Hacker News Reader

Comment by irjustin | Hacker News Reader

For everyone else, I'll shamelessly use this to plug Netmaker[0].

Not affiliated, just a satisfied guy that needs access to private AWS VPCs across multiple accounts and would love to see them be more widely adopted.

[0] https://www.netmaker.io/

View on HN

Is Netmaker like Tailscale? From their site I'm unclear what the distinguishing factor is.

Roughly, yes. Netmaker has a self-hostable server though. With tailscsle of course the 3rd-party headscale is available. Netbird also seems promising. See https://github.com/cedrickchee/awesome-wireguard for more alternatives.

Yes. Netbird is very recommendable: https://netbird.io/

...until you read the app privacy label. This app collects a lot of your data for being privacy software.

Tell me again why p2p privacy software needs to phone home?

https://apps.apple.com/us/app/netbird-p2p-vpn/id6469329339

Using it in prod right now, not a fan. It will gleefully create a root ssh tunnel for you through its daemon if the box on the website is checked.

Thanks, didn't know about this. I guess Netmaker (or similar) manage the keys for you which would make the admin a lot easier. In a previous job we setup and managed wg across a few Windows and Linux boxes using Ansible. It was OK but was getting a little messy in the end.

Can’t you do that “AWS native” with private link or vpc peering? I’m a noob with these so I don’t understand the benefit of netmaker

The goal isn't to make the networks seem like one and connect resources across accounts, which is what those products do.

My goal is to access private resources via SSH bastion/jump machines in a specific account. There's a few ways to do this in AWS, but all of them are more costly by a pretty wide margin.

https://docs.aws.amazon.com/systems-manager/latest/userguide...

  aws ssm start-session --target $instance-id

This is the best way to connect to your instances. However you still need the SSM agent installed and the right IAM permissions.

You can forward ssh through ssm, and dump that into your ssh config file. Works pretty nicely with some of the sso automation for the cli that's around these days.

Is this using SSM’s raw port forwarding support? From what I’ve seen, their protocols seem to lack binary safety (we get weird encoding issues).

Without knowing the specifics of your situation, I would slightly suspect client/configuration if you’re encountering encoding issues. In my experience, integrating ssh and ssm is quite stable (provided you’re using OpenSSH and not a specific language client’s own implementation of the protocol).

sso tools: https://synfinatic.github.io/aws-sso-cli/

ssh proxy: https://github.com/qoomon/aws-ssm-ec2-proxy-command

AWS VPN is pretty cost effective, we used if for a few years with a multi account setup. And it's pretty much zero work.

Unless you're transferring a lot of data, such as video streaming or copying files. Looks like $90/TB for egress.

What is it, a generic VPN platform? Similar to Tailscale etc?

Their site is extremely vague.

Reply on news.ycombinator.com