Hetzner DIY Private Networking with Tinc
In this technical retrospective (2018), @romantomjak shares practical architectural lessons learned from running, scaling, or migrating production software under lean constraints.
Core Principles for Independent Builders:
Defaulting to simpler architectures (such as monolithic frameworks, SQLite, or managed VPS) prevents early engineering bankruptcy.
Evaluating true compute and egress costs reveals that high cloud bills can often be slashed by 80%+ through judicious re-platforming.
Code you write at 2 AM as a solo engineer must be easy to debug six months later without complex microservice dependencies.
Community Debate Themes:
HN engineers debated the tradeoffs between cloud convenience and raw server economics, database indexing strategies, and resisting premature architectural complexity.
CATEGORY Frugal Engineering →
HISTORICAL ERA Cloud & Mobile Era (2014–2019)
COMMUNITY SCORE 87 points
TOTAL DISCUSSIONS 37 comments
Use WireGuard[1] instead. It's way faster than Tinc and other userland VPN implementations. I've been using it for the same purpose as the author of the article and it has been rock solid - not a single issue during almost two years. Setup and configuration is a breeze[2].
[1] https://www.wireguard.com/ ↗ [2] https://github.com/hobby-kube/guide#wireguard-setup ↗
Edit: Benchmarks on Hetzner Cloud (1vCPU, 2GB)
``` $ iperf3 -c kube1 Connecting to host kube1, port 5201 [ 4] local 10.0.1.2 port 57622 connected to 10.0.1.1 port 5201 [ ID] Interval Transfer Bandwidth Retr Cwnd [ 4] 0.00-1.00 sec 77.2 MBytes 647 Mbits/sec 79 1.37 MBytes [ 4] 1.00-2.00 sec 78.8 MBytes 661 Mbits/sec 0 1.51 MBytes [ 4] 2.00-3.00 sec 81.2 MBytes 681 Mbits/sec 0 1.62 MBytes [ 4] 3.00-4.00 sec 85.0 MBytes 713 Mbits/sec 134 1.20 MBytes [ 4] 4.00-5.00 sec 80.0 MBytes 671 Mbits/sec 0 1.28 MBytes [ 4] 5.00-6.00 sec 77.5 MBytes 651 Mbits/sec 0 1.33 MBytes [ 4] 6.00-7.00 sec 88.8 MBytes 745 Mbits/sec 0 1.37 MBytes [ 4] 7.00-8.00 sec 73.8 MBytes 619 Mbits/sec 0 1.39 MBytes [ 4] 8.00-9.00 sec 78.8 MBytes 661 Mbits/sec 0 1.41 MBytes [ 4] 9.00-10.00 sec 80.0 MBytes 671 Mbits/sec 0 1.42 MBytes ```
From my understanding, this statement is not quite correct, as Hetzner allows you to set up VLANs:
You probably still want to encrypt the traffic passing through those VLANs.
They also offer the option to install custom hardware, so you might even be able to get a second NIC connected to your own private switch.
You can achieve something similar with Hetzner's recently introduced "vSwitch feature". Works across their different DCs, which is nice. Some docs here: https://wiki.hetzner.de/index.php/Vswitch/en ↗
I've been using ZeroTier to give a common backplane to my Hetzner servers, DO droplets and AWS instances.
Isn't the point of DO's private networking that you don't need to encrypt the traffic? Or is it just internal, but not private?