Setting up Tailscale

No repository file or test is identified; start by locating the project's existing documentation structure and deciding which parts of this Tailscale/OpenWrt guide belong there. Done means the setup, exit-node, and router instructions are organized in the appropriate documentation and remain consistent with the linked references.

https://tailscale.com/kb/1036/install-arch

Setup tailscale and add your computer

1. pamac install tailscale
2. (probably need to restart your computer as I was running into problems when trying to bring up tailscale)
   • journalctl -u tailscaled -> kernel/drivers/net/tun.ko found on disk, but not for current kernel; are you in middle of a system update and haven't rebooted? found: /lib/modules/
3. sudo systemctl enable --now tailscaled
4. sudo tailscale up, click the link in the terminal output and add the device to your tailnet

See logs

journalctl -u tailscaled

CLI Reference

• https://tailscale.com/kb/1080/cli
• https://tailscale.com/kb/1241/tailscale-up

Have someone else add a new device to your tailnet

You can generate one-off auth keys to give to someone to add a new device, https://tailscale.com/kb/1085/auth-keys

In the Tailscale admin console: Settings -> Keys -> Generate auth key

Usage:

sudo tailscale up --auth-key=tskey-abcdef1432341818

Add an exit node

1. Enable IP forwarding on the machine you're going to use as the exit node, see https://tailscale.com/kb/1408/quick-guide-exit-nodes?tab=linux#advertise-a-device-as-an-exit-node
   • Here are some Linux specific instructions (if you're on a different platform, refer to the link above):
     1. First, check if you already have IP forwarding enabled (you might already if you have Docker) (enabled = 1, disabled = 0):

     $ sysctl net.ipv4.ip_forward
     net.ipv4.ip_forward = 1
     $ sysctl net.ipv6.conf.all.forwarding
     net.ipv6.conf.all.forwarding = 1
     

     1. Enable IP forwarding (persists over restarts):

     echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
     echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
     sudo sysctl -p /etc/sysctl.d/99-tailscale.conf
     

     3. If you want to undo the IP forwarding, rm /etc/sysctl.d/99-tailscale.conf, then manually set each property via sudo sysctl -w net.ipv4.ip_forward=0 and sudo sysctl -w net.ipv6.conf.all.forwarding=0
   • If you don't do this step, you will probably see the following warning in the Tailscale admin console:

     Unable to relay traffic
     This machine has IP forwarding disabled and cannot relay traffic. Please enable IP forwarding on this machine to use relay features like subnets or exit nodes.

2. sudo tailscale up --advertise-exit-node or sudo tailscale set --advertise-exit-node
3. Then go into the Tailscale admin console, select the relevant machine -> Edit route settings -> Use as exit node to approve it for use.
   • You could also adjust your ACL's to auto-accept/approve the exit node

Use specific exit node to route traffic through

Then on other devices, you can choose which exit node to use via the following command:

sudo tailscale set --exit-node=<ID>

You might also be interested in this extra command: --exit-node-allow-lan-access=true: "Allow the client node access to its own LAN while connected to an exit node. Defaults to not allowing access while connected to an exit node." (source). This makes it so that your local LAN traffic doesn't go through the exit node so you can still access all of your local devices.

List available exit nodes:

sudo tailscale exit-node list

You can also have Tailscale recommend an exit node based on latency and performance information:

sudo tailscale exit-node suggest

Reference:

• https://tailscale.com/kb/1392/auto-exit-nodes

Add a new WiFi network to your OpenWRT router that will direct all traffic through a tailnet exit-node

Aka: How to connect your Smart TV to the Tailscale network

We're going to create a new WiFi network (like my_wifi_5g_tailnet) that you can connect your Smart TV to and have all of the traffic go through a Tailscale exit node (like your parents house that is set as the Netflix "household"). This is useful to get around the pesky single household streaming policies that have been implemented to crackdown on password sharing (hypothetical). Or trying to access content that is "Geo-blocking" (geographical restrictions).

This kind of setup is also just useful in general for situations where you can't install a Tailscale client on a device but want all of the traffic to go through the tailnet.

My specs:

• Linksys WRT1200AC v1 router
  • https://openwrt.org/toh/linksys/wrt1200ac
• Flashed with OpenWrt 23.05.5

Reference:

• https://openwrt.org/docs/guide-user/services/vpn/tailscale/start
• https://www.youtube.com/watch?v=UvniZs8q3eU

Install an up-to-date version of Tailscale on OpenWRT

While the version of Tailscale that is available in the package manager will probably work, it's pretty out-of-date and old. It's probably best to to update to the latest version with known security vulnerabilities patched.

