13 ms·

Tailscale Peer Relays is now generally available

470 points by sz4kerto 7mo ago

debarshri 7mo ago
For someone who is new in this technically does it work like turn and sturn? Relay communicating over outbound ports? Wouldnt this run into scaling issues?
jahrichie 7mo ago
Are you guys using this for OpenClaw or what?
- nsbk 7mo ago
  One of the many use cases, but basically yes. Other use cases: Home automation, remote backups, media servers, photo libraries, AI assistants... you name it!
- josefresco 7mo ago
  I use it only as a Personal VPN - works great!
- dwedge 7mo ago
  It's a vpn from the original definition before vpn meant a proxy to get around geoblocks. I use tailscale for my home servers, my routers, for servers I have in other houses all behind NAT. I have half a dozen raspberry pi print servers in two warehouses also behind NAT and they can connect to each other and I can connect to them from CGNAT
tda 7mo ago
I just set this up the other day, and I got my ping to drop from 16 to 10ms, and my bandwidth tripled, when connecting from a remote natted site to a matter desktop my house. Together with Moonlight/Sunshine I can now play Windows games on my Linux desktop from my MacBook, with 50mbps/10ms streaming. So far so good! Not a single port forwarded, I just set my router up as peer node.
- deleted 7mo ago
  [deleted]
- arjie 7mo ago
  What hardware do you use on the networking side?
  - tda 7mo ago
    Nothing special, an edgerouter that allows installing tailscale
    - arjie 7mo ago
      Ah, perfect. The Mikrotiks weren't as straightforward earlier but maybe it's easier now. Glad to know it works on EdgeOS. Did you just use this? https://github.com/jamesog/tailscale-edgeos https://github.com/jamesog/tailscale-edgeos
      - OJFord 7mo ago
        On RouterOS you just need hardware that supports containers, then you can just run the offical tailscale image. Otherwise there's native ZeroTier and WireGuard, but no Tailscale.
- aborsy 7mo ago
  There are several ports open (you dont open them, Tailscale does), including for peer relay. Some are vpn ports, but the ports for relay servers are not for VPN so my guess is that the software that listens to those ports is a lot less secure (compared to Wireguard or OpenVPN).
  - tda 7mo ago
    Yes my router has open ports, but it does not do any port forwarding. So I can 'directly' connect any device behind my router without my router needing to know any specifics of which device that is. And I don't need to do any port forwarding of anything on my network and thus expose them to the whole internet; I just expose them to the users of my tailscale network (only me)
behnamoh 7mo ago
How does Tailscale make money? I really like their service but I'm worried about a rug pull in the future. Has anyone tried alternative FOSS solutions? Also, sometimes it seems like I get rate limited on Tailscale. Has anyone had that experience? This usually happens with multiple SSH connections at the same time.
- prodigycorp 7mo ago
  I love tailscale but you may be right, it's entering that acquisition zone that'll inevitably bum everyone out. Salesforce, stay away from it!
  - politelemon 7mo ago
    Dearest Salesforce, Apple, Oracle, and IBM. Please look elsewhere for acquisitions to ruin for everyone. Cheers.
  - tomxor 7mo ago
    I have the same fears. Last year they have publicly stated they are not interested in acquisition [0] > Pennarun confirmed the company had been approached by potential acquirers, but told BetaKit that the company intends to grow as a private company and work towards an initial public offering (IPO). > “Tailscale intends to remain independent and we are on a likely IPO track, although any IPO is several years out,” Pennarun said. “Meanwhile, we have an extremely efficient business model, rapid revenue acceleration, and a long runway that allows us to become profitable when needed, which means we can weather all kinds of economic storms.” Nothing is set in stone, after all it's VC backed. I have a strong aversion to becoming dependent upon proprietary services, however i have chosen to integrate TS into my infrastructure, because the value and simplicity it provides is worth it. I considered the various copy cat services and pure FOSS clones, but TS are the ones who started this space and are the ones continuously innovating in it, I'm onboard with their ethos and mission and have made use of apenwarrs previous work - In other words, they are the experts, they appear to be pretty dedicated to this space, so I'm putting my trust in them... I hope I'm right! [0] https://betakit.com/corporate-vpn-startup-tailscale-secures-230-million-cad-series-c-on-back-of-surprising-growth/ https://betakit.com/corporate-vpn-startup-tailscale-secures-...
itissid 7mo ago
I have my homenas set up with Node Proxy Manager container forwarding requests to different docker machines:ports e.g. I have some TTS/STT/LLM services locally hosted. To increase bandwidth to internet facing nodes, would you use this or some other simpler solution?
- tecleandor 7mo ago
  Is it a typo and it's the Nginx Proxy Manager?
  - mikepurvis 7mo ago
    I assume so; I use the same thing with my Unraid box and then create the DNS entries in the unifi panel so I get jellyfin.lan, minecraft.lan, etc inside the house.
  - itissid 7mo ago
    Oh yeah Nginx* not Node.
aborsy 7mo ago
Is peer relay essentially a custom relay which was previously available, except now it’s one command? So it runs a STUN server or similar, for discovery and relaying.
- kabirx 7mo ago
  Peer relays are a bit different from our previously available Custom DERP servers. While the custom DERPs do relay traffic, they also require a bunch of configuration and management for their other jobs and they open up availability concerns that are pretty tough for our average customer. Conversely Peer Relays are built on top of the shoulders of DERP. For example, they don't need to do peer discovery set connections up end to end - instead connections are brokered via our DERP fleet and then in a sense "upgraded" to an available Peer Relay or Direct connection. Because of that they're super lightweight and much easier to deploy + manage. And, they scale horizontally so you can deploy many peer relays across your network, and they're resilient to downtime (we'll just fall back to DERP).
  - shj2105 7mo ago
    I’m so confused. What is the difference between a peer relay and a DERP server that is self hosted? The issue I have is I’m trying to connect two devices where one is behind a CGNAT that always causes the connection to be relayed even though the other one is not behind a cgnat with proper port forwarding. Would a peer relay solve this but is it like a DERp where I have to host it on a VPS separate from my existing two networks or is this something different where I can host the peer relay on the network not behind a CGNAT and somehow it will link the two networks through it?
