Tailscale - Revision history

Dogphilosopher: Added documentated issue and workaround for asking for root authentication

2026-03-04T19:30:27Z

Added documentated issue and workaround for asking for root authentication

← Older revision		Revision as of 19:30, 4 March 2026
Line 103:		Line 103:
	Some GUI applets/utilities cannot control {{ic\|tailscaled}} as a regular user and prompt for a password for every action/not connecting. Assigning the user as an operator fixes this:		Some GUI applets/utilities cannot control {{ic\|tailscaled}} as a regular user and prompt for a password for every action/not connecting. Assigning the user as an operator fixes this:

	{{Commands\|1=$ sudo tailscale set --operator=USERNAME}}		{{Commands\|1=$ sudo tailscale set --operator=USERNAME}}'''Note:''' There is currently a bug with the above command documented in: https://github.com/tailscale/tailscale/issues/18294

			The workaround is to login and set the operator as part of connecting to tailscale. This section can be removed once the issue is resolved.

			{{Commands\|1=# for initial login
			sudo tailscale login

			# this will set your user as the operator for the future
			sudo tailscale up --operator=$USER

			# validate your user is an operator
			tailscale debug prefs {{!}} grep -i operator}}

	== Running multiple Tailnet-accessible services on a single machine ==		== Running multiple Tailnet-accessible services on a single machine ==

Alex: Added workaround for some applets/utils issues.

2026-01-26T15:29:47Z

Added workaround for some applets/utils issues.

← Older revision		Revision as of 15:29, 26 January 2026
Line 99:		Line 99:

	[https://github.com/tailscale/tailscale/issues/4432#issuecomment-1112819111 Issue in Tailscale tracker]		[https://github.com/tailscale/tailscale/issues/4432#issuecomment-1112819111 Issue in Tailscale tracker]

			=== Some utils/applets asks root auth every time ===
			Some GUI applets/utilities cannot control {{ic\|tailscaled}} as a regular user and prompt for a password for every action/not connecting. Assigning the user as an operator fixes this:

			{{Commands\|1=$ sudo tailscale set --operator=USERNAME}}

	== Running multiple Tailnet-accessible services on a single machine ==		== Running multiple Tailnet-accessible services on a single machine ==

Joshieadalid: Add native nftables configuration and update UDP performance optimization section using networkd-dispatcher.

2026-01-02T04:56:09Z

Add native nftables configuration and update UDP performance optimization section using networkd-dispatcher.

← Older revision		Revision as of 04:56, 2 January 2026
Line 8:		Line 8:

	# If you would like to use a preauthorized key		# If you would like to use a preauthorized key
	#authKeyFile = "/run/secrets/tailscale_key";		#authKeyFile = "/run/secrets/tailscale_key";

	};		};
Line 18:		Line 18:

	For more configuration option, refer to <code>[https://search.nixos.org/options?show=services.tailscale services.tailscale]</code> .		For more configuration option, refer to <code>[https://search.nixos.org/options?show=services.tailscale services.tailscale]</code> .

			== Native nftables Support (Modern Setup) ==
			Recent versions of NixOS encourage the use of [[nftables]] over legacy iptables. Tailscale can be configured to use `nftables` natively, which avoids conflicts and kernel module bloat.

			This configuration forces the `nftables` backend and optimizes the service startup:

			<syntaxhighlight lang="nixos">
			{ config, pkgs, ... }:

			{
			# 1. Enable the service and the firewall
			services.tailscale.enable = true;
			networking.nftables.enable = true;
			networking.firewall = {
			enable = true;
			# Always allow traffic from your Tailscale network
			trustedInterfaces = [ "tailscale0" ];
			# Allow the Tailscale UDP port through the firewall
			allowedUDPPorts = [ config.services.tailscale.port ];
			};

			# 2. Force tailscaled to use nftables (Critical for clean nftables-only systems)
			# This avoids the "iptables-compat" translation layer issues.
			systemd.services.tailscaled.serviceConfig.Environment = [
			"TS_DEBUG_FIREWALL_MODE=nftables"
			];

			# 3. Optimization: Prevent systemd from waiting for network online
			# (Optional but recommended for faster boot with VPNs)
			systemd.network.wait-online.enable = false;
			boot.initrd.systemd.network.wait-online.enable = false;
			}
			</syntaxhighlight>

	== Split DNS ==		== Split DNS ==
Line 87:		Line 120:

	== Optimize the performance of subnet routers and exit nodes ==		== Optimize the performance of subnet routers and exit nodes ==
	Tailscale gives [https://tailscale.com/kb/1320/performance-best-practices#enable-on-each-boot recommendations] on how to optimize UDP throughput ~~of your node~~.		Tailscale gives [https://tailscale.com/kb/1320/performance-best-practices#enable-on-each-boot recommendations] on how to optimize UDP throughput. For high-throughput nodes (like subnet routers), disabling UDP Generic Receive Offload (GRO) on the physical interface is recommended to prevent packet drops.

