Hacker News Reader

Comment by geoctl | Hacker News Reader

Can I ask you what an ideal setup for your use case would look like? Octelium isn't really concerned with connecting complete remote subnets to each other directly. You can simply use a SOCKS5 proxy as an Octelium Service and do all the access control, dynamic routing and load balancing to that Service representing a specific "VPN".

View on HN

Basically what tailscale offers with headscale but with more sophisticated control over exit traffic, like:

1) the ability to define an arbitrary wireguard configuration as an exit node (tailscale can do this in theory, but it only works with mullvad and it doesnt work with headscale).

2) the ability to write sophisticated exit traffic rules (e.g. intranet.myemployer.com requests get routed via one home server running my company's proprietary VPN, mybank.com gets routed via another home exit node, default traffic through mullvad, etc.)

As for (1) zero trust architectures don't really expose complete subnets to users, they only expose individual resources and enforce access control at each of these resources individually. As for (2) As I said above, this can actually be done with Octelium if your VPNs are able to run as SOCKS5 proxies. You can create as many Services, each representing a separate VPN/exit node SOCKS5 proxy, and then use Octelium's stable private DNS to connect to the different SOCKS5 proxies/Services depending on your domain-based rules.

Reply on news.ycombinator.com