ah nice. i’ve actually been building something pretty similar on top of wireguard too

my use case is a bit different though. i started because i wanted to give friends access to specific things in my homelab, but very selectively. like “you can use jellyfin on this one machine, but you can’t ssh, and you can’t even see my other devices”

tailscale is honestly amazing for getting devices connected, i still use it a lot. but once i started trying to do these very specific “this machine can talk to that machine only on this port” kind of setups, it started feeling more complex than it should be, at least for personal use. ACL editor is more confusing when it comes to this. i know we have got option for tags and things, but those are very poorly documented and i haven't found a single tutorial that works nicely.

your userspace approach is really interesting btw, especially the no tun / no root part. makes sense to run it on rigit enterprise environments.

I've been working on a similar tool for a while - connet (https://github.com/connet-dev/connet). It builds upon QUIC (instead of wireguard), but I think from an enduser perspective the results ends up looking pretty similar.

Nice! It looks essentially like userspace NAT, only active for particular ports. I'm contemplating a similar setup to handle access to my home machines: when I'm in my home network, some ports are forwarded to 127.x.y.z directly from the remote machine, and when I'm away, the same ports are forwarded via a Wireguard connection. This way, at home I can use the full speed of the LAN, and when away, the speed is limited by the Wireguard gateway, but I still connect to the same host:port, wherever I am.

Very interesting - but I also find it important for solutions to state the trade-offs if they provide a novel approach that doesn't have the same requirements as the main contenders. In your case, what are the trade offs for running in user space ?

> My initial motivation was wanting to RDP and SSH into my home workstation from a locked-down corporate laptop when I travel. I couldn't install Tailscale on the laptop

I'm not sure it would work but did you try running tailscale client through a docker container so it's not installed directly in your host system?

Pretty cool! I see on enterprise edition you also support a virtual mount, is it FUSE based? I got a similar tool but went the other way around, I wanted to browse files synchronously (and bidirectional sync of edits) between two devices via FUSE mounts, and ended up tunneling TCP for this in the end.

I think this is the same as using a cloudflared tunnel?

to access my home desktop machine, I run:

``` $ ssh [email protected] -o ProxyCommand="cloudflared access ssh --hostname %h" ```

and I setup all the cloudflare access tunnels to connect to the service.

Now add an Android client and exit node support and it will completely replace Tailscale for me. :)

Now that’s cool. I wished I new that when I was trying remote access my computer a few month ago.

thats awesome. really

Exactly what I was going to build for myself, no need now, very cool

This is super cool.

That's very useful!

Sooo freaking cool.

Very cool

Awesome