Tailscale - Revision history

Qweered: tweak wording

2026-06-17T15:40:11Z

tweak wording

← Older revision		Revision as of 15:40, 17 June 2026
Line 9:		Line 9:
	# If you would like to use a preauthorized key, set		# If you would like to use a preauthorized key, set
	# authKeyFile = "/run/secrets/tailscale_key";		# authKeyFile = "/run/secrets/tailscale_key";
	# Note: maximum time ~~to expire~~ is 90 days		# Note: maximum expire time is 90 days
	};		};
	}\|name=/etc/nixos/configuration.nix\|lang=nix}}		}\|name=/etc/nixos/configuration.nix\|lang=nix}}

Qweered: Add note about maximum key lifetime

2026-06-17T15:39:36Z

Add note about maximum key lifetime

← Older revision		Revision as of 15:39, 17 June 2026
Line 4:		Line 4:
	{{File\|3={		{{File\|3={
	services.tailscale = {		services.tailscale = {
			# Enable tailscale at startup
	enable = true;		enable = true;
	~~# Enable tailscale at startup~~

	~~# If you would like to use a preauthorized key~~
	~~#authKeyFile = "/run/secrets/tailscale_key";~~

			# If you would like to use a preauthorized key, set
			# authKeyFile = "/run/secrets/tailscale_key";
			# Note: maximum time to expire is 90 days
	};		};
	}\|name=/etc/nixos/configuration.nix\|lang=nix}}		}\|name=/etc/nixos/configuration.nix\|lang=nix}}

Lucasfcnunes at 18:09, 19 May 2026

2026-05-19T18:09:54Z

← Older revision		Revision as of 18:09, 19 May 2026
Line 34:		Line 34:
	enable = true;		enable = true;
	# Always allow traffic from your Tailscale network		# Always allow traffic from your Tailscale network
	trustedInterfaces = [ ~~"tailscale0"~~ ];		trustedInterfaces = [ config.services.tailscale.interfaceName ];
	# Allow the Tailscale UDP port through the firewall		# Allow the Tailscale UDP port through the firewall
	allowedUDPPorts = [ config.services.tailscale.port ];		allowedUDPPorts = [ config.services.tailscale.port ];

Dogphilosopher: Added documentated issue and workaround for asking for root authentication

2026-03-04T19:30:27Z

Added documentated issue and workaround for asking for root authentication

← Older revision		Revision as of 19:30, 4 March 2026
Line 103:		Line 103:
	Some GUI applets/utilities cannot control {{ic\|tailscaled}} as a regular user and prompt for a password for every action/not connecting. Assigning the user as an operator fixes this:		Some GUI applets/utilities cannot control {{ic\|tailscaled}} as a regular user and prompt for a password for every action/not connecting. Assigning the user as an operator fixes this:

	{{Commands\|1=$ sudo tailscale set --operator=USERNAME}}		{{Commands\|1=$ sudo tailscale set --operator=USERNAME}}'''Note:''' There is currently a bug with the above command documented in: https://github.com/tailscale/tailscale/issues/18294

			The workaround is to login and set the operator as part of connecting to tailscale. This section can be removed once the issue is resolved.

			{{Commands\|1=# for initial login
			sudo tailscale login

			# this will set your user as the operator for the future
			sudo tailscale up --operator=$USER

			# validate your user is an operator
			tailscale debug prefs {{!}} grep -i operator}}

	== Running multiple Tailnet-accessible services on a single machine ==		== Running multiple Tailnet-accessible services on a single machine ==

Alex: Added workaround for some applets/utils issues.

2026-01-26T15:29:47Z

Added workaround for some applets/utils issues.

← Older revision		Revision as of 15:29, 26 January 2026
Line 99:		Line 99:

	[https://github.com/tailscale/tailscale/issues/4432#issuecomment-1112819111 Issue in Tailscale tracker]		[https://github.com/tailscale/tailscale/issues/4432#issuecomment-1112819111 Issue in Tailscale tracker]

			=== Some utils/applets asks root auth every time ===
			Some GUI applets/utilities cannot control {{ic\|tailscaled}} as a regular user and prompt for a password for every action/not connecting. Assigning the user as an operator fixes this:

			{{Commands\|1=$ sudo tailscale set --operator=USERNAME}}

	== Running multiple Tailnet-accessible services on a single machine ==		== Running multiple Tailnet-accessible services on a single machine ==

Joshieadalid: Add native nftables configuration and update UDP performance optimization section using networkd-dispatcher.

2026-01-02T04:56:09Z

Add native nftables configuration and update UDP performance optimization section using networkd-dispatcher.

