Hacker News Reader

Comment by unshavedyak | Hacker News Reader

For basic tunneling into home servers, is Tailnet.. overkill? Ie i could expose my IP via Dyn DNS, or i could use something like Cloudflare or Tailnet to tunnel into the network. However.. i'm not sure what the right fit is. Would you recommend Tailnet for someone who just wants to expose some internal IPs to the public in a safe way?

Tunneling compared to Dyn DNS at least has the advantage of more security via reduced access to ports. So maybe that alone is worth $5/m. .. well, $10/m, since i have two users. $10/m seems a bit steep just for some small access to my internal network for things like Camera Feeds, etc.

Dyn DNS + some safe self hosted VPN might be more affordable and just as safe compared to Tailscale.

.. thoughts on the best service to price ratio for my needs?

View on HN

Depends on whether you're talking about stuff that you actually want to be "exposed to the public" (i.e. can receive traffic from any IP) or just "accessible from outside the LAN."

If the former, Tailscale isn't really a good fit since it only permits access to authenticated devices.

If the latter, Tailscale is perfect. It's a VPN in the original sense of the world, "private" being the operative term - your devices can communicate as if they were all on the same LAN, without worrying about their traffic being eavesdropped.

As for the pricing, I'm fairly confident that Tailscale won't mind if you're sharing a free plan (so single-user) across e.g. your laptop and your wife's, even though there are technically two "users" there. They've made it pretty clear that the divide they care about is "personal use free, company use paid."

On the note of free plan. It's actually a bit of a shame.. i want to pay, i like $5/m, but it looks like $5/m is less devices than if i used free?

Though i just noticed that the Personal Pro plan works with up to 100 devices for $4/m. Might give that a try. I really like paying.. as i hate free VC services.

edit: Wow, the signup requirement is bizarre though. I don't have or want Google or Microsoft.. i do have a Github, which i guess i'll have to use... but what the hell? So odd that i can't just signup with my email.

Yeah, they get a lot of flak for that from HN. Doesn't bother me personally, but I can see why it would be a dealbreaker for some people. On the other hand, I sympathize with their decision to just not have to worry about storing passwords, account recovery, and all the associated headaches, because I hate those headaches too.

My guess is they will eventually add a sign-up-with-email option, but it's pretty far from the top of their priority list.

In researching the email issue i saw a fair number of people arguing to decouple accounts from identities. I thought that was fair. I use Github and i have no problem there, but i didn't want some snafu on my account (Github) to somehow block my home network access.

So i just signed up with an alternate Github "Identity" account to use with Tailscale. Still feels weird, but we'll see how it goes.

Note a discussion elsethread about this where a tailscalar chimed in: https://news.ycombinator.com/item?id=33987904

Dynamic DNS with wireguard works great, especially for a small footprint (sounds like you only have one LAN you want to access remotely, not multiple sites). It'll be free, and you won't have any cloud centralized service you're dependant on.

Personally I host both of these services (dynamic DNS client, wireguard server) right on my WAN edge router, but you could also run it on a host (e.g., VM or raspberry pi) inside the LAN.

How was wireguard setup? My fear with manually setting up wireguard is making some mistake that compromises security.

While i like free (selfhosting), my gut says $5/m would be worth having Tailscale manage security for me to ensure it's done right.

I'd say it depends on how many remote clients you plan to have, since you have to manually configure the associated key per client. Unlike a traditional VPN which was just username/password based (from the user perspective, anyway) wireguard is based on keys, which means if you want to get in remotely, you need to have a key which has been configured. If you only have a few clients, this is easy enough to get going. If you have lots of clients, or want to be able to easily add new clients, I can see it becoming cumbersome.

As far as setting it up securely, I don't think you're any worse off doing it yourself compared to using tailscale. You can define what networks each client may access. Personally I run wireguard on top of OpnSense, so I also have firewall rules in place to limit what any client can do from my remote-access network towards other parts of my network.

An interesting collab between cloudflare and tailscale could be to add cloudflare tunnel as a tailnet node to proxy public traffic into your private tailnet (with acls managed by your tailnet) as an alternative to opening ports on your firewall. This would give you true public access (if that's what you want) but also hide your ip and protect you from ddos etc. https://www.cloudflare.com/products/tunnel/

Tailscale has an alpha version of a feature that does the same thing, without relying on CloudFlare: https://tailscale.com/kb/1223/tailscale-funnel/

> i could expose my IP via Dyn DNS

Not if your IP is behind CGNAT or the like.

> $10/m seems a bit steep

They have a free multi-user plan but it's in small print on the pricing page and requires use of Github for user management.

> Ie i could expose my IP via Dyn DNS

That works if your IP is globally reachable.

> For basic tunneling into home servers, is Tailnet.. overkill

It's a service. You just pay money and they take care of it, instead of running this all by yourself.

> thoughts on the best service to price ratio for my needs?

You can buy VPS for $14/3m = $4.66/m and configure Headscale or whatever on it. Fixed public IP, no need for DynDNS, no user/$ limit except CPU/RAM - you can have whatever you want on it.

EDIT: found out they even have a $11/3m plan = $3.66/m.

Reply on news.ycombinator.com