	~~You need to have <code>ethtool</code> and <code>~~networkd-dispatcher~~</code> installed, and~~ to ~~create~~ the ~~appropriate rule for Tailscale~~.		In NixOS, this can be automated using `networkd-dispatcher` to ensure the setting persists across reboots and network changes.

	~~Supposing the network device you'll be using is called <code>eth0</code>, you can add the following to your <code>configuration.nix</code>:~~<syntaxhighlight lang="nixos">		<syntaxhighlight lang="nixos">
	services ~~= {~~		# In environment.systemPackages, ensure you have pkgs.ethtool
	networkd-dispatcher = {		services.networkd-dispatcher = {
	enable = true;		enable = true;
	rules."50-tailscale" = {		rules."50-tailscale-optimizations" = {
	onState = ["routable"];		onState = [ "routable" ];
	script = ''		script = ''
	${~~lib~~.~~getExe~~ ethtool} -K eth0 rx-udp-gro-forwarding on rx-gro-list off		${pkgs.ethtool}/bin/ethtool -K eth0 rx-udp-gro-forwarding on rx-gro-list off
	'';		'';
	};
	};		};
	};		};
	</syntaxhighlight>		</syntaxhighlight>
			''Note: Replace `eth0` with your actual WAN interface name (e.g. `ens192`).''

Phobos at 17:02, 25 November 2025

2025-11-25T17:02:28Z

← Older revision		Revision as of 17:02, 25 November 2025
Line 17:		Line 17:
	</syntaxhighlight>If you are using features like subnet routers or exit nodes you will also need to set <code><nowiki>services.tailscale.useRoutingFeatures</nowiki></code> to "server", "client" or "both" depending on the role of your machine.		</syntaxhighlight>If you are using features like subnet routers or exit nodes you will also need to set <code><nowiki>services.tailscale.useRoutingFeatures</nowiki></code> to "server", "client" or "both" depending on the role of your machine.

	For more configuration option, refer to [~~Https~~://search.nixos.org/options?show=services.tailscale services.tailscale].		For more configuration option, refer to <code>[https://search.nixos.org/options?show=services.tailscale services.tailscale]</code> .

	== Split DNS ==		== Split DNS ==

Phobos at 17:00, 25 November 2025

2025-11-25T17:00:26Z

← Older revision		Revision as of 17:00, 25 November 2025
Line 13:		Line 13:
	}\|name=/etc/nixos/configuration.nix\|lang=nix}}		}\|name=/etc/nixos/configuration.nix\|lang=nix}}

	After enabling Tailscale~~, create an~~ account ~~and login at https~~://login~~.tailscale.com (or self-host a compatible [https://github.com/juanfont~~/~~headscale Headscale] service; also available in NixOS).~~		After enabling, you can login to your Tailscale account with:<syntaxhighlight lang="console">
			# tailscale login
	If you are using features like subnet routers or exit nodes you will also need to set <code><nowiki>services.tailscale.useRoutingFeatures</nowiki></code> to "server", "client" or "both" depending on the role of your machine.		</syntaxhighlight>If you are using features like subnet routers or exit nodes you will also need to set <code><nowiki>services.tailscale.useRoutingFeatures</nowiki></code> to "server", "client" or "both" depending on the role of your machine.

	For more configuration option, refer to [Https://search.nixos.org/options?show=services.tailscale services.tailscale].		For more configuration option, refer to [Https://search.nixos.org/options?show=services.tailscale services.tailscale].

Phobos at 16:56, 25 November 2025

2025-11-25T16:56:50Z

← Older revision		Revision as of 16:56, 25 November 2025
Line 1:		Line 1:
	~~From [https~~:~~//tailscale.com Official Website]~~		== Basic setup ==
			To enable Tailscale, add the following to your configuration:

	~~<blockquote>~~		{{File\|3={
	~~''"Tailscale makes networking easy''~~		services.tailscale = {
			enable = true;
			# Enable tailscale at startup

	~~''Tailscale lets~~ you ~~easily manage access~~ to ~~private resources, quickly SSH into devices on your network, and work securely from anywhere in the world.~~"''		# If you would like to use a preauthorized key
	</~~blockquote>~~		#authKeyFile = "/run/secrets/tailscale_key";

	== ~~Basic setup ==~~		};
	~~You need to~~		}\|name=/etc/nixos/configuration.nix\|lang=nix}}

	~~# make~~ an account and login at https://login.tailscale.com (or self-host a compatible [https://github.com/juanfont/headscale Headscale] service; also available NixOS)		After enabling Tailscale, create an account and login at https://login.tailscale.com (or self-host a compatible [https://github.com/juanfont/headscale Headscale] service; also available in NixOS).
	~~# enable the Tailscale client app on your NixOS machine by adding <code><nowiki>services.tailscale.enable = true;</nowiki></code> and access tokens to your NixOS configuration~~.

