3 posts tagged with "zero-trust networking"

On mobile devices, private device networking almost always raises the same question: do we need system VPN permission?

Whether you use Larktun or Tailscale, if you want every app on the phone to access a private network, the usual answer is yes. A system-level VPN tunnel gives the client full capability: traffic can be routed through the private network, DNS and routes can be handled centrally, and apps can access internal services without being aware of the tunnel. But this also creates practical friction. Users must understand and approve a VPN profile, apps may need extra platform capabilities, and the tunnel can conflict with a company VPN, campus VPN, or other proxy tools that already occupy the system network entry point.

So is there another path: can we use private device networking without requesting system VPN permission?

Yes. The key is tsnet.

I recently provisioned a free Oracle Cloud server with 4 CPU cores and 24 GB of memory. For a development server, that is generous enough for test services, build jobs, database experiments, and the occasional production-support workload.

But as soon as I needed remote SSH access, the classic question appeared: should I expose port 22 to the public internet?

My answer is clear: no.

Sometimes a product does not begin with a grand plan. It begins with a small, ordinary wish.

You are away from home, and suddenly you need to publish a program, restart a service, or check the quiet little computer sitting on your desk. You only have a tablet or a phone in your hand. Still, you hope you can reach that machine as naturally as opening your own door.

Larktun grew out of that wish.