https://tailscale.com/blog/how-tailscale-works
Ah! OK, now I get it! :-)
But, what found particularly interesting on that page was the following:
>" Some especially cruel networks block UDP entirely
, or are otherwise so strict that they simply cannot be traversed using STUN and ICE. For those situations, Tailscale provides a network of so-called DERP (Designated Encrypted Relay for Packets) servers. These fill the same role as TURN servers in the ICE standard, except they use HTTPS streams and WireGuard keys instead of the obsolete TURN recommendations."
DERP seems like one interesting solution (there may be others!) to UDP blockages...
Would encourage anyone to go look at the wireguard source code, it's amazingly concise and easy to read.
But they do seem to contribute and open source a lot to the community which I am grateful for.
You can't VPN out of the guest WiFi at my work (using personal device), but Tailscale, if connected while I'm at my house or via phone hotspot, will happily let me use my home devices as exit nodes. So I just leave it on all the time and only disconnect if there are issues (rare). I can use sketchy WiFi without really worrying about snooping, and for services that require me to use a US IP address... well, my house is definitely in the US and it's not going anywhere.
It tended to happen a lot more when switching between wifi / cellular when leaving and entering buildings, etc.
Now I just don’t use it
Short lived tokens is not always an option
It can get especially interesting when you do things like have your GitHub runners onboard themselves to Tailscale - at that point you can pretty much fully-provision isolated systems directly from GitHub Actions if you want
We use it for to allow us to connect in from the outside (and user to user access etc), but not for service to service connections.
Performance between fly.io web servers in iad region to RDS databases in us-east-1 via subnet routers has been spotty to say the least.
They provided much-needed solutions to annoying problems and did it in a way that made developers love them.
Really smart and well executed.
Similarly I’m going to host my small business’ staging database on a home server and expose that on my tail net.
setheron•3mo ago