Hacker News Reader

Comment by jcalvinowens | Hacker News Reader

> something that I'd like to get rid off in the future as well by adding a VPN layer on top.

What VPN software would you use? Personally I've never found anything I consider as trustworthy as OpenSSH.

Wireguard. Actually I setup also 2nd backup tunnel in case some upgrade or change messes up the first one.

+1 to WireGuard. For people new to it, there are some great scripts which set up and configure it for you like https://github.com/Nyr/wireguard-install

I use OpenVPN for historical reasons but today I’d go for Wireguard, much simpler, faster and integrated in the kernel, connectionless so much less friction when e.g. rebooting or changing networks.

Wireguard is quite good too, and if you’re up for some complication in your life you can do full mesh quite easily with it if your online infra is a bit distributed.

There's also helpers for wireguard meshes. Or become dependent on yet another service like tailscale (at least there's headscale) or zerotier.

It has no dhcp

I use IPv6 magic

you can statically configure if you don't have a zillion hosts

Aren't the cool kids using https://tailscale.com/ these days?

Ain't no cool kids (in my world) using centralized for-profit services for essential things like that.

Pretty much all of it is open-source, and there's a self-hosted open-source alternative available for the only closed-source cloud-hosted component[0] - and that's even actively being promoted by Tailscale![1]

[0]: https://headscale.net/

[1]: https://tailscale.com/opensource#encouraging-headscale

Seems the cool kids are using Headscale then if anything, rather than Tailscale :)

multicast/mDNS is broken, and it doesn't seem that it will be fixed anytime soon. This prevents hosts discovering each other as if they were on non-virtual LAN.

Personally, I find that having to set up an OIDC provider is too much overhead for a VPN. In a corporate setting, you likely have something already, but for individuals or small teams it's too much extra work.

How could that work with their architecture? They configure your device to use a DNS server running locally in their app. That resolves their device names to their internal device IP addresses. Their device names default to hostnames, just like mDNS does.

So to give an example if I enter http://geder in my browser I want that to resolve to 100.100.5.10 regardless of if I am on my home network (where geder is) or if I am on a train.

From my perspective half the reason to use tailscale is that it replaces why I'd want mDNS with less bugs.

Except that mDNS is required for loads of things (via DNS-SD, which is basically the main reason to use mDNS).

That requires rewriting all software to follow tailscale's model instead of mDNS. Additionally, discovery would no longer work when devices are on the same physical network.

Reply on news.ycombinator.com