Hacker News Reader

Comment by teaearlgraycold | Hacker News Reader

What does everyone use it for?

I have a Tailscale client running on my NAS at home, this allows me to access stuff at home when I am not there, mostly my Home Assistant instance but sometimes the files on the NAS as well.

Without Tailscale I would need a way to publish my routers current WAN address somehow (probably with DDNS), create a port forward rule on my ISPs router/modem and then setup a VPN server to listen to those connections.

Not to mention that the current ISP doesn't even allow me to login to their modem and setup port forwarding.

I have it on all my personal and family servers and devices. I use it so that for both myself and my family all our internal stuff (unraid network shares, jellyfin, homepages, photo backups, etc, etc) "just works" for the less technical members of the family even when they're not at home. It seamlessly detects when the peer is local so it doesn't route out to the internet and back, has an easy ACL to segment things (wife's phone doesn't need access to dd-wrt), and a bunch of other features.

We've been able to do this with existing VPNs for a long, long time, but tailscale is by far the most painless offering I've ever used and I migrated away from OpenVPN completely.

>It seamlessly detects when the peer is local so it doesn't route out to the internet and back

One of my use cases for Tailscale was connectivity between my primary NAS and an off-site NAS I use for backups. Being able to bring my NAS to the same site/network I had set-up the off-site NAS and just have things work over the LAN without reconfiguring anything was a wonderful surprise.

(Yes, I’m aware I could save some overhead by reconfiguring but looking at the network traffic monitor I was happy enough with the throughput I got though Tailscale’s LAN routing)

Can you use it like a VLAN for segmenting devices? I have eero’s and a firewalla but since my eero’s don’t support tagged vlan traffic I can’t segment my devices as much as I’d like to.

(not an expert here) but my understanding is: sort of. I believe the biggest difference is that VLAN operates at Layer 2 and Wireguard works at Layer 3.

So anything already on the same LAN wouldn’t be able to be segmented; if my theory is aligned?

Not GP, and I can only answer for myself, but:

Personally, I use it to connect my home devices as if they were always together on the same LAN, even when they're not. E.g. Raspberry Pi, home NAS, "home" server that's actually in a different physical location, etc. All accessible anywhere at any time, even (say) from my laptop in a moving vehicle, without connections dropping even when my IP changes. It really is like magic.

At work, we use it so that remote employees can access locally-hosted applications, office NAS, etc. ACLs make it easy to employ the principle of least privilege, so that having a route into the office LAN doesn't immediately mean any and every device is compromised.

Throwing in my usecases:

- Running a Jupyterlab instance on my desktop PC (WSL) and use it through my laptop from anywhere. Can also be accessible through phone/tablet if needed

- Simple routing of other services my PC exposes (Jellyfin for now)

- Access dev services running on my laptop through my phone without checking IP all the time

- Good replacement for AirDrop using Taildrop file sharing. AirDrop errors out if I try to use it on a "public" network (ex: University Wi-Fi)

A few use case:

- I have a SOHO setup at home: several PCs/ my work laptop, raspberry pi, synology and ubiquiti. It means I can access ubiquiti console and synology via network as opposed to be some janky proxy that those company's provide.

- taildrop is great for sending screenshots and files from my phone to (can't wait until they let me send URLs/links/txt like KDEConnect)

- I also have a raspberry pi setup in an ABNB in another country. When I'm traveling I can use my house as a proxy for US based services and the reverse is true - if I want my browsing to look like my IP address in another country I can.

The thing that sold me on it was managing remote (and I mean remote - like in a field in west Virginia with solar + cell) nodes. We started with using manually provisioned wireguard tunnels, but wg isn't great at things like failing over. Plus, our core infrastructure is on a slightly dynamic IP and we didn't want to route image upload through GCP. Tailscale made this problem go away . And then we got hooked on it for all developer access, having GitHub actions be able to push into our deployment, etc. It's pretty magical.

Seedbox access without exposing it to the wider web.

Managing personal devices.

One day I had to go to the office and only then did I notice my keepass hadn't synced in months. My home PC was sleeping so I SSH'd to my Openwrt box, got the MAC for my PC and used etherwake to start it. From there I used RDP to login and get an updated password. All from my phone.

I use it on my EC2 dev box and my home network, allowing me to block ssh on all the firewalls, yet ssh freely between all of them.

I use it to link together my research computer, laptop, and home-servers to give me access while traveling or working from home.

Reply on news.ycombinator.com