FireZone – Open-source VPN server and firewall | Hacker News Reader

FireZone – Open-source VPN server and firewall

firezone.dev

246 pointspunnerud58 comments

Hi everyone!

Firezone CEO here. Someone just clued me into this thread. Unfortunately I’m in and out of Internet service today but I’ll do my best to answer questions.

As noted by others, Firezone isn’t really aiming to be a mesh networking tool like Tailscale, but more of a classic east-west VPN similar to OpenVPN Access Server. We also expose simple controls for managing egress firewall rules.

We have a big release planned next week to bring OIDC auth and the ability to manage multiple WireGuard networks, plus Docker support and more firewall + multisite features in the pipeline for later this summer.

We have a one-line install script for Linux at our repo if you’d like to give it a whirl! Grateful for any and all feedback.

https://github.com/firezone/firezone

Thanks for posting. What are the use cases for Firezone exactly? Is the intention to simplify networking configuration in data centers? (as opposed to the zero config nature of Tailscale devices that could be anywhere on the internet?)

> We also expose simple controls for managing egress firewall rules.

Unless user-tracking telemetry is blocked, in which case, apparently your CLI tools stop working?

https://news.ycombinator.com/item?id=31542047

Edit: dunno if that comment was deleted because the author was wrong about their PiHole blocking telemetry causing commands to fail, if they were harassed into deleting it, or what.

I guess I'll give you the benefit of the doubt that there was something else going on with their network that caused commands to fail, but you're still getting side-eye for engaging in telemetry/usage tracking.

The post you're linking to seems to have been deleted.

Hi, I deleted that post because it had something in it I didn't want forever recorded on the internet. Nobody harassed me and I wasn't wrong.

One of my pihole blocklists includes telemetry.* which matches some network call made by the command you run to update the Firezone config. Pihole returns "0.0.0.0" for hostnames it blocks and the error that's raised ends up coming form openssl. Later I discovered there are 2 options at the bottom of the /etc/firezone/firezone.rb config file, commented out, that allow you to disable the telemetry. With these options turned on the error no longer occurs.

We don't actively block any functionality when a user blocks telemetry -- that's definitely an unintended side effect and bug. You'll have more luck disabling telemetry in the config file with `default['firezone']['telemetry']['enabled'] = false` documented here: https://docs.firezone.dev/docs/reference/configuration-file/

We could definitely clarify how to disable telemetry better and we should make sure nothing breaks when telemetry is blackholed instead of disabled. I've opened https://github.com/firezone/firezone/pull/658 to get these addressed.

Can you share your experiences working with Elixir for this kind of project? Sharing anything about strengths, weaknesses, or general insights would be appreciated.

Sure! Elixir's been great. Phoenix is a joy to work with, and many of the concurrency primitives built into OTP make it the perfect foundation for a product like this. And rustler makes it super easy to add low-level / native code.

I will say the big downside to using Elixir is that distributing releases is a bit cumbersome. `mix release` expects that you're building on the same OS / version as you'll be running on, though we're looking into using something like burrito [1] to help alleviate this.

[1] https://github.com/burrito-elixir/burrito

All: the submitted title ("FireZone – Tailscale Alternative – The Open Source VPN Server and Firewall") broke the site guidelines by editorializing.

"Please use the original title, unless it is misleading or linkbait; don't editorialize." - https://news.ycombinator.com/newsguidelines.html

As complaining commenters and the project creator agree, this is not a Tailscale alternative. Please don't do that! This was a case study on how small title perturbations end up dominating entire threads.

This is great, I was just thinking of a similar setup for the wireguard VPN I had created for work.

We use multiple WG interfaces with its own IPv6 subnet for access control so will be keeping an eye on the following issue. https://github.com/firezone/firezone/issues/549

We're actively working on this and expect to have it done for 0.4.0. You can track progress here: https://github.com/firezone/firezone/pull/653

There is an install script for this which is imperative. I wish there was something for NixOS (which would be declarative).