    - kabirx 7mo ago
      You should be able to stand up a peer relay on an existing tailscale device - so your proposal is correct! Try setting one of the devices up as a peer relay per the docs here: https://tailscale.com/docs/features/peer-relay https://tailscale.com/docs/features/peer-relay
himata4113 7mo ago
I never brought my self to use tailscale because it has a login screen and I absolutely despise that even as a concept for a private NAT. I know headscale exists, but it doesn't seem to even support the features I really want.
- earthscienceman 7mo ago
  I can't believe this isn't a show stopper for more people here. I literally couldn't figure out how use it the first time tried because I didn't know how to comprehend that it was trying to get me to auth via browser window. I kept digging around for a tailscale.conf. Which is then when I realized it was less a piece of software and more so an auth management provider with some vaguely helpful auxillary services.
yuvadam 7mo ago
Tailscale simp here, been using this feature since it launched in beta, can't believe it didn't exist earlier. This solved every last remaining problem of my CGNAT'd devices having to hop through STUN servers (with the QoS being noticable), now they just route through my own nodes.
- hashstring 7mo ago
  Why does STUN impact your QoS? I thought STUN was just for discovering your own external IP/port.
kittbuilds 7mo ago
The peer relay approach is interesting because it essentially turns every node in your tailnet into a potential relay for other nodes. This is a meaningful architectural shift from relying on Tailscale's centralized DERP servers. For anyone worried about the "rug pull" concern raised in another comment — this actually makes me more optimistic, not less. By distributing relay infrastructure to the edges, Tailscale is reducing its own operational cost per user while improving performance. That's the kind of flywheel that makes a generous free tier more sustainable, not less. Each new node potentially helps the whole network.
drnick1 7mo ago
It's a bit disingenuous to present solutions like Tailscale as more secure than opening a VPN port on one's on machine. The latter solution should always be preferred when available just because you don't want your infrastructure to depend on a "free" service which might cease to be free tomorrow.
- nickburns 7mo ago
  Things are much more unscrupulous than potentially ceasing to be free tomorrow. Nobody who values their privacy would ever route their network traffic through a 'free' service.
  - jon_adler 7mo ago
    Isn’t there separation of the control and data planes? I don’t think Tailscale get to see any of your network traffic.
    - nickburns 7mo ago
      They need to know how/where to route your outbound traffic. That inherently includes plaintext DNS, TLS handshakes, and otherwise plaintext traffic (like HTTP for example). Anybody wanting to see what Tailscale is able to see can simply sniff any router interface passing outbound traffic before it enters the WireGuard tunnel interface.
      - db48x 7mo ago
        No, that’s not quite true. The wireguard tunnels that the Tailscale daemon creates only go to your own machines. Nothing going through those tunnels goes to or is seen by Tailscale the company. Sometimes those tunnels go through a proxy (especially when you’re afflicted by CGNAT), but the proxy sees only encrypted traffic.
        nickburns 7mo ago
        So how does the proxy know where to proxy packets to?
adithyassekhar 7mo ago
I wish I could read this but got this[0] guy on mobile with no close button, won't close when you click outside the modal. 0: https://i.postimg.cc/14h3Q9mD/Screenshot-20260219-001356-Chrome-Canary.jpg https://i.postimg.cc/14h3Q9mD/Screenshot-20260219-001356-Chr... Edit: Nvm, found it. Weird place to put it.
- yardstick 7mo ago
  I see a white X in a blue box to the lower right of the modal. Is it that?
  - adithyassekhar 7mo ago
    That was it, ok now I feel stupid.
    - a_wild_dandan 7mo ago
      You’re not stupid. That’s terrible UX. The button is completely disconnected from its modal, and is placed in a bizarre/nonstandard location.
      - ChrisClark 7mo ago
        It's placed like one of those chat services on sites. Which we've been trained to ignore.
      - yardstick 7mo ago
        Sounds like a bug in their css layout related to the smaller screen size
    - drannex 7mo ago
      Oh man, I even read all the comments and still couldn't find it when I finally clicked on the image link. Terrible UX. cc: @apenwarr (tailscale founder), might want to have someone fix this and move the close button to the top right of the modal, not the bottom right.
shj2105 7mo ago
I’m so confused. What is the difference between a peer relay and a DERP server that is self hosted?
- allthetime 7mo ago
  Talking out my ass, but as with all things Tailscale, not much, aside from easier to use / less manual setup. Nothing they do was impossible before, but their big win is making world wide private networking easy and accessible. I’ve been on-boarding my friends who have their own local media servers setup so we can all share/stream content from each other.
- apenwarr 7mo ago
  (Tailscale founder here) Two main differences: first, every DERP server used by your tailnet must be accessible by every node on your tailnet at all times, otherwise you get hard-to-debug netsplits. That's a very high bar to maintain so we've historically recommended you don't try. In contrast, peer relays are "if a given pair of nodes can connect through any of the relays, go for it" so deploying one is always a performance and reliability improvement. Secondly, peer relays support UDP while DERP is TCP-only. That would be fixable by simply improving the DERP protocol, but as we explored that option, we decided to implement the Peer Relay layer instead as a more complete solution.
  - shj2105 7mo ago
    Hmm got it not sure I entirely understand. The issue I have is I’m trying to connect two devices where one is behind a hard CGNAT that always causes the connection to be relayed even though the other one is not behind a cgnat with proper port forwarding. Would a peer relay solve this but is it like a DERP where I have to host it on a VPS separate from my existing two networks or is this something different where I can host the peer relay on the same network not behind a CGNAT and somehow it will link the two networks through it?
  - kwakubiney 7mo ago
    > every DERP server used by your tailnet must be accessible by every node on your tailnet at all times, otherwise you get hard-to-debug netsplits. What would allow a given pair of nodes access a peer relay? Isn’t the peer relay by default also accessible by every node on the tailnet since it’s in the tailnet as well?
