Hacker News Reader

Comment by fitblipper | Hacker News Reader

I used to LOVE tailscale. Then I put wireguard on my home network exposed to the internet with a dynamic DNS provider and it immediately became irrelevant. Not only is raw wireguard more stable (I don't have to fight the DNS issues on my mobile phones) it feels faster and is amazingly simple to set up.

View on HN

Tailscale takes two minutes to setup and you can add more devices with zero configuration.

WireGuard takes 30 mins to an hour to set up, you'll need to configure port forwarding, DDNS, create keys for each device, and add them to each device manually. But you have 100% control.

Performance-wise, I haven't noticed a difference. My internet connection maxes out way before Tailscale hits any performance limits.

Tailscale wins for convenience.

I started with plain wireguard then migrated to tailscale, for my use case:

- I was able to get my partner onto the tailnet by telling her to install an app and login. She doesn't know or care what wireguard is, but she can now access some of my self hosted services on her phone.

- I'm able to easily dynamically register machines to the tailnet, such as CI jobs

- I'm able to self host a DNS resolver and have it just work for devices connected to the tailnet

I'm sure I could achieve these goals with plain wireguard, but I feel like I was able to outsource significant complexity to tailscale instead.

I followed a similar trajectory for similar reasons. I was playing with wireguard around 2020 when I learned of Tailscale and since then haven't looked back.

Just the other day I was able to set my sister up with access to my Plex server and the ability to piggyback on my UK internet connection to stream BBC/Channel 4 content from Australia. It took all of 5 minutes to get it working.

Same trajectory, but I've now migrated a lot of my previous tailscale stuff to Cloudflare tunnels -- it opens up the attack vector a _little_ bit (that can be mitigated) and it's app-free (which made it viable for a lot of my non-tech users). Still love tailscale and use it all the time for remote access to very sensitive stuff (ssh).

Interesting. I've obviously heard Cloudflare tunnel, but haven't looked into beyond knowing that it exists. Was going "app-free" the primary motivator in your case for the switch?

I have a few services I've configured static routes for on my router (so my wife can access them without needing to have her phone connected to Tailscale all the time), but other than that it's never been much of a pain point.

Yeah, the app-free nature of tunnels was a huge draw. Cloudflare does effectively MiTM your traffic, so that's a risk you have accept but the tradeoff was worth it for me. Between that an the secondary authentication you can put in front of your services, I felt much better about opening my self-hosted stuff to to relative 'public'.

Care to share your setup? I did some research into self hosting my own wireguard for my nuc and rpi, before ultimately settling on Tailscale because of how much simpler and plug-and-lay it was to add/remove devices compared to self hosting wireguard, not dealing with certificates, maintenance, etc.

I have an openwrt router running wireguard. I use it to provision the peer keys and routes. I also use openwrts cloudflare ddns which is super simple to setup. Any new client I want to add I jump into the wireguard interface in the GUI, go to the peer tab, and it does everything for me there.

There are no certificates to share with Wireguard. Nothing to rotate if you don't want to. Once it works, it works.

I've even got a backup wireguard server running on a Pi 1b. Works fine. We currently run wireguard on our router (and it seems more and more routers are supporting it).

There are keys to configure for each client, but once you have the configuration for one client, the rest come very quickly and easily.

I should add that I don't have any experience with Tailscale, but compared to OpenVPN and other VPN solutions, Wireguard is lightweight, simple, and easy to setup/configure.

We use it on all our mobile devices (phones, laptops, tablets) to tunnel our traffic through our home network with all the filtering it offers (along side access to private services we host).

I used https://wgportal.org/latest/

Once you install it you can then do everything from a UI to onboard new users.

It supports OIDC so you can avoid mangling with password and delegate that to an iDP such as google, github etc.

Get a Unifi system. It's built in. Works great!

That was my thinking as well. I got the unify fiber gateway specifically for unify teleport and vpn integration.

I find tailscale to be simpler, more reliable and cover my needs better. I am pretty sure that have i known about tailscale before, i wouldn't have got the unify gateway.

I still love my unify though, dashboard galore

I use an Island Router with Wireguard server built in, it handles DDNS and even the base Island router is beefy enough to give me up to 954mbps or so of Wireguard to right inside my home network. It took 2 minutes to set up.

That being said, I do understand the appeal of Tailscale and have used it.

My favorite thing about Tailscale is how it lets you SSH/RDP INTO servers without having to open any ports.

It all depends on the use case…I have two raspberry units running as exit nodes back in my home country, one in my mother’s place and another in my in-laws’. They have regular internet providers routers, and at least one of the routers wouldn’t even be able to properly support port forwarding.

Tailscale allowed me to setup everything at home and just plug them to their network in 5 mins.

No you are being disingenuous if you think raw wireguard is amazingly simple to set up. Sure it is simpler than IPSec. But it’s absolutely not simpler than Tailscale. I migrated my raw Wireguard setup to Tailscale because after a few months without any tinkering I simply forget details of my setup. I’d rather outsource it to Tailscale.

Reply on news.ycombinator.com