Hacker News Reader

Comment by nomdep | Hacker News Reader

Could anyone please tell me what is Tailscale for? It allows you to connect to other computers in your home? For doing what?

View on HN

The most obvious use case is to replace absolutely anything you'd ever use OpenVPN or IPSEC for. Building on that, Tailscale is so simple that you consider things you wouldn't have before just because OpenVPN would have been so painful to set up. It has fine-grained access control and it integrates with SSO.

It's good for home use, but --- and I am bias I guess because of my background --- where it really shines is corporate connectivity. If I joined a company as a security person and it was running some horrible OpenVPN access VPN for its dev team right now, one of my top action items would be to replace it immediately with Tailscale.

My rough understanding with Tailscale is they have a central server you need to trust. How do you feel about this from a security perspective?

As a privacy tool, it's a legitimate qualm. As a company security thing, it's close to exactly what you want. In particular, you very much want as much of this stuff as possible linked to your Okta or GSuite account. Not just Tailscale; everything. It's why sso.tax is such a big deal.

Most use it to access their home server that are not directly internet facing. Like how you access work servers through VPN. Same purpose really. Files, medias, apps etc.

I'm wondering if there's any benefit to the average tech-savvy person to using Tailscale/ZeroTier as a VPN (with a VPS, say) vs. just using a consumer-facing VPN like Mullvad or whatever.

Well if you're using VPN for well "shady stuff" (e.g. torrenting), I don't suppose a VPS with your Full name, credit card, and billing address is specially helpful.

But except that deploying Wireguard* on a VPS for bypassing censorship/georestrictions is quite nice and cheaper compared to many paid ones.

* Tailscale and Zerotier aren't really needed if you want to route all your traffic thru a single machine, wireguard itself does exactly this.

It's possible to set up tailscale with exit node routing (ie: similar to what Mullvad does) - but it will be your exit node (eg: an on-prem server, a vm you manage). So that basically allows you to do legacy access control via ip whitelists (only allow IP our.office to talk to your.dmz.service that we develop manage for you).

If possible, just bringing the node/servicenin question "into" the wireguard/tailscale network would be better. But good luck getting a hospital to allow you to connect your tailscale to their patient record db (or what have you - obviously in this case you'd hope they have a solid vpn and give you access.. ).

For the use case of "talk via vm through mullvad exit node" i suppose you could set up Mullvad on the vm, and tailscale on the vm with Mullvad vpn as exit node, then join all your other nodes to tailscale.

Tailscale would replace how you connect to your vm, not mullvad.

https://tailscale.com/kb/1103/exit-nodes/

https://tailscale.com/kb/1019/subnets/

Reply on news.ycombinator.com