alberto_delrio 7mo ago
Tried the other day, honestly so far surprised by the good results!
ZoomZoomZoom 7mo ago
If you're sold on Tailscale due to them "being open" (as they semi-officially support the development of Headscale), keep in mind, that at the same time some of their clients are closed source and proprietary, and thus totally controlled by them and the official distribution channels, like Apple. Some of the arguments given for this stance are just ridiculous: > If users are comfortable running non-open operating systems or employers are comfortable with their employees running non-open operating systems, they should likewise be comfortable with Tailscale not being open on those platforms. https://github.com/tailscale/tailscale/issues/13717 https://github.com/tailscale/tailscale/issues/13717 A solution like this can't really be relied in situations of limited connectivity and availability, even if technically it beats most of the competition. Don't ever forget it's just a business. Support free alternatives if you can, even if they underperform by some measures.
- xyst 7mo ago
  I switched to Netbird because of this.
- 8cvor6j844qw_d6 7mo ago
  Went with ZeroTier and Netbird, they're not too bad.
  - drcongo 7mo ago
    I keep hoping to switch to Netbird, but run into the same issue every time for the last couple of years I've been trying it - peers randomly drop of the network. There's a longish standing open issue on their GitHub.
  - wolvoleo 7mo ago
    Zerotier is a lot harder to self-host than tailscale
  - resiros 7mo ago
    Netbird is very good for my use case. Simple to set up, and just works.
  - 7mo ago
jak6jak 7mo ago
I looked into tailscale in the past as a way to host a game server such as minecraft on my local machine publicly without port forwarding . It seems that tailscale is mostly configured only to work with people you know and trust. I was hoping that Peer Relays would help alleviate some restrictions with tailwind funnel. Does anyone know any alternatives?
- Computer0 7mo ago
  if you have a cheap vps you can use it to forward the traffic to for some benefit, that is what i have been doing when i need compute accessible online and don't want to pay for cloud.
bityard 7mo ago
I wonder if someone might indulge me by answering a question or two about Tailscale. I have a self-managed wireguard network which works, but probably isn't very smart or elegant. From what I can gather, Tailscale does a lot of "magic" things to accomplish its goals, and some of them actually have "magic" right in the name. As a system administrator by trade, I have been bitten SO MANY TIMES by things that try to automagically mess with DNS resolution, routing tables, firewall rules, etc in the name of user-friendliness. (Often, things that even ship with the OS itself.) Are there any documentation or articles detailing exactly what it's doing under the hood? I found https://tailscale.com/docs/concepts https://tailscale.com/docs/concepts but it doesn't really cover everything. If I have a virtualization host with, let's call it a "very custom" networking configuration, how likely is it to interfere with things? Is it polite and smart about working around fancy networking setups, or does it really only handle the common cases (one networking interface, a default route, public nameserver) elegantly?
- raggi 7mo ago
  It's difficult for us to maintain documentation of exactly the kind you'd want there, though we do try to keep up with docs as best we can. In particular there is a fairly wide array of heuristics in the client to adapt to the environment that it's running in - and this is most true on Linux where there are far far too many different configuration patterns and duplicate subsystems (example: https://tailscale.com/blog/sisyphean-dns-client-linux https://tailscale.com/blog/sisyphean-dns-client-linux). To try and take a general poke at the question in more of the context you leave at the end: - We use rule based routing to try to dodge arbitrary order conflicts in the routing tables. - We install our rules with high priority because traffic intended for the tailnet hitting non-tailscale interfaces is typically undesirable (it's often plain text). - We integrate with systemd-resolved _by preference_ on Linux if it is present, so that if you're using cgroup/namepsace features (containers, sandbox runtimes, etc etc) then this provides the expected dns/interface pairings. If we can't find systemd-resolved we fall back to modifying /etc/resolv.conf, which is unavoidably an area of conflict on such systems (on macos and windows they have more broadly standard solutions we can use instead, modulo other platform details). - We support integration with both iptables and nftables (the latter is behind manual configuration currently due to slightly less broad standardization, but is defaulted by heuristic on some distros/in some environments (like gokrazy, some containers)). In nftables we create our own tables, and just install jumps into the xtables conventional locations so as to be compatible with ufw, firewalld and so on. - We do our best in tailscaled's sshd to implement login in a broadly compatible way, but again this is another of those places the linux ecosystem lacks standards and there's a ton of distro variation right now (freedesktops concerns start at a higher level so they haven't driven standardization, everyone else like openssh have their own pile of best-guesses, and distros go ham with patches). - We need a 1360 byte MTU path to peers for full support/stability. Our inner/interface MTU is 1280, the minimum MTU for IPv6, once packed in WireGuard and outer IPv6, that's 1360. I can't answer directly based on "very custom" if there will be any challenges to deal with. We do offer support to work through these things though, and have helped some users with fairly exotic setups.
marcosscriven 7mo ago
I really like Tailscale. Recently though I’ve been having some hard-to-diagnose slowdowns even on a direct (non DERP) connection. I’m not sure if it’s something to do with MTUs or my ISP.
solarisos 7mo ago
The shift from managed DERP to decentralized Peer Relays is a massive win for self-hosters with difficult NAT situations. I’m curious if this significantly reduces Tailscale's own egress costs or if the primary goal was just improving latency for users who can't establish a direct WireGuard tunnel. Either way, removing the 'hassle' of setting up a custom DERP server is a great UX improvement.
- alexktz 7mo ago
