*naïve* static IPs create 3 problems: first, if I do this and then forget about it for a year, then move one of these adapters to a different network, it will mysteriously just not work at all and require debugging. I really don't want to be bothered with that. second, it basically breaks IPv6 completely. third, there are weird issues with moving devices and confusing the arp cache if you send any traffic within 2XMSL which is just a big bummer of a bug magnet.
15
Replies
0
Boosts
This comment is unavailable — it may have been deleted or is not visible to you.
This comment is unavailable — it may have been deleted or is not visible to you.
This comment is unavailable — it may have been deleted or is not visible to you.
This comment is unavailable — it may have been deleted or is not visible to you.
@glyph My god.
Honest question: since you're doing custom DNS records anyway, is this easier than a Wireguard-based solution like Netbird? Or raw WG, but Netbird makes a lot of the annoying stuff easy-peasy.
This could very well not to be your liking; this is just an area I've explored deeply in one direction and always avoided Unifi stuff.
@mttaggart I'm already using WireGuard, but honestly WireGuard is kind of flaky for me, and I definitely would not want to use it on my LAN at home. If I weren't doing Unifi, I would probably just run a twisted.names server to do it myself and just write a couple of zone files, I'm just trying _not_ to operate any more infrastructure than I need
@glyph Understood. Sorry to hear that; Wireguard in many forms has been one of the most reliable parts of my infrastructure, so it's a shame you're not having the same experience. But I totally understood minimizing infra. I'm sure if I weren't quasi-professionally operating these tools, I'd have far less patience for DIY stuff.
@mttaggart It is possible that I've unfairly maligned it, but the fact that the iOS app hasn't been updated in 3 years is … concerning, particularly in the vulnpocalypse
@glyph Yeah I really mean the protocol more than the first-party app. Between Tailscale, Netbird, Netmaker, etc., plenty of well-maintained projects that use the core protocol, which is fairly battle-tested.
@mttaggart do you have a recommended client for regular old iOS usage?
@mttaggart my understanding of TailScale is that if I get TailScale I have a tailnet and I'm dragging around a bunch of extra complexity that I don't need for a basic VPN, but perhaps I misunderstand the affordances of the app
@glyph Potato, potato, complexity, options. Tailscale as a SaaS product is something you might want to avoid. But it's an easy onramp. You can use as much of it or as little as you like.
There's also Headscale, the self-hosted implementation of a Tailscale server, but that breaks the rule about adding infrastructure.
Netbird, same thing, but imo drastically less complexity.
@glyph FWIW, I am not super concerned about the vanilla client on iOS. The attack surface is such that by the time an attacker hits the app, they'd already own your phone. As for the protocol, the easiest thing to do to harden your tunnel is adding a preshared key to the configs. That gives you both current decryption protection and post-quantum!
@mttaggart doesn’t the config come along with a PSK no matter what?
@glyph No. It comes with an asymmetric key. The PSK is extra.
@mttaggart ah, right you are, looks like it’s blank in my config, I should regenerate this
@mttaggart this is actually looking a lot better than I remember from the last time I played with it. although I still find myself lightly annoyed that, like all networking software, there is _zero_ accommodation of the reality of residential ipv6, i.e. there is still a strong assumption that nobody cares about dynamic /64 prefix delegations
@mttaggart yep; and unifi’s implementation gives you a dedicated ULA at least. annoying that the vpn config needs the full address specified in advance rather than letting you SLAAC in or something upon connecting