← Older revision		Revision as of 04:56, 2 January 2026
Line 8:		Line 8:

	# If you would like to use a preauthorized key		# If you would like to use a preauthorized key
	#authKeyFile = "/run/secrets/tailscale_key";		#authKeyFile = "/run/secrets/tailscale_key";

	};		};
Line 18:		Line 18:

	For more configuration option, refer to <code>[https://search.nixos.org/options?show=services.tailscale services.tailscale]</code> .		For more configuration option, refer to <code>[https://search.nixos.org/options?show=services.tailscale services.tailscale]</code> .

			== Native nftables Support (Modern Setup) ==
			Recent versions of NixOS encourage the use of [[nftables]] over legacy iptables. Tailscale can be configured to use `nftables` natively, which avoids conflicts and kernel module bloat.

			This configuration forces the `nftables` backend and optimizes the service startup:

			<syntaxhighlight lang="nixos">
			{ config, pkgs, ... }:

			{
			# 1. Enable the service and the firewall
			services.tailscale.enable = true;
			networking.nftables.enable = true;
			networking.firewall = {
			enable = true;
			# Always allow traffic from your Tailscale network
			trustedInterfaces = [ "tailscale0" ];
			# Allow the Tailscale UDP port through the firewall
			allowedUDPPorts = [ config.services.tailscale.port ];
			};

			# 2. Force tailscaled to use nftables (Critical for clean nftables-only systems)
			# This avoids the "iptables-compat" translation layer issues.
			systemd.services.tailscaled.serviceConfig.Environment = [
			"TS_DEBUG_FIREWALL_MODE=nftables"
			];

			# 3. Optimization: Prevent systemd from waiting for network online
			# (Optional but recommended for faster boot with VPNs)
			systemd.network.wait-online.enable = false;
			boot.initrd.systemd.network.wait-online.enable = false;
			}
			</syntaxhighlight>

	== Split DNS ==		== Split DNS ==
Line 87:		Line 120:

	== Optimize the performance of subnet routers and exit nodes ==		== Optimize the performance of subnet routers and exit nodes ==
	Tailscale gives [https://tailscale.com/kb/1320/performance-best-practices#enable-on-each-boot recommendations] on how to optimize UDP throughput ~~of your node~~.		Tailscale gives [https://tailscale.com/kb/1320/performance-best-practices#enable-on-each-boot recommendations] on how to optimize UDP throughput. For high-throughput nodes (like subnet routers), disabling UDP Generic Receive Offload (GRO) on the physical interface is recommended to prevent packet drops.

	~~You need to have <code>ethtool</code> and <code>~~networkd-dispatcher~~</code> installed, and~~ to ~~create~~ the ~~appropriate rule for Tailscale~~.		In NixOS, this can be automated using `networkd-dispatcher` to ensure the setting persists across reboots and network changes.

	~~Supposing the network device you'll be using is called <code>eth0</code>, you can add the following to your <code>configuration.nix</code>:~~<syntaxhighlight lang="nixos">		<syntaxhighlight lang="nixos">
	services ~~= {~~		# In environment.systemPackages, ensure you have pkgs.ethtool
	networkd-dispatcher = {		services.networkd-dispatcher = {
	enable = true;		enable = true;
	rules."50-tailscale" = {		rules."50-tailscale-optimizations" = {
	onState = ["routable"];		onState = [ "routable" ];
	script = ''		script = ''
	${~~lib~~.~~getExe~~ ethtool} -K eth0 rx-udp-gro-forwarding on rx-gro-list off		${pkgs.ethtool}/bin/ethtool -K eth0 rx-udp-gro-forwarding on rx-gro-list off
	'';		'';
	};
	};		};
	};		};
	</syntaxhighlight>		</syntaxhighlight>
			''Note: Replace `eth0` with your actual WAN interface name (e.g. `ens192`).''

Phobos at 17:02, 25 November 2025

2025-11-25T17:02:28Z

← Older revision		Revision as of 17:02, 25 November 2025
Line 17:		Line 17:
	</syntaxhighlight>If you are using features like subnet routers or exit nodes you will also need to set <code><nowiki>services.tailscale.useRoutingFeatures</nowiki></code> to "server", "client" or "both" depending on the role of your machine.		</syntaxhighlight>If you are using features like subnet routers or exit nodes you will also need to set <code><nowiki>services.tailscale.useRoutingFeatures</nowiki></code> to "server", "client" or "both" depending on the role of your machine.

