jahrichie wrote:
| Are you guys using this for OpenClaw or what?
| nsbk wrote:
| One of the many use cases, but basically yes. Other use cases:
| Home automation, remote backups, media servers, photo
| libraries, AI assistants... you name it!
| josefresco wrote:
| I use it only as a Personal VPN - works great!
| dwedge wrote:
| It's a vpn from the original definition before vpn meant a
| proxy to get around geoblocks. I use tailscale for my home
| servers, my routers, for servers I have in other houses all
| behind NAT. I have half a dozen raspberry pi print servers in
| two warehouses also behind NAT and they can connect to each
| other and I can connect to them from CGNAT
| aborsy wrote:
| Is peer relay essentially a custom relay which was previously
| available, except now it's one command?
|
| So it runs a STUN server or similar, for discovery and relaying.
| kabirx wrote:
| Peer relays are a bit different from our previously available
| Custom DERP servers. While the custom DERPs do relay traffic,
| they also require a bunch of configuration and management for
| their other jobs and they open up availability concerns that
| are pretty tough for our average customer.
|
| Conversely Peer Relays are built on top of the shoulders of
| DERP. For example, they don't need to do peer discovery set
| connections up end to end - instead connections are brokered
| via our DERP fleet and then in a sense "upgraded" to an
| available Peer Relay or Direct connection. Because of that
| they're super lightweight and much easier to deploy + manage.
| And, they scale horizontally so you can deploy many peer relays
| across your network, and they're resilient to downtime (we'll
| just fall back to DERP).
| shj2105 wrote:
| I'm so confused. What is the difference between a peer relay
| and a DERP server that is self hosted?
|
| The issue I have is I'm trying to connect two devices where
| one is behind a CGNAT that always causes the connection to be
| relayed even though the other one is not behind a cgnat with
| proper port forwarding. Would a peer relay solve this but is
| it like a DERp where I have to host it on a VPS separate from
| my existing two networks or is this something different where
| I can host the peer relay on the network not behind a CGNAT
| and somehow it will link the two networks through it?
| kabirx wrote:
| You should be able to stand up a peer relay on an existing
| tailscale device - so your proposal is correct! Try setting
| one of the devices up as a peer relay per the docs here:
| https://tailscale.com/docs/features/peer-relay
| himata4113 wrote:
| I never brought my self to use tailscale because it has a login
| screen and I absolutely despise that even as a concept for a
| private NAT. I know headscale exists, but it doesn't seem to even
| support the features I really want.
| earthscienceman wrote:
| I can't believe this isn't a show stopper for more people here.
| I literally couldn't figure out how use it the first time tried
| because I didn't know how to comprehend that it was trying to
| get me to auth via browser window. I kept digging around for a
| tailscale.conf.
|
| Which is then when I realized it was less a piece of software
| and more so an auth management provider with some vaguely
| helpful auxillary services.
| yuvadam wrote:
| Tailscale simp here, been using this feature since it launched in
| beta, can't believe it didn't exist earlier.
|
| This solved every last remaining problem of my CGNAT'd devices
| having to hop through STUN servers (with the QoS being
| noticable), now they just route through my own nodes.
| hashstring wrote:
| Why does STUN impact your QoS? I thought STUN was just for
| discovering your own external IP/port.
| kittbuilds wrote:
| The peer relay approach is interesting because it essentially
| turns every node in your tailnet into a potential relay for other
| nodes. This is a meaningful architectural shift from relying on
| Tailscale's centralized DERP servers.
|
| For anyone worried about the "rug pull" concern raised in another
| comment -- this actually makes me more optimistic, not less. By
| distributing relay infrastructure to the edges, Tailscale is
| reducing its own operational cost per user while improving
| performance. That's the kind of flywheel that makes a generous
| free tier more sustainable, not less. Each new node potentially
| helps the whole network.
| drnick1 wrote:
| It's a bit disingenuous to present solutions like Tailscale as
| more secure than opening a VPN port on one's on machine. The
| latter solution should always be preferred when available just
| because you don't want your infrastructure to depend on a "free"
| service which might cease to be free tomorrow.