1. ssh [email protected]
2. opkg update
3. opkg install tailscale
4. If you're using OpenWRT 22.03 or later:
   opkg install iptables-nft kmod-ipt-conntrack kmod-ipt-conntrack-extra kmod-ipt-conntrack-label kmod-nft-nat kmod-ipt-nat
service tailscale restart

   • OpenWrt 22.03 and later, use nftables (superseding iptables) as a backend to firewall4. Tailscale alone is unable to configure nftables automatically and this prevents the tailscale daemon from initializing properly and forwarding traffic. Additional packages must be installed (OpenWRT versions 22 or 23)

     -- https://openwrt.org/docs/guide-user/services/vpn/tailscale/start#iptables-nft_issue

5. You will probably end up with an out-of-date old tailscale version -> 1.58.2
6. service tailscale stop
7. In order to update on a storage constrained device (like my router), we need to go through some steps (more docs from Tailscale). You can try running tailscale update to see if it will just work but chances are you will run out of disk space (don't forget to cleanup to free disk space after trying):
   1. Run the following on your normal computer (not on the router): git clone [email protected]:tailscale/tailscale.git (https://github.com/tailscale/tailscale)
   2. git checkout v1.78.1
   3. Generate a combined binary that can act as tailscale and tailscaled (saves space): env GOOS=linux GOARCH=arm go build -o tailscale.combined -tags ts_include_cli,ts_omit_aws,ts_omit_bird,ts_omit_tap,ts_omit_kube -trimpath -ldflags="-s -w" ./cmd/tailscaled
      • To find the relevant architecture we should compile for to set GOARCH appropriately:

      $ opkg print-architecture
      arch all 1
      arch noarch 1
      arch arm_cortex-a9_vfpv3-d16 10
      $ uname -m
      armv7l
      

      • The tailscale/tailscale repo also includes a build_dist.sh --extra-small script to do the same thing but I'm not sure how to adjust the architecture with it.
      • This produces a binary that is du -hs tailscale.combined -> 22M tailscale.combined
   4. Repack the binary to be even smaller: upx --lzma --best tailscale.combined
      • This produces a binary that is du -hs tailscale.combined -> 5.4M tailscale.combined
   5. Copy the binary to the router: scp -O ./tailscale.combined [email protected]:/tmp/tailscale.combined
      • We're using scp -O to use the legacy scp fallback mode since OpenWrt doesn't include sftp-server.
8. Back on the router, test that the binary runs and works:

   $ /tmp/tailscale.combined --version
    1.78.1-dev20241205
     tailscale commit: c80eb698d5057b04d826b5ae2004d4c464ae28f6-dirty
     go version: go1.23.1
   

9. Move the binary to its new home: cp /tmp/tailscale.combined /usr/sbin
10. Remove the old binaries: rm /usr/sbin/tailscaled and rm /usr/sbin/tailscale
11. Symlink the new binary to the proper names: cd /usr/sbin and ln -s tailscale.combined tailscaled and ln -s tailscale.combined tailscale
12. Verify that the new version is being used: tailscale --version and tailscaled --version should both print 1.78.1-dev20241205
13. service tailscale start
14. service tailscale status -> running
    • If you're seeing Warning: client version "1.78.1-dev20241205-tc80eb698d-dirty" != tailscaled server version "1.58.2-1 (OpenWrt)", you probably just need to kill the old version that's running ps | grep tailscale and kill the process ID or just service tailscale stop -> service tailscale start

OpenWRT configuration part 1: Tailscale network interface - Get Tailscale access available in OpenWRT

We're going to create a new network interface that allows us to interact with Tailscale and our tailnet:

1. service tailscale status -> running
2. Run tailscale up and add the device to your tailnet
   • If you're seeing Warning: client version "1.78.1-dev20241205-tc80eb698d-dirty" != tailscaled server version "1.58.2-1 (OpenWrt)", you probably just need to kill the old version that's running ps | grep tailscale and kill the process ID or just service tailscale stop -> service tailscale start
3. To verify things are working, running tailscale status should show other device that are on the tailnet
4. Create a new unmanaged interface via LuCI (visit http://192.168.1.1): Network -> Interfaces -> Add new interface
   • Name: tailscale
   • Protocol: Unmanaged
   • Device: tailscale0
5. Verify that the interface has your Tailscale address assigned: ip address show tailscale0
6. Create a new firewall zone via LuCI: Network -> Firewall -> Zones -> Add
   • Name: tailscale
   • Input: accept
   • Output: accept
   • Forward: accept
   • Masquerading: on
   • MSS Clamping: on
   • Covered networks: tailscale
   • Allow forward to destination zones: unspecified (leave blank)
   • Allow forward from source zones: unspecified (leave blank, this will be filled in later)
7. Save & Apply
8. tailscale up --exit-node=<name|ip> --exit-node-allow-lan-access=true
   • --exit-node-allow-lan-access=true: "Allow the client node access to its own LAN while connected to an exit node. Defaults to not allowing access while connected to an exit node." (source)
   • Note: "If you're using OpenWrt == 22.03 you will also need to specify --netfilter-mode=off. For versions 23+ do NOT include netfilter-mode." (source)
9. If anything starts going wrong, you can run tailscale down to stop Tailscale. You can also go into the Tailscale admin console (https://login.tailscale.com/admin/machines) and remove your openwrt machine from the network.
   • For example, when I was trying to figure everything out, I ran into an issue where I couldn't access the router anymore after running the tailscale up command with just the exit node specified. I was able to get access again by removing the router from the tailnet using the Tailscale admin console. Then finally figured out I needed --exit-node-allow-lan-access=true option to resolve that issue.

