Hacker News

points by drdexebtjl 2 days ago | 0 comments

This is also how I feel about Tailscale and its popular alternatives. They do too much.

Does anyone know of a Tailscale alternative that sticks to the basics?

Something that’s just WireGuard but without the manual key exchange, and with Tailscale-like NAT hole-punching that falls back to using an oblivious relay?

[–] sigbottle 2 days ago

I've been toying around with nebula, self host your lighthouse on a cheap VPS (which even if it gets hacked, the most it can do is lie about traffic, not lie about node certs). Basically you're just paying for the punchthrough (you may even be able to do some duckdns shenanigans?) The main issue is that updating nodes is a pain in the butt, which is the main advantage of tailscale IMO - centralized control plane. Keeps it simple.

I was trying to do some kind of insane workflow where you as the operator have a privileged hardware yubikey that admins the nodes when you plug it in, and the point is the nodes would self-propogate the changes outwards. I immidiately ran into classic issues with distributed security in distributed systems (even with only one central operator trying to admin everything). Tailscale is also a bit more secure in its oauth layer - with this architecture, you need to set proper time limits for expiring so one node compromise doesn't get access to the whole fleet. Couldn't really come up with better ideas than forcing the operator to reuse some kind of hardware key (the idea trying to be avoiding maintaining a cloud control plane as much as possible)

Fun foray but creating such a system requires a lot of expertise that I unfortunately lack

[–] LeBit 2 days ago

I used Nebula extensively.

I really liked it. I like the idea of embedding firewall rules in a certificate.

But , like you observed, it does not scale as well as tailscale.

[–] plextoria 22 hours ago

Is ZeroTier something you considered? I’m not sure if it’s built on WireGuard, but I’ve been using it on some of my personal devices for a while.

[–] Yasuraka 2 days ago

https://github.com/netbirdio/netbird

Bit more than the basics, but not as much as tailscale.

[–] huslage 2 days ago

You can run Tailscale in this mode just fine, or use Tailcat if you want.

[–] drdexebtjl 2 days ago

The point, in the context of this thread, is that the attack surface is huge.

[–] LeBit 2 days ago

No.

{tail,head}scale is the best there is for wireguard at more than 3 nodes.

[–] chasd00 2 days ago

You could just use IPsec. It’s been probably 20 years but look into SWAN. It’s just a vpn in the vpn sense.

[–] InsidiousWombat 1 day ago

IPSec is horrid. Please, don't

It is massively more complex than say Wireguard, because it was developed with "everything and kitchen sink approach", and even the standard de facto authors, Cisco, took good 20 years to stop having IPSec related vulnerability every few months (hell we just had one this year in Linux IIRC)

[–] sgerenser 1 day ago

That doesn’t really help much if you want to connect an arbitrary number of nodes to eachother (each of which is potentially on an entirely different LAN), does it? That’s really the whole point of Tailscale.