Hacker News Reader

They don't even bind the port. Instead, their client gives special treatment to packets arriving on port 22 over the tunnel instead of giving them to the kernel over the tailscale0 interface.

I haven't used it much, but in my experience it takes over port 22 over Tailscale. If you don't contact the Tailscale IP, nothing changes in your SSH.

I assume they only bind to the IP of the WireGuard interface

(Tailscale employee who worked on this)

As patrakov said above, we don't bind at all with the OS kernel. The packets come in, are Wireguard decrypted (in userspace) and then TCP/IP is also done in userspace (gvisor) before Tailscale SSH takes over, handling the connection (~net.Conn) from gvisor.

Good to know! The wording doesn't really make this clear at all to me honestly; "take over" doesn't really seem like a well-defined term to me, but it sounds pretty "complete" in terms of owning it fully. As mentioned in a sibling comment, the part of the sentence after that reads to me like an explanation of why rather than additional technical details of what's actually being done, but obviously I'm only a sample size of one, so maybe this is more clear to the average reader than it was to me.

“Tailscale takes over port 22 for SSH connections incoming from the Tailscale network”

Yes, I read that sentence. To me, "take over" doesn't sound like a "partial" thing, it sounds like it fully takes it over, and "for" sounds like it's just saying why it takes it over, not that it only partially takes control of it. The reason I asked is because I felt like the documentation implies something else despite the wording sounding like this.

Generally speaking, if someone quotes something and asks a clarification, it's because they don't find the wording clear. Repeating it, even with italics, doesn't make the wording any more clear to someone who already doesn't think it's clear.

> The reason I asked is because I felt like the documentation implies something else despite the wording sounding like this.

It literally tells you in the same section what they mean by that sentence and implications for normal SSH. it doesn't imply anything past what reading a few more sentences would say.

> it sounds like it fully takes it over, and "for" sounds like it's just saying why it takes it over, not that it only partially takes control of it

No it doesn't.

> Your SSH config (/etc/ssh/sshd_config) and keys (~/.ssh/authorized_keys) files will not be modified, which means that other SSH connections to the same host, not made over Tailscale, will still work.

> Tailscale takes over port 22 for SSH connections incoming from the Tailscale network. Tailscale will authenticate and encrypt the connection over WireGuard, using Tailscale node keys. The SSH client and server will still create an encrypted SSH connection, but it will not be further authenticated.

What is hard to understand about this?

> it doesn't imply anything past what reading a few more sentences would say.

> Your SSH config (/etc/ssh/sshd_config) and keys (~/.ssh/authorized_keys) files will not be modified, which means that other SSH connections to the same host, not made over Tailscale, will still work.

I literally quoted the section about the ssh config files in my original question, so obviously I read further than that one sentence you requoted first.

> No it doesn't.

To you, it doesn't. To me, it does. If you don't think different people can interpret the same words slightly differently in a way that changes the meaning, I'm not sure why you'd bother trying to explain to me what it means.

> What is hard to understand about this?

The exact parts that I asked about and got helpful explanations about from other people in this thread. I read the two parts you quoted (after I had already quoted them before your original response), and I thought that the first part was vague in a way that the second part conflicted with, so I asked a question for clarification.