Wireguard is pretty much half of what you'd expect from a VPN. It does the low-level part (encryption, packetization, session setup, NAT traversal, etc. -- the “actual VPN”) brilliantly, but everything around key distribution is left to external systems. (Tailscale is a popular choice, but by no means the only one.) E.g., you can't connect to vpn.example.com with user foo and password bar and that's it; there needs to be an Ed25519 public/private keypair set up on both sides, an IP address range (essentially a routing table), and so on.

Of course, if you want to connect two static networks, wg-quick is all you need. But for the typical “remote worker VPN”, it's pretty much a (great) building block.

> but everything around key distribution is left to external systems.

That's what I'd like, since authentication is usually a pain to set up and with Wireguard, there's none to be done. This also means it's totally stateless and is great for mobile devices where a connection might be broken and crsated again frequently.

I’ve been begrudgingly using Tailscale because it’s so damn simple, but hate that I have to authenticate through Google. I recently noticed they’ve added a “sign in with GitHub option,” but I don’t see any easy way to migrate my account (and nodes). Many of the clients are PiHoles I’ve sent off to my family as gifts, so physical access is a PITA. The only way I’ve found to reliably clear the Tailscale settings is to `apt purge Tailscale`, which would cause me to lose Tailscale SSH access. Looking at the hassle of the remote reinstall- I’m thinking to SSH in with Tailscale, then establish a reverse SSH tunnel to maintain remote access - I think I may finally give Innernet [0] a go.

[0] https://github.com/tonarino/innernet

You can also use Microsoft now (both "personal" accounts like used for Xbox/Outlook and "Enterprise" accounts like Microsoft365 and other AAD based accounts)

I'm sure if you asked them about switching auth methods they would help with that.

That’s a good point. I’ve sent them an email and I’ll see what they say.

EDIT: since I’m still in the edit window, here’s what Tailscale came back with (great response time!).

>We can fairly easily switch between auth providers where the usernames are an email address, like Microsoft or Google or Okta.

>For GitHub the username is different, GitHub uses your Profile name. Any email addresses associated with your GitHub profile are not available.

>Unfortunately there isn't a straightforward way to migrate an existing Tailnet with its devices from Google to GitHub. We generally recommend making a new Tailnet with GitHub and re-authenticate devices using GitHub one at a time. For remote devices, this is more challenging.

>If you want to try it, a suggestion: 1. you can create a Reusable authkey at https://login.tailscale.com/admin/settings/authkeys for the new GitHub Tailnet 2. Over ssh to a node currently on the Google Tailnet, you can: `tailscale up --force-reauth --authkey=tskey-0123456789abcdef` 3. You'll lose the SSH session. The device will make a new Node key and be issued a new IP address on the new GitHub Tailnet. 4. You can look up its new IP address on https://login.tailscale.com/admin/machines of the GitHub Tailnet, and should be able to ssh to the new address.

That sounds heavenly. I had never really thought about that immutability like concept, makes a lot of sense for security oriented software.

Except FreeBSD which is used for pfSense - a popular firewall. They're working on it though. There was a bit of drama about it a few months ago when a shoddy implementation was merged.

FreeBSD can use the userspace implementation just fine; what almost made it out but was caught before it could actually be released was an in-kernel module for it.