| nickburns wrote:
| Things are _much_ more unscrupulous than potentially ceasing to
| be free tomorrow. Nobody who values their privacy would ever
| route their network traffic through a 'free' service.
| jon_adler wrote:
| Isn't there separation of the control and data planes? I
| don't think Tailscale get to see any of your network traffic.
| nickburns wrote:
| They need to know how/where to route your outbound traffic.
| That inherently includes plaintext DNS, TLS handshakes, and
| otherwise plaintext traffic (like HTTP for example).
|
| Anybody wanting to see what Tailscale is able to see can
| simply sniff any router interface passing outbound traffic
| before it enters the WireGuard tunnel interface.
| drannex wrote:
| This is a more all-included and resilient system, especially
| for logging, than just opening a VPN port. I do a lot of
| corporate installs, and if we had a system like Tailscale then
| I would be in heaven. The amount of user-created systems are
| heinous in regards to security, and hard to setup and keep
| running. Tailscale lets you setup quickly, and reliably with
| minimal errors OOTB.
|
| If you feel that tailscale will fold, or the free plan will be
| future limited, then you can drop in headscale which is a near
| 1:1 API open source tailscale central server.
|
| If you _always_ want to be open source and not rely on API
| changes or staying up to green on the headscale development
| (made by a third party), then you can set up netbird, which is
| both hosted (for free) as an alternative to Tailscale more
| tailored for developers, but they also open-sourced their
| entire stack, so you can always leave and use that on your own
| servers.
| adithyassekhar wrote:
| I wish I could read this but got this[0] guy on mobile with no
| close button, won't close when you click outside the modal.
|
| 0:
| https://i.postimg.cc/14h3Q9mD/Screenshot-20260219-001356-Chr...
|
| Edit: Nvm, found it. Weird place to put it.
| yardstick wrote:
| I see a white X in a blue box to the lower right of the modal.
| Is it that?
| adithyassekhar wrote:
| That was it, ok now I feel stupid.
| a_wild_dandan wrote:
| You're not stupid. That's terrible UX. The button is
| completely disconnected from its modal, and is placed in a
| bizarre/nonstandard location.
| ChrisClark wrote:
| It's placed like one of those chat services on sites.
| Which we've been trained to ignore.
| yardstick wrote:
| Sounds like a bug in their css layout related to the
| smaller screen size
| drannex wrote:
| Oh man, I even read all the comments and _still_ couldn 't
| find it when I finally clicked on the image link. Terrible
| UX.
|
| cc: @apenwarr (tailscale founder), might want to have
| someone fix this and move the close button to the top right
| of the modal, not the bottom right.
| shj2105 wrote:
| I'm so confused. What is the difference between a peer relay and
| a DERP server that is self hosted?
| allthetime wrote:
| Talking out my ass, but as with all things Tailscale, not much,
| aside from easier to use / less manual setup.
|
| Nothing they do was impossible before, but their big win is
| making world wide private networking easy and accessible.
|
| I've been on-boarding my friends who have their own local media
| servers setup so we can all share/stream content from each
| other.
| apenwarr wrote:
| (Tailscale founder here) Two main differences: first, every
| DERP server used by your tailnet must be accessible by every
| node on your tailnet at all times, otherwise you get hard-to-
| debug netsplits. That's a very high bar to maintain so we've
| historically recommended you don't try. In contrast, peer
| relays are "if a given pair of nodes can connect through any of
| the relays, go for it" so deploying one is always a performance
| and reliability improvement.
|
| Secondly, peer relays support UDP while DERP is TCP-only. That
| would be fixable by simply improving the DERP protocol, but as
| we explored that option, we decided to implement the Peer Relay
| layer instead as a more complete solution.
| shj2105 wrote:
| Hmm got it not sure I entirely understand. The issue I have
| is I'm trying to connect two devices where one is behind a
| hard CGNAT that always causes the connection to be relayed
| even though the other one is not behind a cgnat with proper
| port forwarding. Would a peer relay solve this but is it like
| a DERP where I have to host it on a VPS separate from my
| existing two networks or is this something different where I
| can host the peer relay on the same network not behind a
| CGNAT and somehow it will link the two networks through it?
