3 comments

  • devilbunny2 hours ago
    Tailscale has another interesting feature that I figured out entirely by accident: while the SSO planes (at least using Apple as SSO, rather than your own) may be blocked, the data planes and actual control planes usually are not. If your device is connected to your tailnet before joining a given WiFi, it will stay connected afterward.<p>The guest WiFi at work blocks OpenVPN connections, but established Tailscale slips by. I haven&#x27;t tried straight Wireguard because I don&#x27;t consider Tailscale having timing and volume data on me to be all that valuable to them, and they do mitigate the double-NAT situation. I do run a private peer relay for my tailnet but not a full DERP server, nor do I run Headscale.<p>Obviously, your personal security concerns play a role here, but I&#x27;m not doing anything I wouldn&#x27;t do straight from my home network, so I see no reason to make my life harder. If you need that level of security, you need a different solution.
    • gpm1 hour ago
      While waiting for someone in the hospital I recently played the fun game of &quot;how can I work around their firewall stopping me from connecting to tailscale&quot; that they kindly provided.<p>It was just blocking new connections. Via SNI. Tailscale&#x27;s control plane turn out not to care if SNI is sent. Tailscale&#x27;s app let you set a custom control plane... like a local proxy that forwards connections to tailscale&#x27;s servers without setting SNI.
      • devilbunny41 minutes ago
        This may very well be the system in use.<p>I&#x27;ve seen this effect in several places, not just my work.<p>Of note: I do not work in the tech sphere. I suspect that this particular loophole may be used by IT personnel to be able to tell the management &quot;yes, we block VPN use&quot; while letting them continue to use their own VPNs. I see no reason to complain.
        • gpm31 minutes ago
          I suspect there&#x27;s less thought put into it than that.<p>There&#x27;s probably a firewall vendor that has a product that does SNI inspection for blocking things like pornhub and the product comes with a list of sites that includes VPN control planes.
          • devilbunny14 minutes ago
            Well, yeah, they didn&#x27;t roll their own. Offhand, I forget the product, but it&#x27;s definitely off the shelf.<p>My point being that surely <i>some</i> of them have noticed the same thing I have, and it hasn&#x27;t been stopped. I&#x27;m not going to raise the issue either way.
    • mrsssnake58 minutes ago
      My work guest WiFi network allows only IPv4 HTTPS on port 443 and their their own DNS. Everything else, including ICMP (ping) is blocked. Tailscale barely works as any persistant connection is dropped after 2-3 minutes.<p>Called this out and the security team said noone complains, that there is no use case and they do not want to deal with security risks.<p>And the ossification continues.
      • dheera56 minutes ago
        A TCP over websockets VPN would be fairly simple to write, or ask an AI to write for you
    • stonecharioteer1 hour ago
      Wait, tailscale survives connecting to a locked down wifi? That&#x27;s insane. I remember not being able to use NordVPN at work. I&#x27;d just switch to 4G back then. But if you can&#x27;t initiate a tailscale connection when connected to the office wifi, what does that mean?
      • devilbunny54 minutes ago
        Initiate while on mobile connection or tethered to one (or just leave it connected from home), use while on that WiFi.<p>EDIT: I figured this out because I brought my laptop from home to do a few things while at work that needed it. I noticed that my Tailscale connection (initially established at home) was working just fine. That&#x27;s when I realized that it was the initial authentication that was blocked, not the service.<p>My phone is usually on my tailnet and my iPad is always on it (and using my home exit node), as a result. Using the exit node has a modest but noticeable effect on battery life, but just being connected is maybe 2% of battery a day. Negligible.
      • blactuary41 minutes ago
        When I work at the local coffee shop I cannot SSH to my remote servers for work on their wifi, but if I connect to Tailscale and use my exit node at home I can. Lifesaver
  • comrade12341 hour ago
    Tailscale is interesting. It&#x27;s built on top of wiregaurd but is different in that it creates a mesh of vpn connections between your devices, rather than just a connection from client to server.<p>I haven&#x27;t used it because I use witeguard the traditional way and haven&#x27;t needed a mesh of devices. Also I haven&#x27;t taken time to investigate the private company offering it and what sorts of my information is vulnerable if I use it.
    • socalgal254 minutes ago
      This is my question too... It&#x27;s concerning to me that everyone one seems to be using tailscale (and maybe cloudflare access) and that I don&#x27;t see mention of open source alternatives. I&#x27;m sure for some network experts the alternatives are obvious? Setup a server somewhere publically available that runs ??? and have it be your auth&#x2F;rendezvous server.<p>people complain about github being proprietary but I haven&#x27;t seen much complaint about tailscale being proprietary.<p>I assume I&#x27;m just being overly paranoid? It&#x27;s certainly convenient to just sign up and have things just work.
      • jonah-archive34 minutes ago
        The Tailscale client (non-GUI) is open source: <a href="https:&#x2F;&#x2F;github.com&#x2F;tailscale&#x2F;tailscale" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;tailscale&#x2F;tailscale</a><p>And they collaborate with Headscale to provide an open-source coordination server (with, unsurprisingly, a more limited featureset, but it works fine with their closed-source GUI client): <a href="https:&#x2F;&#x2F;tailscale.com&#x2F;opensource#encouraging-headscale" rel="nofollow">https:&#x2F;&#x2F;tailscale.com&#x2F;opensource#encouraging-headscale</a><p>I use the combination myself and it works quite well, but of course is less convenient than using their product (which I also do in a different context). Overall I&#x27;m pretty happy with their open-source stance.
      • giobox39 minutes ago
        There is a well documented opensource alternative to Tailscale - Headscale. The tailscale client is already opensource, Headscale is opensource drop in replacement for the control server which isn&#x27;t, and fully compatible with Tailscale clients:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;juanfont&#x2F;headscale" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;juanfont&#x2F;headscale</a><p>If you can be bothered running the headscale container, you generally don&#x27;t need to pay for tailscale. It&#x27;s been pretty well supported and widely used for a number of years at this point. Tailscale even permit their own engineers to contribute to headscale, as the company sees it as complimentary to the commercial offering.
        • kurante16 minutes ago
          &gt; Headscale is ... drop in replacement<p>I&#x27;ve been really happy with headscale, but I wouldn&#x27;t call it a complete drop in replacement as I would with vaultwarden. Some features (e.g. Mullvad integration, ACL tests, etc) are missing.<p>Upgrading also requires upgrading every minor version or you run into db migration issues, but that comes with the territory of running your own instance.<p>I would recommend folks look up if headscale suits their needs (like it did for me for many years) before switching over.
    • dig116 minutes ago
      You can also build a mesh network using standard wireguard. While manual configuration requires exchanging keys and settings between devices, many ansible playbooks can automate this process with minimal effort.
  • gsmiznith3 hours ago
    Interesting article; do you have any details on the performance differences?
    • stonecharioteer2 hours ago
      Differences between openvpn and tailscale exit nodes? I can run some tests this weekend.