  Alex from Tailscale here... We’re users just like you, and we felt this pain point ourselves. The good news is that Peer Relays were able to build on a lot of the existing subnet router and exit node plumbing, so it wasn’t a huge engineering lift to bring to life. We also have plenty of customers running in restrictive NAT environments (AWS being a common example), where direct WireGuard tunnels just aren’t always possible. In those cases, something like Peer Relays is essential for Tailscale to perform the way larger deployments expect. So yes, it improves latency and UX for self-hosters, but it also helps us support more complex production environments without requiring folks to run and manage custom DERP infrastructure.
  - solarisos 7mo ago
    Thanks for the context, Alex. It’s interesting to hear that the engineering lift was lighter by leveraging the exit node/subnet router plumbing—that’s a clever use of existing primitives. The point about AWS NAT restrictions is a big one. I think a lot of people underestimate how often 'enterprise-grade' networking actually becomes a bottleneck for direct P2P. Moving that burden away from custom DERP management makes the 'it just works' magic of Tailscale feel much more sustainable for small teams.
- ghthor 7mo ago
  We’ve had issues with the centralized DERPs just blackholing traffic when we startup ephemeral nodes in CI. This is despite us ensuring that all important peers can establish direct connections to each other. But there is some bootstrapping that is happening before both peers negotiate. Having said this, it’s been almost a year since the last incident of this. It’s been rock solid the last months. Ok sure using these new peer nodes will greatly reduce this from even a chance of happening anymore. :hacks away:
timwis 7mo ago
I'm having a hard time understanding how this is different from a bastion server, where you're tunneling through an intermediary server that you've deployed in the target network. I guess the difference is the fact that the intermediary server doesn't need a port open (as standard nat punching will work)? Or are there other big differences?
- fireant 7mo ago
  I think that biggest difference is that your client applications don't need to be explicitly configured to use the bastion server. For example ssh, web browsers, rdp, samba and so on can just pretend that you are inside the target network. Doubly useful if this is a "customer" network and you are working with multiple customers.
- bingo-bongo 7mo ago
  We've setup and used peer-relays since it was first announced and they've been great, but they do solve a somewhat specific problem. Some of our users experienced fairly limited throughput from time to time. Under certain circumstances (eg. always ipv4 NAT/double-NAT, never for ipv6) their Tailscale client couldn't establish a direct connection to the Tailscale node in the datacenter, so data was relayed through Tailscales public relay nodes. Which at times was rate limited/bottleneck - in all fairness, that is to be expected according to their docs. The first mitigation was to "ban" the specific public relay they were using in the policy. Which helped, but still not a great solution and we might just end up in a weird whack-a-mole-ish ban game with the public peer relays in the long run. So we setup a peer relay, which networking-wise is in a DMZ sort of network (more open), but location wise still in the datacenter and allowed it to easily reach the internal (more restricted networking) Tailscale nodes. Which solved all throughput problems, since we no longer have users connecting through the public relays. Also, the peer relays feels a little bit magic, once you allow the use of them in the Tailscale policy, it just works(tm) - there is basically zero fiddling with them. EDIT: I'll happily provide more details if interested - we did a fair amount of testing and debugging along the way :)
  - timwis 7mo ago
1necornbuilder 7mo ago
[dead]
clarabennett26 7mo ago
[dead]
- samat 7mo ago
  Three AI-generated positive comments in the row from new (green) accounts, with some being answered by Tailscale employees looks like AI-assisted astroturfing PR in hackernews. It’s rampart on every major social network (Reddit especially), interesting to see it live first time on the HN. I am not anti advertising, I just think pushing AI into places were people interact is very bad behavior and should be punished.
  - dang 7mo ago
    I doubt that it's employees, but I agree that some of those accounts look like genAI and have banned them. All: (1) Generated comments aren't allowed on HN - this rule predates LLMs but obviously applies even more now: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20%22generated%20comments%22&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... (2) If you see accounts that look like they're mostly posting genAI comments, please let us know at hn@ycombinator.com. That's how I found my way to these cases.
noirscape 7mo ago
Oh that's really cool! I hope it alleviates some pressure on the DERP servers, whenever I notice the connection on tailscale is bad, it's usually because the device is connecting over DERP.
jrm4 7mo ago
I haven't really dived into Tailscale et al because I'm still using Tinc; and the bulk of this discussion continues to make me not want to. What's the big deal here? Any good reason to switch (besides Tinc's obscurity?)
- skinner927 7mo ago
  tinc is cool. Keep using it.
pluto_modadic 7mo ago
Excited to try this out on headscale someday :)
anvevoice 7mo ago
[dead]
nivcmo 7mo ago
[dead]
- ksynwa 7mo ago
  Does the relay not have to have a publicly accessible IP address? Edit: My understanding of network terminologies is weak. But I assumed that the relay server would have to not be behind a CGNAT.
- phrotoma 7mo ago
  Thank you for being the first person in this discussion to explain wtf this is.
  - deleted 7mo ago
    [deleted]
icfly2 7mo ago
I was going to use wireguard, but the setup is always such a pain. Then I realised that Tailscale was Canadian, so I’m happy to use it
techpulse_x 7mo ago
[flagged]
codethief 7mo ago
One thing I haven't quite understood yet: If I have multiple relays, will Tailscale automatically pick the "best one" for a given connection, e.g. the one closest to the destination in terms of latency?
kittbuilds 7mo ago
[dead]
corford 7mo ago
I love tailscale and this is a nice addition. One last item on my wishlist: better Okta support!!
jamiemallers 7mo ago
[dead]
threecheese 7mo ago
Edit: this is a ridiculous question, I know. Trying to eat my dogfood so to speak Does Tailscale maintain an q&a agent, mcp, or llms.txt that anyone is aware of? I’m trying to use Tailscale across my personal networks - without investing a lot of time - and so I’m throwing agents at it. It’s not going well, primarily because their tools/interfaces have been changing a lot, and so tool calls fail (ex ‘tailscale serve —xyz’ is now ‘tailscale funnel ABC’ and needs manual approval, and that’s not in the training set).

