Choose your own IP

Original Article ↗ Hacker News Discussion ↗

Tailscale’s new “choose your own IP” feature, which lets tailnets use custom address ranges instead of a single global pool, is welcomed as a practical fix for conflicts with carrier-grade NAT and overlapping private networks. Commenters compare Tailscale’s UX and capabilities (automatic NAT traversal, SSO/ACLs, mesh connectivity) to raw WireGuard and OpenVPN, debating when its managed control plane is worth the dependency versus self-hosted alternatives like headscale. The thread also surfaces broader tensions around IPv4 exhaustion, slow and messy IPv6 adoption, NAT’s impact on end‑to‑end connectivity, and whether commercial overlay networks have an incentive to preserve the status quo.

Reaction to “Choose your own IP”

  • Many welcome the feature; it solves conflicts with CGNAT/private ranges overlapping local LANs and services that insist on binding to specific IPs rather than interfaces.
  • Some are excited to align Tailnet IPs with their home schemes (e.g., 10.3.x → 100.103.x).
  • Question raised why CGNAT (100.64/10) is used instead of 10/8; answer: 10/8 is commonly used on LANs and would collide more.

Tailscale vs WireGuard/OpenVPN

  • Repeated theme: Tailscale = WireGuard + automation + identity + policy + NAT traversal + mesh.
  • Advantages cited:
    • SSO/OIDC integration and easy onboarding.
    • Built-in ACLs instead of per-host iptables.
    • NAT traversal with DERP fallback, useful for CGNAT and “road-warrior” setups.
    • Mesh-style connectivity vs manual hub-and-spoke configuration.
  • Critiques: higher iOS battery usage vs plain WireGuard; some prefer “minimalist” self-managed WireGuard for simple cases.

NAT, IPv4, and IPv6 Debates

  • Jokes and complaints about NAT being both cause and solution to network problems.
  • Strong disagreement over NAT vs IPv6:
    • Some defend NAT and distrust IPv6 (privacy, exposure, ISP behavior).
    • Others argue NAT breaks end-to-end, drives centralization, and IPv6 can rotate addresses and avoid tracking.
  • Tailscale already gives every node an internal IPv6 address, but IPv4 support remains necessary because many apps/OSes are still IPv4-centric.
  • Frustration that new solutions still lean heavily on IPv4 instead of pushing IPv6-first designs, though ISPs’ poor IPv6 rollout is cited as a hard constraint.

CGNAT, Starlink, and Real-World Use

  • Several examples where Tailscale “just worked” in tricky environments (Starlink, rural farms, CGNAT-only ISPs), whereas raw WireGuard was hard to get right.
  • Discussion of firewall traversal limits; when symmetric NAT breaks UDP, links fall back to DERP over TCP 443, which is slower. tailscale status can show whether a link is using DERP.

Trust, Self-Hosting, and Identity

  • Some are uneasy relying on a hosted control plane or third-party identity (Google/Microsoft/Apple).
  • Alternatives discussed:
    • Headscale (open-source control server) to self-host; praised as a safety net against lock-in.
    • Custom OIDC via self-hosted IdPs (Keycloak, Authelia, Dex, Casdoor).
  • Desire expressed for simple username/password or passkey-only flows without big-tech identity.

Meta: Company Role and Incentives

  • Strong admiration for Tailscale’s UX, documentation, and devrel; some feel HN overhypes them due to good developer marketing.
  • Concern raised that companies solving “missing” Internet features (like secure end-to-end connectivity) may be structurally disincentivized from broader protocol-level fixes that would obsolete their products.