	If you are using features like subnet routers or exit nodes you will also need to set <code><nowiki>services.tailscale.useRoutingFeatures</nowiki></code> to "server", "client" or "both" depending on the role of your machine.		If you are using features like subnet routers or exit nodes you will also need to set <code><nowiki>services.tailscale.useRoutingFeatures</nowiki></code> to "server", "client" or "both" depending on the role of your machine.

			For more configuration option, refer to [Https://search.nixos.org/options?show=services.tailscale services.tailscale].

	== Split DNS ==		== Split DNS ==

Phobos at 00:05, 25 November 2025

2025-11-25T00:05:09Z

← Older revision		Revision as of 00:05, 25 November 2025
Line 15:		Line 15:
	If you are using features like subnet routers or exit nodes you will also need to set <code><nowiki>services.tailscale.useRoutingFeatures</nowiki></code> to "server", "client" or "both" depending on the role of your machine.		If you are using features like subnet routers or exit nodes you will also need to set <code><nowiki>services.tailscale.useRoutingFeatures</nowiki></code> to "server", "client" or "both" depending on the role of your machine.

	== Split DNS~~: Access self-hosted services at your friends house as if you were there.~~ ==		== Split DNS ==
	Tailscale ~~support~~ "Split DNS" where you can access local services (not exposed to the internet) on a different network (e.g. ~~you~~ friend's house) as if you are in that local network.		Tailscale supports "Split DNS" where you can access local services (not exposed to the internet) on a different network (e.g. your friend's house) as if you are in that local network.

	See KTZ Systems Split DNS overview: https://www.youtube.com/watch?v=Uzcs97XcxiE		See KTZ Systems Split DNS overview: https://www.youtube.com/watch?v=Uzcs97XcxiE

Phobos: Quotation visual fix

2025-11-20T19:59:43Z

Quotation visual fix

← Older revision		Revision as of 19:59, 20 November 2025
Line 2:		Line 2:

	<blockquote>		<blockquote>
	Tailscale makes networking easy		''"Tailscale makes networking easy''

	Tailscale lets you easily manage access to private resources, quickly SSH into devices on your network, and work securely from anywhere in the world.		''Tailscale lets you easily manage access to private resources, quickly SSH into devices on your network, and work securely from anywhere in the world."''
	</blockquote>		</blockquote>

Antono: Known Issues: No internet when using exit node

2025-10-12T14:40:15Z

Known Issues: No internet when using exit node

← Older revision		Revision as of 14:40, 12 October 2025
Line 54:		Line 54:
	=== DNS ===		=== DNS ===
	There is also a known issue with DNS when using the default NixOS configuration; see [https://github.com/tailscale/tailscale/issues/4254 GitHub issue 4254]. Enabling [[systemd-resolved]] seems to be some part of the solution to this problem, as well as ensuring that DHCP is not enabled on the "tailscale0" network interface. Please see the GitHub issue for more information.		There is also a known issue with DNS when using the default NixOS configuration; see [https://github.com/tailscale/tailscale/issues/4254 GitHub issue 4254]. Enabling [[systemd-resolved]] seems to be some part of the solution to this problem, as well as ensuring that DHCP is not enabled on the "tailscale0" network interface. Please see the GitHub issue for more information.

			=== No internet when using exit node ===
			When you turn on exit nodes, NixOS's reverse path filter immediately starts dropping all incoming traffic related to wireguard tunnels, tailscale's control plane connection, etc. etc.
			The quick fix for NixOS users is to set the following option in your NixOS config:

			<code>networking.firewall.checkReversePath = "loose";</code>

			[https://github.com/tailscale/tailscale/issues/4432#issuecomment-1112819111 Issue in Tailscale tracker]

	== Running multiple Tailnet-accessible services on a single machine ==		== Running multiple Tailnet-accessible services on a single machine ==

Radiantly4107: /* Configuring TLS */

2025-04-03T01:21:47Z

Configuring TLS

← Older revision		Revision as of 01:21, 3 April 2025
Line 25:		Line 25:

	== Configuring TLS ==		== Configuring TLS ==
			{{Expansion\|
			* Set up Systemd service to run this command at regular intervals to avoid cert expiration.
			* Show how to run for multiple services on a single machine.
			}}

	Per [https://tailscale.com/kb/1153/enabling-https/?q=tls#provision-tls-certificates-for-your-devices Enabling HTTPS in the Tailscale documentation], run the following:		Per [https://tailscale.com/kb/1153/enabling-https/?q=tls#provision-tls-certificates-for-your-devices Enabling HTTPS in the Tailscale documentation], run the following:

Line 41:		Line 46:
	services.tailscale.permitCertUid = "caddy";		services.tailscale.permitCertUid = "caddy";
	</syntaxhighlight>		</syntaxhighlight>


	~~{{Expansion\|~~
	* Set up Systemd service to run this command at regular intervals to avoid cert expiration.
	* Show how to run for multiple services on a single machine.
	}}

	== Known issues ==		== Known issues ==