How does it compare to BSD based firewalls such as OpnSense and pfSense? They're both great products, but support for ARM and 802.11ac doesn't seem ready yet.

pfSense is still a great product in 2022? I had heard otherwise.

After reading around a bit it appears you're right; thanks for the correction. I used pfSense some years ago to full satisfaction and always thought the reasons for the fork leading to OpnSense were motivated only by licensing issues, but apparently there are also technical reasons for choosing OpnSense over pfSense.

Not going to knock these solutions but at least for Tailscale, if I understand what I read on their web site correctly, I think it's built on Wireguard. I found Wireguard to be easy enough to configure and get working and I'm lazy and cheap.

Since then, I run my web and email servers on an old laptop in my home and the Internet POP is a $3.50 VM plus $1 for a static IP, at AWS Lightsail. This works for me but if I needed to connect a disparate office and devices together I might look at Tailscale or one of these packaged solutions, or maybe not.

you can run netmaker in a lightsail VPS. Similar functionality / UI experience to tailscale but self-hosted

It looks impressive.

Sadly not open source and their change notes are not yet production ready. Every release something breaks. I switched back to pure wireguard because of this. I also wouldn't call tailscale and netmakers ui comparable. Netmaker has far more options. Tailscale tries an apple approach by hiding almost everything but DNS.

> Sadly not open source

Just to clarify this take, the source is available on Github [0] but licensed under the highly controversial Server Side Public License [1][2].

This license was originally written by MongoDB. They applied to get it recognised as an open source license with the OSI but later withdrew the application as it became clear it wouldn't have been approved.

OSI explained in 2019 [3] why it didn't consider the license to be open source.

[0] https://github.com/gravitl/netmaker

[1] https://github.com/gravitl/netmaker/blob/master/LICENSE.txt

[2] https://en.wikipedia.org/wiki/Server_Side_Public_License

[3] https://opensource.org/node/1099

In case you want open source self-hosted tailscale there's https://github.com/juanfont/headscale

It is indeed built on Wireguard, but it is a user space implementation of Wireguard. Maybe that's fine, but kernel space would allow much faster speeds.

This is very nice and looks like a useful tool.

It's also very much not a "Tailscale Alternative" – it explicitly describes itself as not being "a tool for creating mesh networks", which is the exact thing that Tailscale is all about.

Nebula (https://github.com/slackhq/nebula) is much closer to actually being a fully open-source and self-hostable Tailscale alternative as I understand it, though I've never used it myself.

I've been trying netmaker and it's been very easy to set up. Would recommend giving it a go

How are end user devices supposed to join the mesh in Nebula? Is it really add this collection of files to /etc and run a nebula command on the command line?

With keys that are signed with a CA cert. And they connect to a server that basically checks the validation, but then they can connect in between. I've set it up a couple of months ago, I like thr implementation, but it seems a bit too slow somehow.

Yes, you just need those certificate files and a config. All of that could probably be automated for easier deployment.

This doesn't really seem to do what Tailscale is doing, which is to create a mesh network with a central beacon node for facilitating handshakes.

I am currently researching this area and have found the following solutions in the mesh VPN space. In order of how locked down the source code is—which also seems to correlate with ease of use—there is Tailscale, ZeroTier, Netmaker, Nebula, and also Innernet (this last one is only mac/linux).

Thanks! Yggdrasil ( https://yggdrasil-network.github.io/ ) should probably in this list too, except that it doesn't need a central beacon node.

Very interesting. I will add it to my list.

aaaaaand Netbird ..

ZeroTier doesn't use WireGuard, but is a mature option that fills the same niche.

Would any of those can be used against China's GFW?

Tailscale could be blocked by the GFW [1]. I guess that's because it uses a central beacon node?

Also they are built on WireGuard, which is not obfuscated, so they can be detected by DPI?

[1] https://forum.tailscale.com/t/does-tailscale-work-in-mainlan...

