October 2022 Summaries

The October Tailscale newsletter highlights various developments and features aimed at enhancing user experience and security. MagicDNS, which assigns human-readable DNS names to devices within a tailnet, is now generally available, while the integration with NextDNS allows for customized DNS settings including ad-blocking. A notable update is the Tailscale SSH Console, enabling secure browser-based SSH sessions even without the Tailscale app installed on a device. The newsletter also discusses the beta launch of configuration audit logs for tracking network changes and sending notifications via webhooks. Additionally, community contributions are showcased, such as Fly.io's use of Tailscale for private connections and Duolingo's streamlined developer onboarding. Tailscale provides insights into its impact on companies like Mercari and Machinify, emphasizing improved security and simplified VPN solutions. The company is actively hiring and building a learning library to support users and is open to feedback through community engagement on platforms like Twitter.

MagicDNS, a feature of Tailscale, offers a unique approach to DNS that addresses longstanding issues of complexity, reliability, and security inherent in traditional DNS systems. Unlike conventional DNS, which can be a single point of failure and lacks encryption, MagicDNS runs a local DNS server on every device, ensuring that DNS queries remain secure and are not reliant on external servers. This local operation reduces latency and eliminates the risk of misconfiguration or unauthorized tampering. MagicDNS also supports dynamic updates through Tailscale's control plane, allowing for immediate synchronization across devices, which overcomes the typical DNS cache invalidation problems. By building on these principles, MagicDNS integrates seamlessly with Tailscale's infrastructure to provide a more reliable and secure DNS experience, effectively handling features like split DNS and reverse DNS without the usual pitfalls, and even allowing for transparent upgrades such as DNS-over-HTTPS for older systems. This innovative approach transforms DNS into a resilient and secure component of network management, living up to its name by ensuring DNS functionality that is both reliable and protected.

Tailscale has introduced the Tailscale SSH Console, a web-based SSH client that enables users to connect to devices running Tailscale SSH directly from their browsers. This innovation differs from other web-based SSH clients by transforming the browser into a Tailscale client, allowing it to join a tailnet like any other device running Tailscale. The development required porting several components to WebAssembly, including the Tailscale client and an SSH client. To address browser environment challenges, a WebSocket-based solution was implemented for DERP relay communications, enhancing compatibility with the fetch()-based HTTP transport. The Tailscale SSH Console is designed to offer a secure and seamless SSH experience without the need for passwords or public key management, and it integrates with Tailscale's admin console to provide a versatile user interface. Despite initial challenges with binary size, optimizations were made to reduce it, and the project resulted in an open-source WebAssembly client packaged for reuse in closed-source environments. The Tailscale SSH Console aims to provide flexibility akin to a real terminal by using "child" windows for rendering, ensuring the main logic remains in the parent window, which enhances performance and user experience.

Webhooks have been introduced for Tailscale to help users efficiently track changes and events within their tailnet, such as new node approvals or policy file updates, which can be challenging to monitor solely through audit logs. These webhooks can notify administrators of key events like new node join requests, approval processes, and configuration issues, such as IP forwarding being disabled on a subnet router. Administrators can set up webhooks to send notifications to any HTTPS endpoint, allowing integration with tools like Slack for real-time updates. Since webhooks are associated with the tailnet itself, they remain operational even if the administrator who configured them departs the company. To implement webhooks, users are directed to access the Webhooks page in the admin console and refer to the documentation for detailed setup instructions.

MagicDNS, now generally available in Tailscale, enhances network accessibility by automatically registering human-readable DNS names for devices, eliminating the need to remember IP addresses. This feature simplifies accessing devices, even when they move between environments like on-premise and cloud. Despite its utility, many users were unaware of MagicDNS, leading to its default enablement for new tailnets. The system assigns a unique tailnet name format, facilitating DNS registration, node sharing, and the issuance of TLS certificates. MagicDNS is incorporated directly into the Tailscale client, maintaining DNS queries locally for improved security and privacy. Recent updates have resolved numerous bugs, enhancing its functionality across various platforms, including Android, iOS, and macOS. Ongoing improvements are planned, such as support for custom records and subdomains. Users are encouraged to migrate to the new tailnet naming convention and update their Tailscale clients to benefit fully from the advancements in MagicDNS.

Tailscale has introduced configuration audit logs, currently in beta, to enhance the security and integrity of tailnets by allowing network admins to track changes made to their network configurations. These logs, accessible via the admin console and API, provide a detailed record of modifications such as adding devices, updating ACLs, or changing DNS settings. They enable admins and auditors to filter events by user, time, and action, and offer capabilities for monitoring, auditing, and reversing changes as part of incident responses. The logs capture write-actions almost instantaneously and are retained for 90 days, with options for exporting them to long-term storage via the API. This feature is designed to aid in maintaining compliance and security by allowing detailed visibility into network configuration changes and ensuring adherence to access policies.

Tailscale has integrated support for NextDNS, a DNS resolver service that offers customizable filtering and logging options, making it an appealing alternative for those who prefer not to run their own DNS servers. NextDNS allows users to configure various settings, unlike standard public DNS services, and operates globally to ensure robustness and low latency. To utilize NextDNS with Tailscale, users need to create a NextDNS account, set it as their tailnet's global nameserver, and ensure their devices run Tailscale version 1.32 or later. The integration supports Linux and Windows clients, with macOS, iOS, and Android clients pending app store approval. Additionally, users can assign different NextDNS profiles to specific users or groups within their network for tailored DNS configurations.

David Anderson discusses the prevalent insecurity of PostgreSQL connections over the public internet, highlighting vulnerabilities due to server misconfigurations and insufficient client-side TLS enforcement, which can lead to potential Man-in-the-Middle attacks. To address this, Anderson introduces a solution developed by Tailscale: a TLS-enforcing Postgres proxy named pgproxy, designed to secure connections between Postgres clients and cloud-hosted databases. This proxy, which uses Tailscale's tsnet library, ensures secure, authenticated, and authorized connections, regardless of the client's transport security settings, by connecting securely to the upstream database using TLS with full verification. The proxy simplifies deployment and enhances security by allowing fine-grained access control and auditing through connection logs, leveraging Tailscale's network ACLs, and providing a security upgrade without the need for extensive software rewrites.