As organizations increasingly transition towards supporting remote and hybrid workforces, the traditional VPN models are being scrutinized. Many businesses are now considering more robust alternatives like mesh VPNs. Mesh VPNs promise enhanced security, reduced costs, and better flexibility compared to the traditional client-server VPNs. This article delves into the pros and cons of mesh VPNs and provides a guide on setting up essential features that can benefit your organization.
Configure Connectivity to Centralized Corporate Resources
VPNs have traditionally been used as a conduit for remote users to access internal corporate network resources, thus extending the network perimeter to remote locations. However, the traditional VPN approach, which often uses a client-server architecture, poses challenges when it comes to accessing centralized applications or services. This is particularly problematic in meshed environments where resources are decentralized. Mesh VPNs, designed as peer-to-peer networks, only provide access to devices with the mesh VPN client installed by default.
Enter Tailscale—this platform offers the concept of subnet routers that act as gateways to broader network segments. By installing the Tailscale client on just one machine within a network, you can enable connectivity to various other devices.
To configure a subnet router in Tailscale, follow these steps:
First, configure the Tailscale node as a subnet router by initiating Tailscale from the command line. Use the --advertise-routes parameter followed by the specific IPv4 subnets in CIDR notation. For example, to serve the entire 192.168.1.x Class C subnet, you would input:
tailscale up --advertise-routes=192.168.1.0/24Multiple subnets or endpoints can be added by separating them with commas. Secondly, access the Tailscale admin console to approve these routes, enabling secure access to centralized resources for tailnet members.
Restrict Access to Resources and Services to Authorized Users
In a zero-trust security model, access to corporate resources should be limited strictly to users who need it. Just because a user can connect to a VPN doesn’t mean they should have unrestricted access to all network resources. Tailscale offers tools like Access Control Lists (ACLs) to restrict access, ensuring only authorized devices and users can reach specific resources.
Tailscale’s ACLs are based on defining a source and destination. Unlike traditional firewall rules, these ACLs always result in an ‘allow’ action—meaning connectivity occurs only when it is explicitly permitted by a rule. In the Tailscale ACL policy editor, administrators can define rules that leverage users or devices in bulk, using groups or tags, or individually, using hostnames or usernames.
An example of an ACL rule in Tailscale might look like:
{ "action": "accept", "src": ["tag:mobile"], "dst": ["192.168.1.0/24:80,139,443,445"]}This rule allows devices tagged as ‘mobile’ to connect to the 192.168.1.0/24 subnet but only on ports 80, 139, 443, and 445. Asterisks can be used as wildcards for more flexible source and destination definitions, offering granular control over network access.
Route Internet Traffic from Remote Clients through a Central Network
A prevalent use case for VPNs is safeguarding sensitive internet traffic, particularly when devices are connected to public networks. Certain industries may even require internet traffic to be monitored or filtered. Routing all internet traffic through a central network could streamline these compliance and security measures. Tailscale facilitates this with its exit node feature.
Exit nodes are set up similarly to subnet routing. Once the exit node option is enabled in the Tailscale client on the designated device, the configuration must be approved by an admin in the admin console. Exit nodes can either be ‘recommended,’ meaning Tailscale will automatically select an exit node based on latency and performance, or ‘mandatory,’ forcing all user traffic through a single exit node. However, mandatory exit nodes require Tailscale’s premium or enterprise plans, along with an MDM solution.
By implementing exit nodes, organizations can ensure that all remote internet traffic is routed through their central, secure network, maintaining oversight and security compliance efficiently.
Utilize Corporate DNS Servers for Tailscale Clients
As more organizations pivot to support remote and hybrid workforces, traditional VPN models face increasing scrutiny. Businesses are exploring more advanced alternatives like mesh VPNs, which offer enhanced security, cost savings, and greater flexibility compared to traditional client-server VPNs. This shift highlights a need for understanding the advantages and disadvantages that come with implementing mesh VPNs.
Traditional VPNs often suffer from scalability issues and can create single points of failure. Mesh VPNs, however, distribute the network load more evenly, improving overall performance and reliability. By using a decentralized structure, each device can act as a node, allowing for multiple pathways through the network. This arrangement significantly reduces the chance of a total system failure and enhances security through redundancy.
Additionally, mesh VPNs can be more cost-effective. They eliminate the need for expensive centralized servers and reduce overhead costs associated with maintenance and upgrades. The flexibility benefit is notable too, especially for organizations constantly expanding their remote workforce. Mesh VPNs can easily scale up or down based on demand, making them a more adaptable solution.
However, implementing a mesh VPN isn’t without its challenges. The setup process can be complex, requiring specialized knowledge and ongoing management. To help navigate this, our article provides a comprehensive guide on configuring essential features of mesh VPNs to maximize their benefit to your organization.
