What the f*ck is Tailscale and why should you care?
So you're finally done with your todo app project, and now it's time to launch this billion dollar idea so you can retire at 23. you watch a couple of tutorials and understand how to setup postgres and Kubernetes so you can handle your 5 users.
You launch your app ,The next day you're greeted by :FATAL: password authentication failed for user "postgres"
FATAL: password authentication failed for user "admin"
FATAL: password authentication failed for user "root"
FATAL: password authentication failed for user "test"
You have 0 users but your database already has some fans. Automated scanners sweep the entire IPv4 address space around the clock, and your shiny database server was found within minutes. people are now attempting to get into your database by trying out passwords.
Even if you think this is not a problem because your password is hard to guess IT IS! ,even if people can't guess your password they can can still DDOS the database.
You might think you should:
Put everything behind a bastion host?
Let's say that you have setup two servers running postgres and kubernetes. configure them to stop accepting outside connections entirely. Then you setup one extra machine to act as an admin server (DevOps people call this bastion Host) ,Your devs can SSH into this Bastian host and only Bastian host is allowed to talk to the real server .
Problem solved right??
WRONG!
You've just shifted failure points from database server to bastion host, your bastion server can still be:
- DDOS'd - Your devs still have to reach the bastion host to communicate with the servers ,DDOS it and you're servers are no longer reachable.
- Single point of failure - It becomes a single point of failure ,If it fails everything is unreachable.
This is where TAILSCALE steps in.
You might have realized that every solution so far has the same flaw: One server sits up front and becomes the attack point for the attacker.
So what if your important services didn't exist on the public internet at all?
This is the idea behind Tailscale, put everything on a private network and talk to it using Tailscale.
Here's How it Works:
1. Put your servers in a private network (VPC).
A virtual private cloud is an isolated private network inside the public cloud infrastructure. Machines inside this VPC are given a private IP which is not accessible outside this VPC. Now your postgres ,K8s have no Public IP address.
But this is a problem! ,Your laptop isn't inside this VPC either so you can't connect to your database directly.
2. Add Tailscale subnet router.
We add a Tailscale subnet router to the VPC ,this router can communicate with the servers inside the VPC.
3. Install Tailscale on your Machine.
After you install Tailscale on your laptop locally ,It connects to your Tailscale router using peer-to-peer architecture(P2P).
You can do:psql 10.0.x.x
Tailscale on the laptop sees this and realizes that 10.0.x.x is handled by Tailscale router .So it wraps the packet in a WIREGUARD tunnel and sends it to the Tailscale router using P2P. The Tailscale router routes this request to the database.
This P2P connection is made by using a technique called HOLE PUNCHING.
Let's see how the Tailscale router interacts with your database.
After receiving the packets from your laptop's Tailscale client the Router does not directly forward it to wherever it has to go ,Lets say your postgres database in this case ,because:
An ipv4 packet has 2 parts
1. Headers : Information about the packet.
2. Payload : The actual data
Inside the Header there are two fields called,
- Source : IP Address of the sender of the packet.
- Destination : IP address of the recipient of the packet.
Your laptop is not inside the VPC. So your database has no idea how to respond back to the source IP address.
To fix this the Tailscale router performs something called SNAT (source NAT). which basically rewrites the Source IP address from your laptop's IP to it's own internal IP .
Now the postgres can respond to the Tailscale router and the router can send the response back to your laptop.
I chose to explain Tailscale having one router on the VPC but that will only work for a hobby project ,But You can scale Tailscale really easily by adding more subnet routers.
Tailscale is not all rainbows and sunshine
Relayed connections : If you've ever worked with P2P architecture you know that most of the times NAT will block the Peer-to-Peer connection ,When that happens your traffic is rerouted through a Relayed server (Which is Tailscale's own hosted server).
That is about all I know about Tailscale!
This Blog is based on a session taken by my senior, Akash Singh