[!WARNING]

I still have a problem that whenever I use tailscale up --exit-node=<name|ip> --exit-node-allow-lan-access=true, my normal traffic on the other networks starts failing for half of the websites. Tailscale should only be affecting the specific Tailscale network when enabled but it seems like something is going wonky (probably DNS related) and affecting the whole device. Everything goes back to normal once I tailscale down.

For example, here is a list of sites that do and don't work (not sure what the differentiator is):

• ❌github.com, reddit.com, discord.com, x.com, zig.news
• ✅ google.com, ericeastwood.com, news.ycombinator.com, gitlab.com, matrix.org, tailscale.com

References:

• As described in the Tailscale page in the OpenWRT docs: https://openwrt.org/docs/guide-user/services/vpn/tailscale/start
• Perhaps another way to configure this would be with an "app connector" which allow you to forward only specific domains to a node on the tailnet: https://tailscale.com/kb/1281/app-connectors

OpenWRT configuration part 2: Create a WiFi network that will forward all traffic to the exit node

Then we're going to create a new WiFi network that will forward all of the traffic through the Tailscale network interface:

1. Create a new device via LuCI (visit http://192.168.1.1): Network -> Interfaces -> Devices -> Add device configuration...
   • Device type: Bridge device
   • Device name: br-tail
   • Bridge ports: unspecified (leave blank)
   • Bring up empty bridge: checked ✅
2. Create a new network interface via LuCI: Network -> Interfaces -> Add new interface...
   • Name: TAIL (TODO: better name?)
   • Protocol: Static address
   • Device: br-tail
   • Click Create interface, then configure the rest of the details
   • General Settings tab:
     • IPv4 address: 192.168.77.1
       • (this is just an address that is separate from your other address ranges used for lan and other interfaces)
     • IPv4 netmask: 255.255.255.0
   • DHCP Server tab -> Setup DHCP Server
     • (the defaults should be fine)
   • Firewall Settings tab
     • Create / Assign firewall-zone: (leave blank for now but this will be TailZone once we create it below)
3. Create a new firewall zone via LuCI: Network -> Network -> Firewall -> Zones -> Add
   • Name: TailZone
   • Input: reject
     • We don't expect any incoming traffic. Just devices going out onto the tailnet through the exit node.
   • Output: accept
     • We want our devices to be able to go out onto the tailnet through the exit node.
   • Forward: reject
   • Masquerading: off
   • MSS Clamping: off
   • Covered networks: tail
   • Allow forward to destination zones: tailscale
   • Allow forward from source zones: unspecified (leave blank)
4. Create some new firewall traffic rules via LuCI: Network -> Firewall -> Traffic Rules -> Add
   • Name: tailzone DHCP and DNS
   • Protocol: TCP and UDP
   • Source zone: TailZone
   • Destination zone: Device (input)
   • Destination port: 53 67 68
   • Action: accept
5. Create a new WiFi network via LuCI: Network -> Wireless -> Click Add for the relevant radios (I created one for the 2.4 GHz (as my_wifi_2g_tailnet) and 5 Ghz (as my_wifi_5g_tailnet) radios)
   • Mode: Access Point
   • ESSID: my_wifi_5g_tailnet
   • Network: TAIL
   • Hide ESSID: unchecked
   • WMM Mode: checked
   • Wireless Security:
     • Encryption: WPA2-PSK
     • Cipher: auto
     • Key: (pick a WiFi password)
     • 802.11r Fast Transition: unchecked
     • 802.11w Management Frame Protection: Disabled
     • Enable key reinstallation (KRACK) countermeasures: checked
6. Save & Apply
7. You should now be able to connect to the my_wifi_5g_tailnet WiFi network and have all your internet traffic go through the exit node. Once connected, you can check that the public IP of your exit node is shown you search for "my ip" in your favorite search engine. You can also verify things are working by running traceroute google.com and seeing the Tailscale IP of the exit node in the second or so hop in the chain.

References:

• What we're doing here is essentially the same as setting up a guest network as described in this video by OneMarcFifty. We're just forwarding the traffic to the tailscale interface instead of wan.
• The OpenWRT docs have a section on how to Force LAN traffic to route through Exit Node which is in the same vein of what we're trying to setup but instead of forcing our normal LAN traffic over the tailnet, we want to create a whole new separate network so you can choose. we can still have normal LAN traffic and then you can connect devices to the my_wifi_5g_tailnet WiFi network if you want to.

Other references

• Hardware Haven - Tailscale on an OpenWRT router: https://www.youtube.com/watch?v=XGefV0Rf9QQ&t=1440s