Tailnet Lock

How can I trust that I can log in and administer my network when Google kills my Google Account login or Microsoft kills my GitHub Account?

Big tech surveillance orgs being the SSO is an SPoF for the administration of the network. For something as critical as L3, I can't accept that.

I just use Nebula instead. It doesn't have a spiffy web interface or ssh auth chrome bolted on, but it works great for my purposes and it doesn't involve Google or Microsoft at any point.

One option is don't. Run tailscaled inside a container with host network access, that way you can connect to the host, but it doesn't have the ability (unless it escapes the container) to write (ssh) keys.

If you don't want to trust the Tailscale coordination server, and decide that tailnet lock is not for you, have you taken a look at Headscale? https://github.com/juanfont/headscale

It still makes me jittery how much stuff they've packed into the client. The RCE vulnerability in their windows client is pretty strong indicator that things are moving a bit too fast for comfort.

It's a usability thing, IMO.

Historically you had enterprise-grade VPNs that cost a lot of money, or OpenVPN. Both ran over IPSec or SSL, and neither were super straightforward to config/maintain, nor were they particularly performant.

Then came wireguard, which is awesome, but wireguard is just a transport. It doesn't have all the UX niceties built on top of it, like registering clients or generating / distributing keys. Tailscale does a lot of that lifting for you, so you can easily and quickly get a working VPN, at a low cost, with good performance.

Personally I manage wireguard myself, but I also self-host my own VMs, storage server, applications, etc.

Tailscale is like taking your car in for an oil change instead of doing it yourself, plenty of people find that worth it.

For personal stuff, it feels totally new. It's like having your own intranet. It's like being on LAN with all of your personal devices, plus any bridged into your tailnet, at all times, anywhere on earth. You can route your internet traffic through another machine, or not (default.) It has built-in basic file transfer, and a nice little SSH bridge.

Technologically, it's based on Wireguard. Wireguard is fast; really fast, especially compared to OpenVPN. Using cutting edge cryptography and a new UDP protocol, Wireguard connections feel roughly zero-overhead (they're not, of course.) Connections are peer-to-peer and you usually will get pretty close to the fastest reasonable route between any two devices, whether you're on LAN or overseas, whether there's a strong NAT in front or not.

They've also engineered a lot of things carefully, instead of just cobbling together existing end-user tools in Rube Goldberg arrangements. (Not saying there isn't use of existing code; there totally is. But it's all very nicely integrated from what I can see.) Doing things "the hard way" can lead to more complicated software, but the way they've architected things makes the possibilities for expanding the utility of Tailscale to be nearly limitless. It's also amazingly entertaining to read about. Seriously, just read about how their web browser SSH client works:

https://tailscale.com/blog/ssh-console/

Tailscale is a zero-friction VPN. You just install it on every machine, login on every machine and you get your own private network that just works. When I click on one of the machines in the admin console, I get a list of things it takes care of: "Varies" (Whether the machine is behind a difficult NAT that varies the machine’s IP address depending on the destination), Hairpinning, IPv6, UDP, UPnP, PCP, NAT-PMP. I don't even know what some of them mean, I thought PCP was something to get high on.

I run it on every device I own, plus a few at my parents' place. This way I can access my PC and my NAS from my phone, and my NAS from my PC, even though the NAS is behind my home router and the PC and the phone can be connected to a bunch of different networks.

I really like their engineering blog. They aren’t afraid to share they they actually did and what results they saw, even if the “common wisdom” was against it, like, IIRC, they were using SQLite as their database for a while.

Depends on whether you're talking about stuff that you actually want to be "exposed to the public" (i.e. can receive traffic from any IP) or just "accessible from outside the LAN."

If the former, Tailscale isn't really a good fit since it only permits access to authenticated devices.

If the latter, Tailscale is perfect. It's a VPN in the original sense of the world, "private" being the operative term - your devices can communicate as if they were all on the same LAN, without worrying about their traffic being eavesdropped.

As for the pricing, I'm fairly confident that Tailscale won't mind if you're sharing a free plan (so single-user) across e.g. your laptop and your wife's, even though there are technically two "users" there. They've made it pretty clear that the divide they care about is "personal use free, company use paid."

Dynamic DNS with wireguard works great, especially for a small footprint (sounds like you only have one LAN you want to access remotely, not multiple sites). It'll be free, and you won't have any cloud centralized service you're dependant on.

Personally I host both of these services (dynamic DNS client, wireguard server) right on my WAN edge router, but you could also run it on a host (e.g., VM or raspberry pi) inside the LAN.

An interesting collab between cloudflare and tailscale could be to add cloudflare tunnel as a tailnet node to proxy public traffic into your private tailnet (with acls managed by your tailnet) as an alternative to opening ports on your firewall. This would give you true public access (if that's what you want) but also hide your ip and protect you from ddos etc. https://www.cloudflare.com/products/tunnel/

> i could expose my IP via Dyn DNS

Not if your IP is behind CGNAT or the like.

> $10/m seems a bit steep

They have a free multi-user plan but it's in small print on the pricing page and requires use of Github for user management.

> Ie i could expose my IP via Dyn DNS

That works if your IP is globally reachable.

> For basic tunneling into home servers, is Tailnet.. overkill

It's a service. You just pay money and they take care of it, instead of running this all by yourself.

> thoughts on the best service to price ratio for my needs?

You can buy VPS for $14/3m = $4.66/m and configure Headscale or whatever on it. Fixed public IP, no need for DynDNS, no user/$ limit except CPU/RAM - you can have whatever you want on it.

EDIT: found out they even have a $11/3m plan = $3.66/m.

I had the same issue. I think the idea is that you build something yourself on a trusted node that decides whether or not to endorse a new node.

