Comment on PSA: Update your Tailscale!
lemmyvore@feddit.nl 5 days agoWireguard may be more obviously public, but they both technically are, right? Otherwise accessing a node just wouldn’t be possible.
There is something exposed to the Internet in both cases, yes, but it works very differently.
With WG it’s a client-server pattern; the server exposes a port, waits for authorized clients to connect, and when a client connects successfully the server routes their connections into the private LAN with everything that entails.
With TS the public part is a supplier of control configurations and client pairing service. The pairing service needs to be contacted by two authorized clients in order to negotiate a connection between them. Once that’s done, it’s the clients that route each other’s connections into their respective LANs, the pairing server is not involved anymore.
In other words the TS public surface is not WG, it’s their (proprietary) client verification and matching service. The WG connections between clients happen later, privately.
To me, separating client authentication from routing and transport looks like a better design, because it’s multi-layered. You get the normal WG authentication and another layer on top.
If you don’t need something specific that tailscale offers, then wireguard offers probably better security.
“Security” is a relative term. It’s better to think in terms of attack surface, exposure, whether attacks are targeted or not etc. Which are all ongoing factors.
Both TS and WG are popular and being used by lots of people but it’s also important for them to be actively maintained, independently audited, maintain transparency etc.
In my configuration I have a server with a public IP that manages incoming connections, and my home network connects to that server via a keepalive connection, so it’s actually operating in the same client-server mode you described going through my NAT. This also solves the dynamic IP issues.
When I’m at home, my phone can route directly over my LAN, and when I leave the house it proxies through my public server back to my house (or out to the web depending on what I’m accessing).
hirihit640@sh.itjust.works 4 days ago
This is pedantics, but technically what you are talking about can be achieved with wireguard too. You are talking about using STUN/TURN to do NAT holepunching to establish a connection between two wireguard clients.
Wireguard is just the vpn protocol. Tailscale even uses it. How the connection is established, is up to the user. So what you’re really talking about is Tailscale vs “how most people set up Wireguard”.
The reason why I make this distinction is because it would be nice if somebody made an easy self-hosted way to do the STUN/TURN stuff for plajn wireguard.
lemmyvore@feddit.nl 4 days ago
There’s Headscale, but it can’t be fully selfhosted because you need an external host if both clients are behind NAT.
hirihit640@sh.itjust.works 4 days ago
afaik Headscale is designed for Tailscale and not plain Wireguard. It’s overkill for plain wireguard.
lemmyvore@feddit.nl 4 days ago
I mean, “plain WG” doesn’t have the ability to connect multiple sites seamlessly, nevermind from behind NAT. That’s what Headscale/Tailscale do, they enable multiple WG backends to connect together on the fly into a common VLAN, with almost zero extra config.
It may seem overkill if you only want to connect two sites but once you solve this problem for 2 it’s basically also solved for N so why not take advantage of the capability.