Use NextDNS everywhere you use Tailscale | Hacker News Reader

Use NextDNS everywhere you use Tailscale

tailscale.com

83 pointsmfiguiere39 comments

I literally just spent some time this weekend trying to get it working with a dnsresolver locally routing my home network there and then out to nextdns, all through tailscale. The issue really came down to something I didn't bother diagnosing, and very well could've been my router.

But. This just solved all those issues. Threw my nextdns address into tailscale and away i go. I swear every single time I run into some modern inconvenience of the web Tailscale (by mission statement) is there to solve it.

I had the same issue with NextDNS, and I also wanted to make Mullvad work with Tailscale. It does weird routing stuff on Linux so I had to write a custom script to make both VPNs work at the same time, and on iOS they're not compatible at all.

Then I wondered why I needed NextDNS at all, so I just replaced everything with pi-hole and zerotier (tailscale but plays better with custom networks. It's a simple interface with an IP address. )

Tailscale is cool and shiny, but it's one of those automagic software that don't leave much space for customisation and hacking. I guess I'm not the intended audience.

> zerotier (tailscale but plays better with custom networks. It's a simple interface with an IP address. )

That's like saying "it's like Cisco Anyconnect, except with less GUI applications"

They're both VPNs, that's basically all they've got in common.

Tailscale builds upon wireguard and creates a pretty polished interface for it. Zerotier has their own VPN technology and also provides hardware appliances for VPN termination

How does zerotier performance compare to tailscale? Throughput and CPU usage-wise?

Regardless of whether or not you use them, their article on how they do NAT traversal is pretty good:

https://tailscale.com/blog/how-nat-traversal-works/

EDIT: nevermind, ZeroTier has its own issues, so I went back to Tailscale.

I think this is a nice feature. I travel a lot. Having a pi or vm hosting my adblocking resolver will force every request to traverse hetzner in Germany because that’s where I have my stuffs. By using Nextdns I will always have a resolver in the country where I am since they are distributed over the world. Cuts down on the latency and geolocation aware stuffs won’t go bananas and think I’m in Germany.

Ofc, as soon as I enable the use of exit nodes I will be back in Germany again. But I don’t always need exit nodes. Split can be sufficient and this solved one of the issues I had with my use case.

Sounds like this feature isn't NextDNS specific and can it replaced with anything?

Then sign me up! I have my own unbound instance.. but also been pretty happy just using custom /etc/hosts files, so not feeling a strong incentive to shave this yak right now.

That was exactly my reaction. Seems like some kind of publicity stunt by both companies.

You can't deny, at this point in its life, marketing is king for a newly-minted unicorn like Tailscale, as it eyes that Gartner Magic Quadrant leadership position for Zero Trust Networks ;)

There was engineering work on both sides for us to launch this. I did much of the Tailscale side.

https://github.com/tailscale/tailscale/issues/2452 links to all the client commits.

There was also a lot of control plane stuff to let you specify config for different NextDNS profiles per tags/groups/users/etc.

And NextDNS improved some things on their side too, especially around passing device info to them.

And then, yes, we publicized it after working on it. And closed that bug.

Is there any info on how it interacts with Magic DNS?

No different than the interaction between MagicDNS & any other upstream DNS (Google, Cloudflare, your own, etc).

The built-in resolver at 100.100.100.100 handles the *.your-tailscale-suffix names in your tailnet and the rest that doesn't match goes upstream. Basically.

I believe so. This is the issue that was tracking it - https://github.com/tailscale/tailscale/issues/2452

Difference being you can now set IPv6 DNS servers. It's been a while since I tried but this wasn't possible or I did something wrong prior.

Using ipv4 NextDNS servers returned 'youre using NextDNS but without configuration'.

Configuring DNS in general was there before, but there are a couple of NextDNS-specific things that went live: automatically using DoH when using NextDNS, setting profiles on a per-device basis so you can vary what things are blocked or not, and optionally sending client info to NextDNS so that your NextDNS dashboard gives you a better picture of what devices are querying what.

And there's a little UI polish coming for the admin panel to show NextDNS configuration a bit more cleanly, but that's not live yet.

I used to use Tailscale to access my nextcloud instance remotely.

However I stopped because I started using protonVPN, and there is no way to run a normal VPN on top of Tailscale, without having some kind of exit-node which will add even more latency.

It would be cool if Tailscale would support some kind of wireguard import, so if the data is not sent to Tailscale recepients, it will send it through the normal Wireguard tunnel.

In my experience the app also had other issues, like excessive battery usage on Android.

Other than that, Tailscale + Head scale, the best mesh network implementation you can find IMO.

Hoping they eventually relent and provide authentication/authorisation themselves. Not keen on relying on Microsoft or Google for this low level control over my network.

Tailscale?

They don’t want to, because it’s Hard and if (when?) some part of it fucks up you get blamed. They’ll let you use your own but only if you pay them enough.