470 points by sz4kerto 7mo ago

For someone who is new in this technically does it work like turn and sturn? Relay communicating over outbound ports? Wouldnt this run into scaling issues?

jahrichie 7mo ago

Are you guys using this for OpenClaw or what?

nsbk 7mo ago
One of the many use cases, but basically yes. Other use cases: Home automation, remote backups, media servers, photo libraries, AI assistants... you name it!
josefresco 7mo ago
I use it only as a Personal VPN - works great!
dwedge 7mo ago
It's a vpn from the original definition before vpn meant a proxy to get around geoblocks. I use tailscale for my home servers, my routers, for servers I have in other houses all behind NAT. I have half a dozen raspberry pi print servers in two warehouses also behind NAT and they can connect to each other and I can connect to them from CGNAT

tda 7mo ago

I just set this up the other day, and I got my ping to drop from 16 to 10ms, and my bandwidth tripled, when connecting from a remote natted site to a matter desktop my house. Together with Moonlight/Sunshine I can now play Windows games on my Linux desktop from my MacBook, with 50mbps/10ms streaming. So far so good! Not a single port forwarded, I just set my router up as peer node.

deleted 7mo ago
[deleted]
arjie 7mo ago
What hardware do you use on the networking side?
- tda 7mo ago
  Nothing special, an edgerouter that allows installing tailscale
  - arjie 7mo ago
    Ah, perfect. The Mikrotiks weren't as straightforward earlier but maybe it's easier now. Glad to know it works on EdgeOS. Did you just use this? https://github.com/jamesog/tailscale-edgeos https://github.com/jamesog/tailscale-edgeos
    - OJFord 7mo ago
      On RouterOS you just need hardware that supports containers, then you can just run the offical tailscale image. Otherwise there's native ZeroTier and WireGuard, but no Tailscale.
aborsy 7mo ago
There are several ports open (you dont open them, Tailscale does), including for peer relay. Some are vpn ports, but the ports for relay servers are not for VPN so my guess is that the software that listens to those ports is a lot less secure (compared to Wireguard or OpenVPN).
- tda 7mo ago
  Yes my router has open ports, but it does not do any port forwarding. So I can 'directly' connect any device behind my router without my router needing to know any specifics of which device that is. And I don't need to do any port forwarding of anything on my network and thus expose them to the whole internet; I just expose them to the users of my tailscale network (only me)

behnamoh 7mo ago

How does Tailscale make money? I really like their service but I'm worried about a rug pull in the future. Has anyone tried alternative FOSS solutions? Also, sometimes it seems like I get rate limited on Tailscale. Has anyone had that experience? This usually happens with multiple SSH connections at the same time.

prodigycorp 7mo ago
I love tailscale but you may be right, it's entering that acquisition zone that'll inevitably bum everyone out. Salesforce, stay away from it!
- politelemon 7mo ago
  Dearest Salesforce, Apple, Oracle, and IBM. Please look elsewhere for acquisitions to ruin for everyone. Cheers.
- tomxor 7mo ago
  I have the same fears. Last year they have publicly stated they are not interested in acquisition [0] > Pennarun confirmed the company had been approached by potential acquirers, but told BetaKit that the company intends to grow as a private company and work towards an initial public offering (IPO). > “Tailscale intends to remain independent and we are on a likely IPO track, although any IPO is several years out,” Pennarun said. “Meanwhile, we have an extremely efficient business model, rapid revenue acceleration, and a long runway that allows us to become profitable when needed, which means we can weather all kinds of economic storms.” Nothing is set in stone, after all it's VC backed. I have a strong aversion to becoming dependent upon proprietary services, however i have chosen to integrate TS into my infrastructure, because the value and simplicity it provides is worth it. I considered the various copy cat services and pure FOSS clones, but TS are the ones who started this space and are the ones continuously innovating in it, I'm onboard with their ethos and mission and have made use of apenwarrs previous work - In other words, they are the experts, they appear to be pretty dedicated to this space, so I'm putting my trust in them... I hope I'm right! [0] https://betakit.com/corporate-vpn-startup-tailscale-secures-230-million-cad-series-c-on-back-of-surprising-growth/ https://betakit.com/corporate-vpn-startup-tailscale-secures-...

itissid 7mo ago

I have my homenas set up with Node Proxy Manager container forwarding requests to different docker machines:ports e.g. I have some TTS/STT/LLM services locally hosted. To increase bandwidth to internet facing nodes, would you use this or some other simpler solution?

tecleandor 7mo ago
Is it a typo and it's the Nginx Proxy Manager?
- mikepurvis 7mo ago
  I assume so; I use the same thing with my Unraid box and then create the DNS entries in the unifi panel so I get jellyfin.lan, minecraft.lan, etc inside the house.
- itissid 7mo ago
  Oh yeah Nginx* not Node.

aborsy 7mo ago

Is peer relay essentially a custom relay which was previously available, except now it’s one command? So it runs a STUN server or similar, for discovery and relaying.

