News for hackers. Stuff that matters.

A comment on You may not need Cloudflare Tunnel. Linux is fine. Parent comment

Re:You may not need Cloudflare Tunnel. Linux is fine by ElectricalUnion on Friday April 08, 2022 @03:04PM (#30961199)
> Second, and far more important, meshing all your devices into a single flat network is dangerous. There is a reason why networks are designed with isolation strategies. Introducing an overlay into your networks breaks down these barriers for you, but also for an attacker.

What prevents you from meshing the individual services on a per-need basis? The fact that they're overlays makes them even more convenient for such isolation.

> The only overlay network that has built in firewall capabilities is Nebula.

Are those built in firewall capabilities really missing from the other networks?

As far as I know, ZeroTier is more of a SDN that an simple overlay (That's what made me interested in ZeroTier in the first place). If conventional "L4 transport-layer" firewall/routing capabilites are enough for real networks, then ZeroTier SDN capabilities are probably enough for it's virtual networks. Granted, it doesn't have some nice built-in high-level generic "L7 application-level" firewall capabilities, but I don't trust those in the first place.

[ Parent | on HN ]
Re:You may not need Cloudflare Tunnel. Linux is fine by depingus on Saturday April 09, 2022 @07:43PM (#30973208)
I'm not suggesting overlay networks are useless (Slack uses it to connect thousands of machines around the world!). My comment is aimed at the self-hosting community using them as a VPN replacement for remote management / access. I don't see how they are any better than VPNs for this. They're probably worse once you start connecting all the devices you aim to remotely manage into a flat network (mixing internet facing devices that should be DMZ'd with internal devices).
[ Parent | on HN ]