8 ms·

One's banned in my hostel because of a stupid sysadmin. One isn't.

bongodongobob 9mo ago
Not allowing random VPN connections on a LAN is pretty standard. I've been surprised at how many people here are able to use tailscale and the like. Guessing it's just because there are likely smaller teams here that don't have any kind of managed network.
- antonvs 9mo ago
  Smaller teams, yes, but also it seems as though the SaaS explosion has led to many enterprises significantly relaxing the "hardness" of their network boundaries, at least when it comes to integration with companies whose services they depend on. I've seen Tailscale and tools like ngrok being approved to get into large enterprises who you might think wouldn't allow it. Some of these enterprises will set up a bastion in a DMZ to control that, but I've been surprised by how many don't do that. That relaxation tends to have ripple effects - once you allow tunneling tools in for one purpose - like SaaS integration - then it becomes more normalized and people start using it for other purposes.
- observationist 9mo ago
  Someone is making your IT team do extra work without a good understanding of their systems if they're banning tailscale or granting special network level access thinking that ip or mac address based profiling is secure. Your network should be zero trust. That means you want to treat every host that connects as if it's on the public internet; the corollary to that is you should give your hosts access to the public internet, unrestricted, and treat your users like adults who don't need micromanaging or constant surveillance (do sane logging, ofc.) If you need a host that's subject to continuous surveillance, design it as such and require remote access with MFA, and so on. Give your end users as much freedom as possible, and only constrict it where necessary, or you're going to incentivize shadow IT, unintended consequences, and a whole lot of unnecessary make-work that doesn't contribute to security. Unrestricted access forces change management, design choices, and policy to confront each user and device for the attack vector they are, and to behave accordingly.
  - panarky 9mo ago
    And then a few of those users who you treated like adults who don't need surveillance make a private network among themselves and other nodes in Russia and China to exfiltrate the corporation's most sensitive intellectual property, serve as a bridge for state-sponsored bad actors to bypass your firewall, and tunnel command-and-control traffic through your "unrestricted" egress, and now your zero-trust philosophy has created a zero-accountability blind spot that your IR team discovers eighteen months later during a breach investigation.
    - idiotsecant 9mo ago
      If your threat is state sponsored bad actors you've already failed. OK, great you blocked VPNs. Now they tunneled their vpn through as HTTPS. You successfully annoyed all your legit users and completely failed to stop the real problem.
      - wkat4242 9mo ago
        Https is also inspected in our place and has been for a decade. Also there's different classes of state sponsored APT groups. You won't stand a chance against the NSA but there's a lot of state sponsored groups in Russia that are just looking for low hanging fruit to get some foreign money for their regime.
    - hugo1789 9mo ago
      What’s the alternative—locking down all legitimate users and still losing the data anyway? Network controls alone don’t stop exfiltration. HDMI/DP can move data faster than most consumer NICs. Does the system account for that scenario?
      - wkat4242 9mo ago
        It's a matter of layers. Banning VPNs isn't a perfect measure. But it makes it a lot easier than when you let everyone cowboy around. Same with RBAC. It's not perfect because some people need legit access to stuff and it can be abused. But it makes it much harder for bad actors.
- c0balt 9mo ago
  About that, we actually tried (with support from the network team) to open a small VPN Fron our office for some mobile devices as part of an event installation. Just plain wireguard on a public IP. After two weeks of back and forth the wireguard packets were still being discarded somewhere by a firewall/router thanks to "deny VPNs by default". Tailscale got through those immediately though by using their relays + one of the workarounds for standard wireguard ports being blocked. Point being, the service provided by a mature solution like Tailscale for punching through networks is surprisingly effective even for corporate-level networks.
pcarroll 9mo ago
Would you mind revealing which one is banned? I wonder what they are using to make that determination.
- Imustaskforhelp 9mo ago
  They are most likely referring to tailscale in my opinion.
  - sh3rl0ck 9mo ago
    Yes.
linsomniac 9mo ago
I've run into a few odd instances of headscale not working where I'd expect it to and I don't understand how it's failing. - Connected to my phone hotspot in the car outside my son's therapist, it worked for months, but then for 2-3 weeks tailscale wouldn't connect. Browsing worked fine. In the 6 weeks since then, it's worked fine. - A couple nights ago I was in a Holiday Inn Express. I could successfully connect to tailscale, and ssh to machines at the office (which has tailscale on a public IP, but couldn't pass traffic to my machine at home (behind NAT, we have a DERP next to the machine at the office and also another one on the headscale node at AWS). Maybe they blocked the DERP port?
- pcarroll 9mo ago
  I have found that residential ISP routers are notoriously flaky. It doesn't take much to confuse them. A lot of edge cases could be just this.