kabirx 7mo ago
Peer relays are a bit different from our previously available Custom DERP servers. While the custom DERPs do relay traffic, they also require a bunch of configuration and management for their other jobs and they open up availability concerns that are pretty tough for our average customer. Conversely Peer Relays are built on top of the shoulders of DERP. For example, they don't need to do peer discovery set connections up end to end - instead connections are brokered via our DERP fleet and then in a sense "upgraded" to an available Peer Relay or Direct connection. Because of that they're super lightweight and much easier to deploy + manage. And, they scale horizontally so you can deploy many peer relays across your network, and they're resilient to downtime (we'll just fall back to DERP).
- shj2105 7mo ago
  I’m so confused. What is the difference between a peer relay and a DERP server that is self hosted? The issue I have is I’m trying to connect two devices where one is behind a CGNAT that always causes the connection to be relayed even though the other one is not behind a cgnat with proper port forwarding. Would a peer relay solve this but is it like a DERp where I have to host it on a VPS separate from my existing two networks or is this something different where I can host the peer relay on the network not behind a CGNAT and somehow it will link the two networks through it?
  - kabirx 7mo ago
    You should be able to stand up a peer relay on an existing tailscale device - so your proposal is correct! Try setting one of the devices up as a peer relay per the docs here: https://tailscale.com/docs/features/peer-relay https://tailscale.com/docs/features/peer-relay

himata4113 7mo ago

I never brought my self to use tailscale because it has a login screen and I absolutely despise that even as a concept for a private NAT. I know headscale exists, but it doesn't seem to even support the features I really want.

earthscienceman 7mo ago
I can't believe this isn't a show stopper for more people here. I literally couldn't figure out how use it the first time tried because I didn't know how to comprehend that it was trying to get me to auth via browser window. I kept digging around for a tailscale.conf. Which is then when I realized it was less a piece of software and more so an auth management provider with some vaguely helpful auxillary services.

yuvadam 7mo ago

Tailscale simp here, been using this feature since it launched in beta, can't believe it didn't exist earlier. This solved every last remaining problem of my CGNAT'd devices having to hop through STUN servers (with the QoS being noticable), now they just route through my own nodes.

hashstring 7mo ago
Why does STUN impact your QoS? I thought STUN was just for discovering your own external IP/port.

kittbuilds 7mo ago

The peer relay approach is interesting because it essentially turns every node in your tailnet into a potential relay for other nodes. This is a meaningful architectural shift from relying on Tailscale's centralized DERP servers. For anyone worried about the "rug pull" concern raised in another comment — this actually makes me more optimistic, not less. By distributing relay infrastructure to the edges, Tailscale is reducing its own operational cost per user while improving performance. That's the kind of flywheel that makes a generous free tier more sustainable, not less. Each new node potentially helps the whole network.

drnick1 7mo ago

It's a bit disingenuous to present solutions like Tailscale as more secure than opening a VPN port on one's on machine. The latter solution should always be preferred when available just because you don't want your infrastructure to depend on a "free" service which might cease to be free tomorrow.

nickburns 7mo ago
Things are much more unscrupulous than potentially ceasing to be free tomorrow. Nobody who values their privacy would ever route their network traffic through a 'free' service.
- jon_adler 7mo ago
  Isn’t there separation of the control and data planes? I don’t think Tailscale get to see any of your network traffic.
  - nickburns 7mo ago
    They need to know how/where to route your outbound traffic. That inherently includes plaintext DNS, TLS handshakes, and otherwise plaintext traffic (like HTTP for example). Anybody wanting to see what Tailscale is able to see can simply sniff any router interface passing outbound traffic before it enters the WireGuard tunnel interface.
    - db48x 7mo ago
      No, that’s not quite true. The wireguard tunnels that the Tailscale daemon creates only go to your own machines. Nothing going through those tunnels goes to or is seen by Tailscale the company. Sometimes those tunnels go through a proxy (especially when you’re afflicted by CGNAT), but the proxy sees only encrypted traffic.
      - nickburns 7mo ago
        So how does the proxy know where to proxy packets to?

adithyassekhar 7mo ago

I wish I could read this but got this[0] guy on mobile with no close button, won't close when you click outside the modal. 0: https://i.postimg.cc/14h3Q9mD/Screenshot-20260219-001356-Chrome-Canary.jpg https://i.postimg.cc/14h3Q9mD/Screenshot-20260219-001356-Chr... Edit: Nvm, found it. Weird place to put it.

yardstick 7mo ago
I see a white X in a blue box to the lower right of the modal. Is it that?
- adithyassekhar 7mo ago
  That was it, ok now I feel stupid.
  - a_wild_dandan 7mo ago
    You’re not stupid. That’s terrible UX. The button is completely disconnected from its modal, and is placed in a bizarre/nonstandard location.
    - ChrisClark 7mo ago
      It's placed like one of those chat services on sites. Which we've been trained to ignore.
    - yardstick 7mo ago
      Sounds like a bug in their css layout related to the smaller screen size
  - drannex 7mo ago
    Oh man, I even read all the comments and still couldn't find it when I finally clicked on the image link. Terrible UX. cc: @apenwarr (tailscale founder), might want to have someone fix this and move the close button to the top right of the modal, not the bottom right.

shj2105 7mo ago

I’m so confused. What is the difference between a peer relay and a DERP server that is self hosted?

allthetime 7mo ago
Talking out my ass, but as with all things Tailscale, not much, aside from easier to use / less manual setup. Nothing they do was impossible before, but their big win is making world wide private networking easy and accessible. I’ve been on-boarding my friends who have their own local media servers setup so we can all share/stream content from each other.
apenwarr 7mo ago
(Tailscale founder here) Two main differences: first, every DERP server used by your tailnet must be accessible by every node on your tailnet at all times, otherwise you get hard-to-debug netsplits. That's a very high bar to maintain so we've historically recommended you don't try. In contrast, peer relays are "if a given pair of nodes can connect through any of the relays, go for it" so deploying one is always a performance and reliability improvement. Secondly, peer relays support UDP while DERP is TCP-only. That would be fixable by simply improving the DERP protocol, but as we explored that option, we decided to implement the Peer Relay layer instead as a more complete solution.
- shj2105 7mo ago
  Hmm got it not sure I entirely understand. The issue I have is I’m trying to connect two devices where one is behind a hard CGNAT that always causes the connection to be relayed even though the other one is not behind a cgnat with proper port forwarding. Would a peer relay solve this but is it like a DERP where I have to host it on a VPS separate from my existing two networks or is this something different where I can host the peer relay on the same network not behind a CGNAT and somehow it will link the two networks through it?
- kwakubiney 7mo ago
  > every DERP server used by your tailnet must be accessible by every node on your tailnet at all times, otherwise you get hard-to-debug netsplits. What would allow a given pair of nodes access a peer relay? Isn’t the peer relay by default also accessible by every node on the tailnet since it’s in the tailnet as well?

alberto_delrio 7mo ago

Tried the other day, honestly so far surprised by the good results!