| kwakubiney wrote:
| > every DERP server used by your tailnet must be accessible
| by every node on your tailnet at all times, otherwise you get
| hard-to-debug netsplits.
|
| What would allow a given pair of nodes access a peer relay?
| Isn't the peer relay by default also accessible by every node
| on the tailnet since it's in the tailnet as well?
| xeonmc wrote:
| What happens if your peer relay device is behind
| CGNAT/SymNat?
|
| Also, offtopic question: is Tailscale named after the idea of
| UDP packets "tailgating" a connection?
| alberto_delrio wrote:
| Tried the other day, honestly so far surprised by the good
| results!
| ZoomZoomZoom wrote:
| If you're sold on Tailscale due to them "being open" (as they
| semi-officially support the development of Headscale), keep in
| mind, that at the same time some of their clients are closed
| source and proprietary, and thus totally controlled by them and
| the official distribution channels, like Apple. Some of the
| arguments given for this stance are just ridiculous:
|
| > If users are comfortable running non-open operating systems or
| employers are comfortable with their employees running non-open
| operating systems, they should likewise be comfortable with
| Tailscale not being open on those platforms.
|
| https://github.com/tailscale/tailscale/issues/13717
|
| A solution like this can't really be relied in situations of
| limited connectivity and availability, even if technically it
| beats most of the competition. Don't ever forget it's just a
| business. Support free alternatives if you can, even if they
| underperform by some measures.
| xyst wrote:
| I switched to Netbird because of this.
| 8cvor6j844qw_d6 wrote:
| Went with ZeroTier and Netbird, they're not too bad.
| drcongo wrote:
| I keep hoping to switch to Netbird, but run into the same
| issue every time for the last couple of years I've been
| trying it - peers randomly drop of the network. There's a
| longish standing open issue on their GitHub.
| wolvoleo wrote:
| Zerotier is a lot harder to self-host than tailscale
| uneekname wrote:
| I've been relatively happy with Headscale, but now that I have
| MacOS/iOS users I'm in the process of testing alternatives like
| Netbird. I was also surprised that the Tailscale Kubernetes
| operator is not compatible with Headscale.
| dblohm7 wrote:
| (Tailscalar here) To be clear: it's only the GUIs that are
| closed source on selected platforms.
| colordrops wrote:
| Does that include android?
| jbott wrote:
| https://github.com/tailscale/tailscale-android
| colordrops wrote:
| Nice, thanks.
| Lammy wrote:
| Being open source means very little when they won't merge
| PRs, like this one to support disabling streaming one's
| network behavior to ` log.tailscale.com`:
| https://github.com/tailscale/tailscale-android/pull/695
| stavros wrote:
| Let's stop moving the goalposts. Open source has a
| specific definition, and "they merge whatever code I want
| them to" isn't part of it. Just fork the client, compile
| it, and run it yourself.
| Lammy wrote:
| "Just" lmfao
|
| Versus any mildly-technical user being able to stumble
| into the option and discover they're being spied on in
| the first place.
| drcongo wrote:
| Open source = I should be able to fork it, change it, and
| use it
|
| Open source = The maintainers should build exactly what I
| hysterically scream at them
|
| If I had to choose one definition of open source from
| these two options, it's going to option 1 I'm afraid.
| DyslexicAtheist wrote:
| can you say more about this. I've been considering adding
| tailscale to some products but if my (nerd) perspective is to
| survive corporate realism I need more than a 1-liner to
| justify. seriously curious. Also how would I pitch it to a EU
| based crowd that wants increasingly less to do with US based
| tech?
| ZoomZoomZoom wrote:
| I stand corrected.
|
| Although, the problem is not so single-layered. Do I
| understand the situation correctly, in case of iOS, to not be
| subject to additional limitations of the platform that
| restricts the distribution of your products to the extents
| that the laws of the countries where your business is
| registered require, all the user has to do is to fork the
| main repo (which is, thankfully, BSD), build a minimally
| acceptable GUI, pass Apple certification, publish the app in
| the app store, and Bob's your uncle?
| 1vuio0pswjnm7 wrote:
| "Support free alternatives if you can, even if they
| underperform by some measure."