Not allowing random VPN connections on a LAN is pretty standard. I've been surprised at how many people here are able to use tailscale and the like. Guessing it's just because there are likely smaller teams here that don't have any kind of managed network.

antonvs 9mo ago
Smaller teams, yes, but also it seems as though the SaaS explosion has led to many enterprises significantly relaxing the "hardness" of their network boundaries, at least when it comes to integration with companies whose services they depend on. I've seen Tailscale and tools like ngrok being approved to get into large enterprises who you might think wouldn't allow it. Some of these enterprises will set up a bastion in a DMZ to control that, but I've been surprised by how many don't do that. That relaxation tends to have ripple effects - once you allow tunneling tools in for one purpose - like SaaS integration - then it becomes more normalized and people start using it for other purposes.
observationist 9mo ago
Someone is making your IT team do extra work without a good understanding of their systems if they're banning tailscale or granting special network level access thinking that ip or mac address based profiling is secure. Your network should be zero trust. That means you want to treat every host that connects as if it's on the public internet; the corollary to that is you should give your hosts access to the public internet, unrestricted, and treat your users like adults who don't need micromanaging or constant surveillance (do sane logging, ofc.) If you need a host that's subject to continuous surveillance, design it as such and require remote access with MFA, and so on. Give your end users as much freedom as possible, and only constrict it where necessary, or you're going to incentivize shadow IT, unintended consequences, and a whole lot of unnecessary make-work that doesn't contribute to security. Unrestricted access forces change management, design choices, and policy to confront each user and device for the attack vector they are, and to behave accordingly.
- panarky 9mo ago
  And then a few of those users who you treated like adults who don't need surveillance make a private network among themselves and other nodes in Russia and China to exfiltrate the corporation's most sensitive intellectual property, serve as a bridge for state-sponsored bad actors to bypass your firewall, and tunnel command-and-control traffic through your "unrestricted" egress, and now your zero-trust philosophy has created a zero-accountability blind spot that your IR team discovers eighteen months later during a breach investigation.
  - idiotsecant 9mo ago
    If your threat is state sponsored bad actors you've already failed. OK, great you blocked VPNs. Now they tunneled their vpn through as HTTPS. You successfully annoyed all your legit users and completely failed to stop the real problem.
    - wkat4242 9mo ago
      Https is also inspected in our place and has been for a decade. Also there's different classes of state sponsored APT groups. You won't stand a chance against the NSA but there's a lot of state sponsored groups in Russia that are just looking for low hanging fruit to get some foreign money for their regime.
  - hugo1789 9mo ago
    What’s the alternative—locking down all legitimate users and still losing the data anyway? Network controls alone don’t stop exfiltration. HDMI/DP can move data faster than most consumer NICs. Does the system account for that scenario?
    - wkat4242 9mo ago
      It's a matter of layers. Banning VPNs isn't a perfect measure. But it makes it a lot easier than when you let everyone cowboy around. Same with RBAC. It's not perfect because some people need legit access to stuff and it can be abused. But it makes it much harder for bad actors.
c0balt 9mo ago
About that, we actually tried (with support from the network team) to open a small VPN Fron our office for some mobile devices as part of an event installation. Just plain wireguard on a public IP. After two weeks of back and forth the wireguard packets were still being discarded somewhere by a firewall/router thanks to "deny VPNs by default". Tailscale got through those immediately though by using their relays + one of the workarounds for standard wireguard ports being blocked. Point being, the service provided by a mature solution like Tailscale for punching through networks is surprisingly effective even for corporate-level networks.

pcarroll 9mo ago

Would you mind revealing which one is banned? I wonder what they are using to make that determination.

Imustaskforhelp 9mo ago
They are most likely referring to tailscale in my opinion.
- sh3rl0ck 9mo ago
  Yes.

linsomniac 9mo ago

I've run into a few odd instances of headscale not working where I'd expect it to and I don't understand how it's failing. - Connected to my phone hotspot in the car outside my son's therapist, it worked for months, but then for 2-3 weeks tailscale wouldn't connect. Browsing worked fine. In the 6 weeks since then, it's worked fine. - A couple nights ago I was in a Holiday Inn Express. I could successfully connect to tailscale, and ssh to machines at the office (which has tailscale on a public IP, but couldn't pass traffic to my machine at home (behind NAT, we have a DERP next to the machine at the office and also another one on the headscale node at AWS). Maybe they blocked the DERP port?

pcarroll 9mo ago
I have found that residential ISP routers are notoriously flaky. It doesn't take much to confuse them. A lot of edge cases could be just this.