Off the top of my head I'd do something dead simple like verify the user account matches our domain and then also query an inventory system to verify it is indeed a device we manage through MDM (though I'm not sure how this will work for mobile devices. We don't MDM those).

When a new device attempts to join you should have some data on it via the API (User, OS, Tailscale version, source IP, machine name). You could use that data to decide to endorse it or not.

(Tailscalar and a tailnet lock author here)

Thanks for the feedback!! Writing the documentation for how this worked was a challenge, and its good to hear what pieces we need to call out more strongly in the future.

If you're interested in gory details around tailnet lock internals, we have the beginnings of a whitepaper here: https://tailscale.com/kb/1230/tailnet-lock-whitepaper/

Tailscale is just fancy software that creates peer to peer encrypted tunnels between your devices using wireguard.

You can think of it as a LAN for all your devices regardless of what network they’re physically connected to.

The default use case of Tailscale is to have a private LAN, just for you, not your friends. This is changing now, though.

Tailscale does as of recently have the ability to do what you’re saying for Minecraft. It’s called Tailscale Funnel. This lets you expose a port on any of your devices to the public internet with a TLS enabled host name.

Another option for your Minecraft server is to use Cloudflare Tunnel. Works great for this kind of thing and is pretty much functionally equivalent to Tailscale Funnel.

If you want to host a Minecraft server, ZeroTier is probably better. It has a couple of options that make it easier for third parties to be able to connect including automatically authorizing new connecting nodes, or an option where if you connect to a particular ZeroTier network, anyone with your ZeroTier IPv6 can connect to the corresponding port (I forget their exact name, but it's pretty slick).

Sounds like a fancy name for a hiring freeze

"Talent Lock": the new MBA euphemism for H1-Bs

Please don't give them any ideas

From a business sense, it would likely be a reasonable and profitable acquisition for both parties.

From a personal standpoint, I would like to see Cloudflare (among others) smashed into a neutral backbone provider and all its product offerings spun off, ala https://en.wikipedia.org/wiki/Breakup_of_the_Bell_System. It's dangerous for one company to control so much of the internet's infrastructure and it's causing massive problems (like https://news.ycombinator.com/item?id=32912075). Tailscale should remain independent.

“@dang” doesn’t do anything on HN. Emailing the mods using the footer Contact link is the fastest way – and the only certain way – to get the mod team’s attention (including but not limited to dang).

Fixed now. Thanks!

Baader-Meinhof

They're not. It's just roughly when the post a new blog entry, which is... usually about once a week? Sometimes it's about new features, sometimes it's about internals which might be helpful for other people to know about (like the previous entry was about internals of the TUN/TAP, and how they managed to speed it up a bunch).

Tailscale are _the_ company pushing the state of the art in VPN's, and they write great, detailed technical articles and whitepapers about it. As someone who has worked on a different, more traditional, enterprise VPN product, this is extremely interesting to me. Most other companies have neither the cool tech (most haven't even switched from IPsec), nor the ability to put out anything other than marketing fluff, nor the focus to actually keep working on the core VPN tech instead of trying to check all boxes (monitoring/firewalling/device management/...) but not innovating anywhere. Tailscale also scales down to individual, private users, has a free plan, some open source code and an open source reimplementation, all of which appeals to the HN audience.

This article in particular is interesting because Tailscale inserting malicious nodes is the #1 concern I had around their product, and their solution (tailnet locks) is interesting and probably better than the solution I would have come up with (using Wireguard's support for additional symmetric secrets).

Obviously "every single day" is hyperbole, but I agree with you that a much higher proportion of Tailscale blog posts end up on the front page than most corporate blogs.

Finally I think it comes down to this: Tailscale is full of the same kind of people who tend to hang out on Hackernews. HN loves Tailscale because Tailscale is HN's ingroup.

Fly.io is in a similar situation, and similarly sees a higher-than-average fraction of their blog posts getting traction on HN.

For an interesting counterexample, look at warp.dev. They have a lot of the same markers - tackling an interesting problem that affects many HNers daily (the limitations of the terminal), building things from the ground up in Rust, and writing highly technical blog posts about it - but at the same time, it's clear that as an organization, they don't quite get it. They can't understand, for instance, why putting telemetry in their terminal emulator is absolute suicide as far as HN is concerned, or why "moving the terminal to the cloud" is a phrase that will never make HN happy. Unlike Tailscale and Fly, they are not "of the race that knows Joseph", as it were.

That's not to say that there aren't individuals at Warp who are members of the HN ingroup. But at the organizational level, Warp just isn't quite it.

As a (typical?) HNer, there are many reasons. (a) TailScale was founded and is populated by people I followed online before, during, and after my and their tenures at Google, or just followed online already if they're not Xooglers (b) their product is extremely useful, and almost every non-enterprisey new feature they add is immediately or potentially useful to me, and I'm only running a couple of Raspberry Pis and a Minecraft server (c) I like Go, and they use Go extensively, often improving Go in the process, or at least documenting interesting performance characteristics and application design architectures (d) they have managed to find an interesting and rare balance point, to applying commercially viable product funding to a whole host of open source improvements and contributions, and (e) the basic components of their product (Wireguard, networking details, Kernel integration, etc.) are extremely in my areas of interest even independent of the product itself.

Also, they're just awesome folks!

Because someone submits them, and others upvote them. It's really not complicated. There's no deep conspiracy to promote Tailscale here. They're not even a YC company.

In 2013, Docker was on the front page every day.

Sometimes a BFD tech comes around. Even if it’s not immediately obvious, Tailscale is a BFD.

Why does a for-profit company have to practice perfect anonymity to sell a product which does have security/privacy in mind?

Are you sure people who complain about such things are in Tailscale’s target demographic?

> website loads in so many trackers

Not on my browser. Maybe you should consider a better browser and/or install some extensions.