|
| I value _control_ more than I do performance
|
| Better performance is, IMHO, not a reason to sacrifice
| _control_, but that's just me
|
| If users have control, i.e., can compile from source, then in
| theory performance improvement is possible through DIY or work
| of others. However performance is not always the only important
| issue. Today's commercial software tends to be rushed, lower
| quality, bloated. Releasing work-in-progress software that
| requires constant remotely-installed "updates" in place of a
| thoroughly-tested final product is a norm
|
| Without control, if performance, _or anything else about the
| software_, is unsatisfactory, then there is nothing users can
| do
| Forgeties79 wrote:
| Basically a lot of current software teams operate like many
| modern video game companies. Ship the broken thing, (maybe)
| repair/improve it as people suffer through the experience.
| baq wrote:
| Turns out people see value in imperfect experiences.
| zarzavat wrote:
| Seems like an odd thing to be concerned about. Most of the apps
| on my Mac are closed source, that little Tailscale menu bar
| item is really insignificant. You can always control it through
| the command line if you're really bothered by it. I'm pretty
| sure tailscale is on brew.
| tshaddox wrote:
| That justification honestly doesn't sound that ridiculous to
| me, especially if the closed-source stuff is mostly just
| platform-specific GUI and integration code. Is there even a
| practical mechanism to open source an iOS app and then letting
| users verify that the version they're downloading from the App
| Store is exactly the same version that is open sourced?
| j-krieger wrote:
| The entire idea is that they make money. Limited licenses are
| ignored incredibly often.
| varenc wrote:
| The CLI version of the Tailscale client on macOS can be
| compiled from source and installed without the app store:
| go install tailscale.com/cmd/tailscale{,d}@latest
|
| https://github.com/tailscale/tailscale/wiki/Tailscaled-on-ma...
|
| So fully available in situations with limited connectivity. The
| GUI version of the client is closed source though, and it's
| available as a package or from the app store.
| pmarreck wrote:
| I don't understand this attitude. Some humans have to eat and
| put a roof over their heads sometimes, and extracting
| consulting fees from open-source work (i.e. the Redhat model)
| is not always a paying business model. A hybrid model is often
| the best way to compromise.
|
| Disclaimer: I'm pursuing a similar solution on an app I'm
| working on. The CLI will be free and open-source (and will have
| feature parity with the GUI), but charging money for the GUI
| will also help support that development (and put my son through
| school etc.)
|
| And by "feature parity", I really mean it- The GUI will be
| translated into 22 languages... and so will the CLI. ;) (Claude
| initially argued against this feature. I made my arguments for
| it. It: "You make a compelling argument. Let's do it." LOL)
|
| The lowest level of it is already available and fully open-
| source: https://github.com/pmarreck/validate
|
| I'm building something on top of that which will have a nice
| GUI, do some other data integrity stuff, and also have a CLI.
| And will be for sale in the Mac and Windows app stores.
| wolvoleo wrote:
| Personally, I understand people need to make money but this
| tends to be a death spiral (enshittification). So I tend to
| go for solutions without those incentives at all.
|
| I wonder why you jumped into the mesh vpn market, it's so
| saturated. Theres literally hundreds of solutions out there
| (niche ones included for the mainstream ones it's probably 10
| or so), many non profit options included. Is there really a
| niche you can offer that the others don't?
| jak6jak wrote:
| I looked into tailscale in the past as a way to host a game
| server such as minecraft on my local machine publicly without
| port forwarding . It seems that tailscale is mostly configured
| only to work with people you know and trust. I was hoping that
| Peer Relays would help alleviate some restrictions with tailwind
| funnel. Does anyone know any alternatives?
| Computer0 wrote:
| if you have a cheap vps you can use it to forward the traffic
| to for some benefit, that is what i have been doing when i need
| compute accessible online and don't want to pay for cloud.
| bityard wrote:
| I wonder if someone might indulge me by answering a question or
| two about Tailscale. I have a self-managed wireguard network
| which works, but probably isn't very smart or elegant.
