Is there an alternative to Tailscale with a lower memory footprint? I wanted to run Tailscale on a small router, but it failed due to out-of-memory (OOM) issues.
back
4 comments
Have you tried "Smaller binaries" instruction? https://tailscale.com/kb/1207/small-tailscale
Thanks, this could’ve worked for my Raspberry Pi! I would’ve tried it if it was still in commission. Next time?
No, thank you. I'll try it.
How low do you need the footprint? At firezone.dev, we also build a ZT product and our headless-client and Gateway are in Rust and use around 15-30 MB of RAM. Could likely be tuned further down if you need it :)
Maybe Nebula? You can do one yaml config file with all the certificates and firewall rules making it easy to script device provisioning too.
I'm mainly looking for a solution that punches through NAT the way Tailscale does.
Nebula has NAT punching as well[1]. Or does Tailscale do even more magic on it?
It seems to have relays which is interesting. For comparison, here is Tailscale's article on how they do NAT traversal: https://tailscale.com/blog/how-nat-traversal-works/
Wireguard?
Wireguard doesn't do NAT traversal on its own, which is, IMHO, the killer feature of Tailscale.
I wasn't sure and still am not what your statement means, I checked Google, their AI tool offered this:
"Yes, WireGuard does support NAT traversal, though it doesn't handle it natively; it relies on techniques like UDP hole punching to establish connections between peers behind NATs."
That makes no sense to me, I have my peers talking to each other on the Wireguard VPN behind my ISP NAT. I do have one UDP port open on the VPS that they all talk to. Is that what you mean by, "Wireguard doesn't do NAT traversal on its own, which is, IMHO, the killer feature of Tailscale."?
If so, how does not having to open one UDP port which can't really be detected anyway, justify having all your traffic controlled by a third party through servers (I forget what Tailscale called them) you don't own?
Taking on all the monolithic complexity of Tailscale just to get NAT traversal can be arguably not worth it, e.g. https://news.ycombinator.com/item?id=42132131
Fair enough if you're stuck behind a CGNAT though.