Hmm, it's interesting that they are saying it's now supported. I've been using my NextDNS ip6 addresses in Tailscale for one or two years now. I just had to add the ip6 addresses in the global nameservers and checkmark the "override local DNS". It's been working really well. I've been able to use Tailscale to access my Synology for music and blocks ads on my phone.

I haven’t used Tailscale [1][2], but is this very easy (UI/UX) to turn off temporarily? Does NextDNS assign a unique IPv6 address for each account to know this is my account and to apply my chosen filter lists?

I use NextDNS on my devices and turn it off temporarily when something I need to access doesn’t work because of something getting blocked by the filter lists (I do manage the allow list on my NextDNS account for any permanent or long term changes).

Seems like this doesn’t support multiple NextDNS profiles (says it’s in alpha) and the UX looks a bit rough to me.

[1]: I don’t seem to have a need to use Tailscale so far since the devices in my home network are shutdown when I travel and I don’t need access to them at all.

[2]: Besides, I don’t wish to signup for something through a Google or Microsoft or GitHub account (or other third party account), which are the only options supported by Tailscale. I’ll consider Tailscale if/when it supports a simple email/password account registration.

Can't edit my previous comment, but I checked on this question of mine:

> Does NextDNS assign a unique IPv6 address for each account to know this is my account and to apply my chosen filter lists?

NextDNS does assign a unique IPv6 address for each profile in an account, and the IPv6 address actually ends with the exact profile name. For example, if my NextDNS profile is a7bae4, the IPv6 address would be like 2d17:a4c3::a7:bae4.

Are they hinting at a pihole with their "It’s a bit more robust and lower latency than that Pi of yours dangling off the shelf by your cable modem."

How could it possibly have lower latency than something that's literally on your local network? Once it caches a request it's nearly instantaneous.

Sure, when you're right next to it, but I suppose if you're away from home and using your VPN to query your pihole, NextDNS might be faster. But yes I found the dig quite out of place, but for the reason that everyone I know who runs a pihole is not to run their own DNS resolver but (1) to block ads (2) not send more data than required to other services (a strike against NextDNS) (3) tinker, have more control (4) learn

> How could it possibly have lower latency than something that's literally on your local network?

I believe, what they mean is, NextDNS, given its global footprint, is lower latency than pi-hole in your local network connected via Tailscale over public Internet.

Sorry, author here. It got edited down a bit for brevity.

For one user never leaving your house, you're correct.

But once you have two or more users in different cities (or you're traveling), then your Pi at home will almost always lose compared to a geo-replicated service.

How is this new? I was always able to put in a custom DNS?

Seems it's the support for ipv6 DNS, as commented here by LilBytes https://news.ycombinator.com/item?id=33186655

>Difference being you can now set IPv6 DNS servers. It's been a while since I tried but this wasn't possible or I did something wrong prior. Using ipv4 NextDNS servers returned 'youre using NextDNS but without configuration'.

Author here.

What's new is that your NextDNS configuration profile is preserved even if your client can't do IPv6. We did DNS-over-HTTPs previously for the big public DNS providers, but now we also do DoH for NextDNS, using IPv4 or IPv6 for the underlying TCP connection as needed, but always passing through your NextDNS configuration.

The current UI just makes you paste in your NextDNS config-specific IPv6 address as a means of parsing out your config from the lower bits of the address. We have better UI coming.

(We don't do the NextDNS traditional port 53 DNS. They don't really support it with IPv4. There's a IP linking mechanism but it doesn't work with multiple devices)

Do you plan to support custom DoH/DoT endpoints?

Yes. The DNS bootstrap phase is annoying and complicated though. Currently we only do DoH for the big public DNS providers that have well known anycast IPs for their DoH endpoints. That means there's no bootstrap needed.

If you already have a pi-hole and you want it to be your DNS, you can configure the tailscale ip address of the pi-hole server (100.x.y.z) as the global nameserver in the DNS settings in tailscale, and it will route all your DNS queries to the pi-hole.

You can also have the pi-hole configured to use NextDNS as its upstream nameserver, and that works very well. Also, you can set up the server as a subnet router, and have access to all your machines on the LAN, even if you can't install tailscale on all of them.

Tailscale is truly incredible!

Interesting quirk about NextDNS — I found their servers will make a http/https request to the homepage of any domain/subdomain that is resolved via their DNS.

Might be to populate the favicon?

This somehow didn't really work reliably for me. The NextDNS web interface always showed "This device is using NextDNS with no configuration." and browsing felt slow, like there was a small delay with every interaction. Went back to the macOS CLI client for NextDNS and it's working well again.

Sounds like maybe you entered your NextDNS IPv4 address instead of just the IPv6? (UI improvements there coming soon.) We only ask for the v6 to get the config profile out of it but actually use either address family to DoH as needed.

Nope, definitely used the IPv6 address. I might try again sometime soon.

I've been using this setup for a few weeks now on the unstable client. Happy to see it stable now. The integration between the two services is really nice. Personally, have been a NextDNS user for a little over a year and now a fan of Tailscale. :)

Reply on news.ycombinator.com