|
| From what I can gather, Tailscale does a lot of "magic" things to
| accomplish its goals, and some of them actually have "magic"
| right in the name. As a system administrator by trade, I have
| been bitten SO MANY TIMES by things that try to automagically
| mess with DNS resolution, routing tables, firewall rules, etc in
| the name of user-friendliness. (Often, things that even ship with
| the OS itself.)
|
| Are there any documentation or articles detailing exactly what
| it's doing under the hood? I found
| https://tailscale.com/docs/concepts but it doesn't really cover
| everything.
|
| If I have a virtualization host with, let's call it a "very
| custom" networking configuration, how likely is it to interfere
| with things? Is it polite and smart about working around fancy
| networking setups, or does it really only handle the common cases
| (one networking interface, a default route, public nameserver)
| elegantly?
| Computer0 wrote:
| Headscale is an open source alternative, I haven't read the
| code but it might be a good place to start:
| https://github.com/juanfont/headscale
| patmorgan23 wrote:
| I believe the client is open source and there's a reverse
| engineered server (that some tail scale employees contribute
| to)
| marcosscriven wrote:
| I really like Tailscale. Recently though I've been having some
| hard-to-diagnose slowdowns even on a direct (non DERP)
| connection. I'm not sure if it's something to do with MTUs or my
| ISP.
| solarisos wrote:
| The shift from managed DERP to decentralized Peer Relays is a
| massive win for self-hosters with difficult NAT situations. I'm
| curious if this significantly reduces Tailscale's own egress
| costs or if the primary goal was just improving latency for users
| who can't establish a direct WireGuard tunnel. Either way,
| removing the 'hassle' of setting up a custom DERP server is a
| great UX improvement.
| alexktz wrote:
| Alex from Tailscale here... We're users just like you, and we
| felt this pain point ourselves. The good news is that Peer
| Relays were able to build on a lot of the existing subnet
| router and exit node plumbing, so it wasn't a huge engineering
| lift to bring to life.
|
| We also have plenty of customers running in restrictive NAT
| environments (AWS being a common example), where direct
| WireGuard tunnels just aren't always possible. In those cases,
| something like Peer Relays is essential for Tailscale to
| perform the way larger deployments expect.
|
| So yes, it improves latency and UX for self-hosters, but it
| also helps us support more complex production environments
| without requiring folks to run and manage custom DERP
| infrastructure.
| timwis wrote:
| I'm having a hard time understanding how this is different from a
| bastion server, where you're tunneling through an intermediary
| server that you've deployed in the target network.
|
| I guess the difference is the fact that the intermediary server
| doesn't need a port open (as standard nat punching will work)? Or
| are there other big differences?
| 1necornbuilder wrote:
| Real-world CGNAT use case that might be relevant here: I'm
| running an industrial AI monitoring system (computer vision on
| live RTSP camera feeds) deployed on Google Cloud Run. The cameras
| are behind an ISP that blocks port forwarding entirely -- a
| common apartment/SMB situation. Tailscale solved this completely.
| The Cloud Run container joins the tailnet, the camera's RTSP
| server gets a 100.x.x.x address via MediaMTX, and the container
| reads the stream over the private mesh as if everything were on
| the same LAN. No public exposure, no ISP negotiation, no port
| forwarding rules. The Peer Relay announcement matters for this
| setup specifically: my Cloud Run instance spins up fresh
| containers under load, and DERP relay fallback was occasionally
| adding latency during the NAT traversal handshake on cold starts.
| Peer Relays distributing that relay burden to edge nodes should
| reduce that.
|
| One question for the Tailscale folks: for ephemeral compute
| (Cloud Run, Lambda, Fly.io), where containers may spin up/down
| frequently, how does peer relay selection work when the relaying
| node itself might be transient?
| clarabennett26 wrote:
| UDP support in peer relays is crucial. DERP relies solely on TCP,
| which causes latency-sensitive applications like game streaming
| and voice to experience head-of-line blocking along with poor
| routing. With peer relays using UDP on your own nodes, the
| fallback path becomes effective for real-time traffic when direct
| WireGuard fails. Additionally, you can easily enable this feature
| on an existing subnet router without the need to set up and
| manage a separate DERP instance, making it much simpler to
| operate.
___________________________________________________________________
(page generated 2026-02-18 23:00 UTC)