ZoomZoomZoom 7mo ago

If you're sold on Tailscale due to them "being open" (as they semi-officially support the development of Headscale), keep in mind, that at the same time some of their clients are closed source and proprietary, and thus totally controlled by them and the official distribution channels, like Apple. Some of the arguments given for this stance are just ridiculous: > If users are comfortable running non-open operating systems or employers are comfortable with their employees running non-open operating systems, they should likewise be comfortable with Tailscale not being open on those platforms. https://github.com/tailscale/tailscale/issues/13717 https://github.com/tailscale/tailscale/issues/13717 A solution like this can't really be relied in situations of limited connectivity and availability, even if technically it beats most of the competition. Don't ever forget it's just a business. Support free alternatives if you can, even if they underperform by some measures.

xyst 7mo ago
I switched to Netbird because of this.
8cvor6j844qw_d6 7mo ago
Went with ZeroTier and Netbird, they're not too bad.
- drcongo 7mo ago
  I keep hoping to switch to Netbird, but run into the same issue every time for the last couple of years I've been trying it - peers randomly drop of the network. There's a longish standing open issue on their GitHub.
- wolvoleo 7mo ago
  Zerotier is a lot harder to self-host than tailscale
- resiros 7mo ago
  Netbird is very good for my use case. Simple to set up, and just works.
- 7mo ago

jak6jak 7mo ago

I looked into tailscale in the past as a way to host a game server such as minecraft on my local machine publicly without port forwarding . It seems that tailscale is mostly configured only to work with people you know and trust. I was hoping that Peer Relays would help alleviate some restrictions with tailwind funnel. Does anyone know any alternatives?

Computer0 7mo ago
if you have a cheap vps you can use it to forward the traffic to for some benefit, that is what i have been doing when i need compute accessible online and don't want to pay for cloud.

bityard 7mo ago

I wonder if someone might indulge me by answering a question or two about Tailscale. I have a self-managed wireguard network which works, but probably isn't very smart or elegant. From what I can gather, Tailscale does a lot of "magic" things to accomplish its goals, and some of them actually have "magic" right in the name. As a system administrator by trade, I have been bitten SO MANY TIMES by things that try to automagically mess with DNS resolution, routing tables, firewall rules, etc in the name of user-friendliness. (Often, things that even ship with the OS itself.) Are there any documentation or articles detailing exactly what it's doing under the hood? I found https://tailscale.com/docs/concepts https://tailscale.com/docs/concepts but it doesn't really cover everything. If I have a virtualization host with, let's call it a "very custom" networking configuration, how likely is it to interfere with things? Is it polite and smart about working around fancy networking setups, or does it really only handle the common cases (one networking interface, a default route, public nameserver) elegantly?

raggi 7mo ago
It's difficult for us to maintain documentation of exactly the kind you'd want there, though we do try to keep up with docs as best we can. In particular there is a fairly wide array of heuristics in the client to adapt to the environment that it's running in - and this is most true on Linux where there are far far too many different configuration patterns and duplicate subsystems (example: https://tailscale.com/blog/sisyphean-dns-client-linux https://tailscale.com/blog/sisyphean-dns-client-linux). To try and take a general poke at the question in more of the context you leave at the end: - We use rule based routing to try to dodge arbitrary order conflicts in the routing tables. - We install our rules with high priority because traffic intended for the tailnet hitting non-tailscale interfaces is typically undesirable (it's often plain text). - We integrate with systemd-resolved _by preference_ on Linux if it is present, so that if you're using cgroup/namepsace features (containers, sandbox runtimes, etc etc) then this provides the expected dns/interface pairings. If we can't find systemd-resolved we fall back to modifying /etc/resolv.conf, which is unavoidably an area of conflict on such systems (on macos and windows they have more broadly standard solutions we can use instead, modulo other platform details). - We support integration with both iptables and nftables (the latter is behind manual configuration currently due to slightly less broad standardization, but is defaulted by heuristic on some distros/in some environments (like gokrazy, some containers)). In nftables we create our own tables, and just install jumps into the xtables conventional locations so as to be compatible with ufw, firewalld and so on. - We do our best in tailscaled's sshd to implement login in a broadly compatible way, but again this is another of those places the linux ecosystem lacks standards and there's a ton of distro variation right now (freedesktops concerns start at a higher level so they haven't driven standardization, everyone else like openssh have their own pile of best-guesses, and distros go ham with patches). - We need a 1360 byte MTU path to peers for full support/stability. Our inner/interface MTU is 1280, the minimum MTU for IPv6, once packed in WireGuard and outer IPv6, that's 1360. I can't answer directly based on "very custom" if there will be any challenges to deal with. We do offer support to work through these things though, and have helped some users with fairly exotic setups.

marcosscriven 7mo ago

I really like Tailscale. Recently though I’ve been having some hard-to-diagnose slowdowns even on a direct (non DERP) connection. I’m not sure if it’s something to do with MTUs or my ISP.

solarisos 7mo ago

The shift from managed DERP to decentralized Peer Relays is a massive win for self-hosters with difficult NAT situations. I’m curious if this significantly reduces Tailscale's own egress costs or if the primary goal was just improving latency for users who can't establish a direct WireGuard tunnel. Either way, removing the 'hassle' of setting up a custom DERP server is a great UX improvement.

