Hacker News Reader

Comment by PaulWaldman | Hacker News Reader

> To make this possible, we ported the following to WebAssembly: the Tailscale client, WireGuard®, a complete userspace network stack (from gVisor), and an SSH client.

Would it be possible to bundle the same into a portable application allowing you to use Tailscale without installing it? My understanding is that currently if you can't install Tailscale on a client you need to use Subnet Router. https://tailscale.com/kb/1109/devices-without-tailscale/

View on HN

You‘d have to redirect all network usage (i.e. the sockets API or your platform‘s equivalent) through the custom stack, which is possible if you can rebuild the source or by using something like LD_PRELOAD for binaries, but can get very tricky in the general case.

There‘s an utility called SSHuttle that does something similar for SSH instead of Tailscale/Wireguard: It redirects all sockets usage to go through an SSH connection, to allow usage of SSH port forwarding without explicit SOCKS support on the app‘s side.

SSHuttle was created by the CEO/co-founder of Tailscale :)

Indeed, both the name and the very clever combination of existing components sounded familiar when I first heard about Tailscale :)

Interesting. Sshuttle is great. I've used that a couple of times to create a simple vpn without having to deal with openvpn. Simple and effective.

that's a bit worrying

there's a rather large misunderstanding on its github page:

> You can't use openssh's PermitTunnel feature because it's disabled by default on openssh servers; plus it does TCP-over-TCP, which has terrible performance.

it doesn't do TCP over TCP, it's a bytestream over TCP (exactly the same as shuttle)

something like OpenVPN running in TCP mode would be TCP over TCP

Are you sure you are not misunderstading PermitTunnel yourself?

That SSH feature is indeed used for packet forwarding over SSH using TUN/TAP, i.e. packet-over-TCP, and by extension TCP-over-TCP.

. You can use tools like proxychains to leverage LD_PRELOAD to redirect all network traffic via a socks5 proxy.

Tailscaled comes with a socks5 proxy

Reply on news.ycombinator.com