I can think of a short list of things that are 𝙣𝙤𝙩 supposed to happen:

• Cars are not supposed to explode.
• The front is not supposed to fall off.
• VPNs are not meant to let strangers have access to your things.

Regarding the last item on this list, Tailscale revealed, via an unintentional “𝘧𝘪𝘳𝘦 𝘵𝘦𝘴𝘵”, just how completely backwards their design is.

Basically, someone signed in with an email like 𝘯𝘢𝘮𝘦@𝘱𝘰𝘤𝘻𝘵𝘢.𝘱𝘭 (a free public email provider similar to gmail) Disturbingly, they found 𝗜𝗼𝗧 𝗱𝗲𝘃𝗶𝗰𝗲𝘀 𝗳𝗿𝗼𝗺 𝗮 𝗰𝗼𝗺𝗽𝗹𝗲𝘁𝗲 𝘀𝘁𝗿𝗮𝗻𝗴𝗲𝗿 connected to their network.
You can find the full details here

You might ask, “𝘏𝘰𝘸 𝘤𝘰𝘶𝘭𝘥 𝘢 𝘴𝘵𝘳𝘢𝘯𝘨𝘦𝘳 𝘴𝘪𝘨𝘯 𝘪𝘯𝘵𝘰 𝘴𝘰𝘮𝘦𝘰𝘯𝘦’𝘴 𝘯𝘦𝘵𝘸𝘰𝘳𝘬?”

Simply put, Tailscale assumed that 𝘱𝘰𝘤𝘻𝘵𝘢.𝘱𝘭 was a company/private domain and 𝗴𝗿𝗼𝘂𝗽𝗲𝗱 𝗮𝗹𝗹 𝘂𝘀𝗲𝗿𝘀 𝘄𝗶𝘁𝗵 𝘁𝗵𝗮𝘁 𝗱𝗼𝗺𝗮𝗶𝗻 𝗶𝗻𝘁𝗼 𝘁𝗵𝗲 𝘀𝗮𝗺𝗲 𝗧𝗮𝗶𝗹𝗻𝗲𝘁. Apparently, that domain was not on Tailscale’s "public domains" list.

This is 𝗯𝗮𝗱 for many reasons:

• You could be 𝘀𝗵𝗮𝗿𝗶𝗻𝗴 𝘆𝗼𝘂𝗿 𝗽𝗿𝗶𝘃𝗮𝘁𝗲 𝗻𝗲𝘁𝘄𝗼𝗿𝗸 𝘄𝗶𝘁𝗵 𝘀𝘁𝗿𝗮𝗻𝗴𝗲𝗿𝘀.
• Devices connected to the network can see each other and 𝗰𝗼𝗺𝗺𝘂𝗻𝗶𝗰𝗮𝘁𝗲 𝗳𝗿𝗲𝗲𝗹𝘆, which is not something you want unless you trust the other users.
• You might not even notice until 𝘀𝗼𝗺𝗲𝘁𝗵𝗶𝗻𝗴 𝘀𝘁𝗿𝗮𝗻𝗴𝗲 𝗮𝗽𝗽𝗲𝗮𝗿𝘀.
• It is a huge 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗮𝗻𝗱 𝗽𝗿𝗶𝘃𝗮𝗰𝘆 𝗿𝗶𝘀𝗸.

Tailscale did respond and acknowledged the issue saying that they are 𝙬𝙤𝙧𝙠𝙞𝙣𝙜 𝙤𝙣 𝙖 𝙗𝙚𝙩𝙩𝙚𝙧 𝙞𝙙𝙚𝙣𝙩𝙞𝙩𝙮 𝙢𝙤𝙙𝙚𝙡 to prevent these problems in the future. The only issue is, 𝘂𝗻𝗹𝗲𝘀𝘀 𝗮 𝗱𝗼𝗺𝗮𝗶𝗻 𝗶𝘀 𝗼𝗻 𝘁𝗵𝗲𝗶𝗿 𝘀𝗽𝗲𝗰𝗶𝗮𝗹 𝗹𝗶𝘀𝘁, it will be regarded the same.

Something we use at Imperfektus is NetFoundry's OpenZiti.
I actually have a teaser trailer from a podcast that explains this exact pain.
Have a watch of the full episode to see more.

I am sure that Michael Kochanik will bite my head off for saying that it is a wireguard replacement (even though that makes it easy to understand), but if you are looking for a 𝗿𝗲𝗽𝗹𝗮𝗰𝗲𝗺𝗲𝗻𝘁 𝗳𝗼𝗿 𝘆𝗼𝘂𝗿 𝗹𝗲𝗴𝗮𝗰𝘆 𝗩𝗣𝗡 that only does what you tell it, do have a look at 𝗢𝗽𝗲𝗻𝗭𝗶𝘁𝗶.

𝘐 𝘳𝘦𝘤𝘦𝘪𝘷𝘦 𝘯𝘰𝘵𝘩𝘪𝘯𝘨 𝘣𝘺 𝘴𝘢𝘺𝘪𝘯𝘨 𝘵𝘩𝘪𝘴. I just 𝘁𝗿𝘂𝗹𝘆 𝗯𝗲𝗹𝗶𝗲𝘃𝗲 𝗶𝗻 𝘁𝗵𝗲 𝗽𝗿𝗼𝗱𝘂𝗰𝘁.

If you are looking for a 𝗺𝗼𝗱𝗲𝗿𝗻, 𝗼𝗽𝗲𝗻-𝘀𝗼𝘂𝗿𝗰𝗲 𝘇𝗲𝗿𝗼-𝘁𝗿𝘂𝘀𝘁 𝘀𝗼𝗹𝘂𝘁𝗶𝗼𝗻, have a chat with NetFoundry and tell them that I sent you :)