	For more configuration option, refer to [~~Https~~://search.nixos.org/options?show=services.tailscale services.tailscale].		For more configuration option, refer to <code>[https://search.nixos.org/options?show=services.tailscale services.tailscale]</code> .

	== Split DNS ==		== Split DNS ==

Phobos at 17:00, 25 November 2025

2025-11-25T17:00:26Z

← Older revision		Revision as of 17:00, 25 November 2025
Line 13:		Line 13:
	}\|name=/etc/nixos/configuration.nix\|lang=nix}}		}\|name=/etc/nixos/configuration.nix\|lang=nix}}

	After enabling Tailscale~~, create an~~ account ~~and login at https~~://login~~.tailscale.com (or self-host a compatible [https://github.com/juanfont~~/~~headscale Headscale] service; also available in NixOS).~~		After enabling, you can login to your Tailscale account with:<syntaxhighlight lang="console">
			# tailscale login
	If you are using features like subnet routers or exit nodes you will also need to set <code><nowiki>services.tailscale.useRoutingFeatures</nowiki></code> to "server", "client" or "both" depending on the role of your machine.		</syntaxhighlight>If you are using features like subnet routers or exit nodes you will also need to set <code><nowiki>services.tailscale.useRoutingFeatures</nowiki></code> to "server", "client" or "both" depending on the role of your machine.

	For more configuration option, refer to [Https://search.nixos.org/options?show=services.tailscale services.tailscale].		For more configuration option, refer to [Https://search.nixos.org/options?show=services.tailscale services.tailscale].

Phobos at 16:56, 25 November 2025

2025-11-25T16:56:50Z

← Older revision		Revision as of 16:56, 25 November 2025
Line 1:		Line 1:
	~~From [https~~:~~//tailscale.com Official Website]~~		== Basic setup ==
			To enable Tailscale, add the following to your configuration:

	~~<blockquote>~~		{{File\|3={
	~~''"Tailscale makes networking easy''~~		services.tailscale = {
			enable = true;
			# Enable tailscale at startup

	~~''Tailscale lets~~ you ~~easily manage access~~ to ~~private resources, quickly SSH into devices on your network, and work securely from anywhere in the world.~~"''		# If you would like to use a preauthorized key
	</~~blockquote>~~		#authKeyFile = "/run/secrets/tailscale_key";

	== ~~Basic setup ==~~		};
	~~You need to~~		}\|name=/etc/nixos/configuration.nix\|lang=nix}}

	~~# make~~ an account and login at https://login.tailscale.com (or self-host a compatible [https://github.com/juanfont/headscale Headscale] service; also available NixOS)		After enabling Tailscale, create an account and login at https://login.tailscale.com (or self-host a compatible [https://github.com/juanfont/headscale Headscale] service; also available in NixOS).
	~~# enable the Tailscale client app on your NixOS machine by adding <code><nowiki>services.tailscale.enable = true;</nowiki></code> and access tokens to your NixOS configuration~~.

	If you are using features like subnet routers or exit nodes you will also need to set <code><nowiki>services.tailscale.useRoutingFeatures</nowiki></code> to "server", "client" or "both" depending on the role of your machine.		If you are using features like subnet routers or exit nodes you will also need to set <code><nowiki>services.tailscale.useRoutingFeatures</nowiki></code> to "server", "client" or "both" depending on the role of your machine.

			For more configuration option, refer to [Https://search.nixos.org/options?show=services.tailscale services.tailscale].

	== Split DNS ==		== Split DNS ==

Phobos at 00:05, 25 November 2025

2025-11-25T00:05:09Z

← Older revision		Revision as of 00:05, 25 November 2025
Line 15:		Line 15:
	If you are using features like subnet routers or exit nodes you will also need to set <code><nowiki>services.tailscale.useRoutingFeatures</nowiki></code> to "server", "client" or "both" depending on the role of your machine.		If you are using features like subnet routers or exit nodes you will also need to set <code><nowiki>services.tailscale.useRoutingFeatures</nowiki></code> to "server", "client" or "both" depending on the role of your machine.

	== Split DNS~~: Access self-hosted services at your friends house as if you were there.~~ ==		== Split DNS ==
	Tailscale ~~support~~ "Split DNS" where you can access local services (not exposed to the internet) on a different network (e.g. ~~you~~ friend's house) as if you are in that local network.		Tailscale supports "Split DNS" where you can access local services (not exposed to the internet) on a different network (e.g. your friend's house) as if you are in that local network.

	See KTZ Systems Split DNS overview: https://www.youtube.com/watch?v=Uzcs97XcxiE		See KTZ Systems Split DNS overview: https://www.youtube.com/watch?v=Uzcs97XcxiE