alexktz 7mo ago
Alex from Tailscale here... We’re users just like you, and we felt this pain point ourselves. The good news is that Peer Relays were able to build on a lot of the existing subnet router and exit node plumbing, so it wasn’t a huge engineering lift to bring to life. We also have plenty of customers running in restrictive NAT environments (AWS being a common example), where direct WireGuard tunnels just aren’t always possible. In those cases, something like Peer Relays is essential for Tailscale to perform the way larger deployments expect. So yes, it improves latency and UX for self-hosters, but it also helps us support more complex production environments without requiring folks to run and manage custom DERP infrastructure.
- solarisos 7mo ago
  Thanks for the context, Alex. It’s interesting to hear that the engineering lift was lighter by leveraging the exit node/subnet router plumbing—that’s a clever use of existing primitives. The point about AWS NAT restrictions is a big one. I think a lot of people underestimate how often 'enterprise-grade' networking actually becomes a bottleneck for direct P2P. Moving that burden away from custom DERP management makes the 'it just works' magic of Tailscale feel much more sustainable for small teams.
ghthor 7mo ago
We’ve had issues with the centralized DERPs just blackholing traffic when we startup ephemeral nodes in CI. This is despite us ensuring that all important peers can establish direct connections to each other. But there is some bootstrapping that is happening before both peers negotiate. Having said this, it’s been almost a year since the last incident of this. It’s been rock solid the last months. Ok sure using these new peer nodes will greatly reduce this from even a chance of happening anymore. :hacks away:

timwis 7mo ago

I'm having a hard time understanding how this is different from a bastion server, where you're tunneling through an intermediary server that you've deployed in the target network. I guess the difference is the fact that the intermediary server doesn't need a port open (as standard nat punching will work)? Or are there other big differences?

fireant 7mo ago
I think that biggest difference is that your client applications don't need to be explicitly configured to use the bastion server. For example ssh, web browsers, rdp, samba and so on can just pretend that you are inside the target network. Doubly useful if this is a "customer" network and you are working with multiple customers.
bingo-bongo 7mo ago
We've setup and used peer-relays since it was first announced and they've been great, but they do solve a somewhat specific problem. Some of our users experienced fairly limited throughput from time to time. Under certain circumstances (eg. always ipv4 NAT/double-NAT, never for ipv6) their Tailscale client couldn't establish a direct connection to the Tailscale node in the datacenter, so data was relayed through Tailscales public relay nodes. Which at times was rate limited/bottleneck - in all fairness, that is to be expected according to their docs. The first mitigation was to "ban" the specific public relay they were using in the policy. Which helped, but still not a great solution and we might just end up in a weird whack-a-mole-ish ban game with the public peer relays in the long run. So we setup a peer relay, which networking-wise is in a DMZ sort of network (more open), but location wise still in the datacenter and allowed it to easily reach the internal (more restricted networking) Tailscale nodes. Which solved all throughput problems, since we no longer have users connecting through the public relays. Also, the peer relays feels a little bit magic, once you allow the use of them in the Tailscale policy, it just works(tm) - there is basically zero fiddling with them. EDIT: I'll happily provide more details if interested - we did a fair amount of testing and debugging along the way :)
- timwis 7mo ago

1necornbuilder 7mo ago

[dead]

clarabennett26 7mo ago

[dead]

samat 7mo ago
Three AI-generated positive comments in the row from new (green) accounts, with some being answered by Tailscale employees looks like AI-assisted astroturfing PR in hackernews. It’s rampart on every major social network (Reddit especially), interesting to see it live first time on the HN. I am not anti advertising, I just think pushing AI into places were people interact is very bad behavior and should be punished.
- dang 7mo ago
  I doubt that it's employees, but I agree that some of those accounts look like genAI and have banned them. All: (1) Generated comments aren't allowed on HN - this rule predates LLMs but obviously applies even more now: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20%22generated%20comments%22&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... (2) If you see accounts that look like they're mostly posting genAI comments, please let us know at hn@ycombinator.com. That's how I found my way to these cases.

noirscape 7mo ago

Oh that's really cool! I hope it alleviates some pressure on the DERP servers, whenever I notice the connection on tailscale is bad, it's usually because the device is connecting over DERP.

jrm4 7mo ago

I haven't really dived into Tailscale et al because I'm still using Tinc; and the bulk of this discussion continues to make me not want to. What's the big deal here? Any good reason to switch (besides Tinc's obscurity?)

skinner927 7mo ago
tinc is cool. Keep using it.

pluto_modadic 7mo ago

Excited to try this out on headscale someday :)

anvevoice 7mo ago

[dead]

nivcmo 7mo ago

[dead]

ksynwa 7mo ago
Does the relay not have to have a publicly accessible IP address? Edit: My understanding of network terminologies is weak. But I assumed that the relay server would have to not be behind a CGNAT.
phrotoma 7mo ago
Thank you for being the first person in this discussion to explain wtf this is.
- deleted 7mo ago
  [deleted]

icfly2 7mo ago

I was going to use wireguard, but the setup is always such a pain. Then I realised that Tailscale was Canadian, so I’m happy to use it

techpulse_x 7mo ago

[flagged]

codethief 7mo ago

One thing I haven't quite understood yet: If I have multiple relays, will Tailscale automatically pick the "best one" for a given connection, e.g. the one closest to the destination in terms of latency?

kittbuilds 7mo ago

[dead]

corford 7mo ago

I love tailscale and this is a nice addition. One last item on my wishlist: better Okta support!!

jamiemallers 7mo ago

[dead]

threecheese 7mo ago

Edit: this is a ridiculous question, I know. Trying to eat my dogfood so to speak Does Tailscale maintain an q&a agent, mcp, or llms.txt that anyone is aware of? I’m trying to use Tailscale across my personal networks - without investing a lot of time - and so I’m throwing agents at it. It’s not going well, primarily because their tools/interfaces have been changing a lot, and so tool calls fail (ex ‘tailscale serve —xyz’ is now ‘tailscale funnel ABC’ and needs manual approval, and that’s not in the training set).