Making Tailscale Faster

iscoelho•about 1 hour ago

In my opinion, this is Tailscale's largest issue.

It is slow. It cannot achieve speeds of greater than 1Gbps on clients systems (Windows & Mac), where you'd normally see it being used. On Linux, it struggles to achieve 10Gbps even when using a synthetic large packet benchmark [1]. With an IMIX benchmark, it would not be competitive whatsoever.

This problem is fixable. WireGuard achieves higher performance (Kernel vs Userspace implementation) and IPsec implementations can achieve 100Gbps/400Gbps (DPDK/XDP). Zero-copy networking.

From this blog post, I can say Tailscale still seems to not have the appetite for that, which is a shame.

[1] https://tailscale.com/blog/more-throughput

boomer_joe•42 minutes ago

Yes. Just fucking stop doing userspace wireguard on linux https://github.com/tailscale/tailscale/issues/426 - issue has been open for 6 years (and is locked now, lol), btw.

And if any tailscale employees are reading this - https://github.com/tailscale/tailscale/issues/15724 please fix this too. Regular users not using some sort of enterprise saas DNS (whatever their thing is?) deserve DNS privacy too.

iscoelho•31 minutes ago

Tailscale's netstack is barely even WireGuard and they aren't compatible whatsoever. It's all marketing at this point.

So it's not that simple: it's impossible for Tailscale to use any existing kernel or accelerated WireGuard implementation. They could derive inspiration, but a kernel module for Linux won't fix Windows & Mac. With that said, I feel they have enough funding to maintain a few platforms (:

fitblipper•about 1 hour ago

I used to LOVE tailscale. Then I put wireguard on my home network exposed to the internet with a dynamic DNS provider and it immediately became irrelevant. Not only is raw wireguard more stable (I don't have to fight the DNS issues on my mobile phones) it feels faster and is amazingly simple to set up.

PorciiVorbesc•about 1 hour ago

Care to share your setup? I did some research into self hosting my own wireguard for my nuc and rpi, before ultimately settling on Tailscale because of how much simpler and plug-and-lay it was to add/remove devices compared to self hosting wireguard, not dealing with certificates, maintenance, etc.

davidee•40 minutes ago

There are no certificates to share with Wireguard. Nothing to rotate if you don't want to. Once it works, it works.

I've even got a backup wireguard server running on a Pi 1b. Works fine. We currently run wireguard on our router (and it seems more and more routers are supporting it).

There are keys to configure for each client, but once you have the configuration for one client, the rest come very quickly and easily.

I should add that I don't have any experience with Tailscale, but compared to OpenVPN and other VPN solutions, Wireguard is lightweight, simple, and easy to setup/configure.

We use it on all our mobile devices (phones, laptops, tablets) to tunnel our traffic through our home network with all the filtering it offers (along side access to private services we host).

UltraSane•28 minutes ago

My favorite thing about Tailscale is how it lets you SSH/RDP INTO servers without having to open any ports.

aborsy•about 2 hours ago

I would like less battery usage with exit node.

CharlesW•about 3 hours ago

I wonder if the post's focus on Linux/Android is just because that's where they started, or because they're leveraging techniques that are only possible on Linux/Android?

chrash•about 2 hours ago

it sounds like they’re leveraging Linux features that may not exist 1:1 on Darwin and NT

ykurtov•about 2 hours ago

In our use case latency went parabolic at 250 sessions pumping just 60 mb/s through a tunnel.

time4tea•about 2 hours ago

Leaves them where they landed. Slop check : yes +++ATH

Making Tailscale Faster

⚡ Community Insights

Discussion (13 Comments)Read Original on HackerNews