I have actually lived in China for 2 years and travelled there for maybe 6 months in total in addition to that. I've always just used a traditional, commercial VPN service such as ExpressVPN. In theory, those can also easily be blocked, but in my experience it rarely happens in practice.

The main issue with living in China is the fact that the connections to the outside world are so clogged that using something like Youtube is often so slow that it's not even worth trying; that was the case in the Beijing area between 2016-2018 at least.

There is a "conspiracy" theory that those VPN works in China because they have a connection to the CCP.

It would be amazing if Tailscale can use ExpressVPN kind of services for handshaking so that it can work inside the GFW.

I think self-hosting is the better solution if you're worried about someone blocking a VPN's IP address.

I've heard those conspiracy theories, but to be honest I just accepted that everything was monitored when I was in China anyway. Installing something like Wechat/微信 basically gives tencent permission to everything that's on your (Android) phone anyway. To me, the VPN was solely about granting access to what was otherwise blocked, not about privacy.

Yes. I am looking for something like Tailscale but can be self-hosted.

That would be headscale, mentioned above.

I am note able to reply to your other comment, so I'll reply here.

Everything except for Tailscale (and possibly ZeroTier) on that list can be entirely self-hosted.

Thanks. I will take a look.

A ton of people seem to use ZeroTier in China. It's harder to block since you can self-host everything, which many in China do.

fully self-hosted is usually best, e.g.wireguard. zerotier is close. openziti, especially in cases in which app-specific VPNs help (each session looks like different encrypted apps, and you choose what apps).

Worth noting, the biggest closed source thing from Tailscale is the server side, which has an open source re-implementation call Headscale[0].

[0] https://github.com/juanfont/headscale

You can probably add https://enclave.io to that list; creates mesh VPN networks based on tags + policy.

Fortinet has a (cloud controlled, IPSec based) mesh VPN solution. Maybe other networking equipment vendors also have their own offerings.

why would anyone want to have IPSec in 2022 ? It means remaining stuck with a mid-90ies committee-driven-crypto protocol (and the design is far from best practice in modern security).

I really like the design principles[1] of Wireguard. It does away with all the key-negotiation nonsense and eliminates a whole cluster of potential flaws right out of the gate. Also Jason Donenfeld's software development cycle is a skill level that can only be described as a 10000x-developer.

[1] https://securitycryptographywhatever.buzzsprout.com/1822302/...

I think your average enterprise sysadmin/networking person doesn't really care about IPSec vs Wireguard.

Yeah you can't really use FZ for Tailscale use cases, though maybe OP is just referring to how it uses WireGuard. Netmaker and Innernet are the two Tailscale alternatives which are using WireGuard. And in fact, both are much faster than Tailscale because they use Kernel WireGuard. So they'd probably be the best options for "Tailscale Alternative."

another well vetted one is OpenZiti (NetFoundry SaaS products are built on top of OpenZiti). full mesh, although default-closed model instead of default-open model:

https://openziti.github.io/ziti/overview.html

Tinc is another mesh option. Doesn't use wireguard but is still highly regarded and liked: https://www.tinc-vpn.org/

The originally submitted title said "Tailscale Alternative" but this appears to have been an error and we've taken it out now. More at https://news.ycombinator.com/item?id=31542122.

@dang Seems like the headline is somewhat editorialized -- can we get "Tailscale Alternative" removed?

Email the mods if you want a title fixed, there's no effective @dang-based summoning

Fixed now: https://news.ycombinator.com/item?id=31542122

Thanks.

On that note, Anyone got a way to get wireguard to work like speedify on a Linux client?

I haven't but I have almost tried Zerotier multipath: https://docs.zerotier.com/zerotier/multipath/

If I understand correctly, it should do something what speedify does.

Depending on the use case you may be able to do something like ECMP. An example use case is here: https://blog.muthuraj.in/2020/06/high-throughput-site-to-sit...

Reply on news.ycombinator.com