Tailscale: Difference between revisions

(14 intermediate revisions by 8 users not shown)

Line 1:

~~From~~ [https://tailscale.~~com Official Website~~]

== Basic setup ==

To enable Tailscale, add the following to your configuration:

{{File|3={

services.tailscale = {

enable = true;

# Enable tailscale at startup

# If you would like to use a preauthorized key

#authKeyFile = "/run/secrets/tailscale_key";

};

}|name=/etc/nixos/configuration.nix|lang=nix}}

After enabling, you can login to your Tailscale account with:<syntaxhighlight lang="console">

# tailscale login

</syntaxhighlight>If you are using features like subnet routers or exit nodes you will also need to set <code><nowiki>services.tailscale.useRoutingFeatures</nowiki></code> to "server", "client" or "both" depending on the role of your machine.

For more configuration option, refer to <code>[https://search.nixos.org/options?show=services.tailscale services.tailscale]</code> .

~~<blockquote>~~

== Split DNS ==

Tailscale ~~makes networking easy~~

Tailscale supports "Split DNS" where you can access local services (not exposed to the internet) on a different network (e.g. your friend's house) as if you are in that local network.

~~Tailscale lets you easily manage access to private resources, quickly SSH into devices on your network, and work securely from anywhere in the world~~.

See KTZ Systems Split DNS overview: https://www.youtube.com/watch?v=Uzcs97XcxiE

</~~blockquote>~~

~~== Basic setup ==~~

Combined with Let's Encrypt using the "DNS-01" challenge you can get browser-trusted HTTPS certificates for local services (not exposed to the internet) and access them with Tailscale from anywhere.

~~Enabling tailscale is as simple as adding <code><nowiki>~~services~~.tailscale.enable = true;</nowiki></code>~~ to ~~your Nix config~~.

~~If you are using features like subnet routers or exit nodes you will also need to set <code><nowiki>services~~.~~tailscale~~.~~useRoutingFeatures</nowiki><~~/~~code> to "server", "client" or "both" depending on the role of your machine.~~

See Wolfgang's Channel Local HTTPS overview: https://www.youtube.com/watch?v=qlcVx-k-02E

== Configuring TLS ==

{{Expansion|

* Set up Systemd service to run this command at regular intervals to avoid cert expiration.

* Show how to run for multiple services on a single machine.

}}

Per [https://tailscale.com/kb/1153/enabling-https/?q=tls#provision-tls-certificates-for-your-devices Enabling HTTPS in the Tailscale documentation], run the following:

Line 19:

Line 40:

}}

~~{{Expansion|~~

As an alternative, you can set up [https://wiki.nixos.org/wiki/Caddy Caddy] to create and manage SSL certs automatically as [https://tailscale.com/kb/1190/caddy-certificates Caddy recognizes Tailscale urls]. After replacing <code><MACHINE_NAME></code>, <code><TAILNET_NAME></code>, <code><port></code> with your tailscale machine name, tailscale tailnet name, and the port of the local service you want to forward, you can add the following to your <code>configuration.nix</code>:<syntaxhighlight lang="nixos">

* Set up ~~Systemd~~ service to ~~run this command at regular intervals~~ to ~~avoid cert expiration~~.

services.caddy = {

* Show how to ~~run for multiple~~ services ~~on a single machine~~.

enable = true;

}}

virtualHosts."<MACHINE_NAME>.<TAILNET_NAME>".extraConfig = ''

reverse_proxy 127.0.0.1:<port>

'';

};

# Allow the Caddy user(and service) to edit certs

services.tailscale.permitCertUid = "caddy";

</syntaxhighlight>

== Known issues ==

If you encounter issues with IPv6 not working through your NixOS-based exit node, this might be an issue with the tailscale client's detection of whether IPv6 NAT is supported. This is the "checkSupportsV6NAT" function in the tailscale codebase. Enabling <code><nowiki>networking.nftables.enable = true;</nowiki></code> and then rebooting may fix this issue if you are using iptables.

=== IPv6 ===

If you encounter issues with IPv6 not working through your NixOS-based exit node, this might be an issue with the Tailscale client's detection of whether IPv6 NAT is supported. This is the "checkSupportsV6NAT" function in the Tailscale codebase. Enabling <code><nowiki>networking.nftables.enable = true;</nowiki></code> and then rebooting may fix this issue if you are using iptables.

=== DNS ===

There is also a known issue with DNS when using the default NixOS configuration; see [https://github.com/tailscale/tailscale/issues/4254 GitHub issue 4254]. Enabling [[systemd-resolved]] seems to be some part of the solution to this problem, as well as ensuring that DHCP is not enabled on the "tailscale0" network interface. Please see the GitHub issue for more information.

=== No internet when using exit node ===

When you turn on exit nodes, NixOS's reverse path filter immediately starts dropping all incoming traffic related to wireguard tunnels, tailscale's control plane connection, etc. etc.

The quick fix for NixOS users is to set the following option in your NixOS config:

<code>networking.firewall.checkReversePath = "loose";</code>

[https://github.com/tailscale/tailscale/issues/4432#issuecomment-1112819111 Issue in Tailscale tracker]

== Running multiple Tailnet-accessible services on a single machine ==

Line 47:

Line 85:

* Set up Systemd services for the additional host names

}}

== Optimize the performance of subnet routers and exit nodes ==

Tailscale gives [https://tailscale.com/kb/1320/performance-best-practices#enable-on-each-boot recommendations] on how to optimize UDP throughput of your node.

You need to have <code>ethtool</code> and <code>networkd-dispatcher</code> installed, and to create the appropriate rule for Tailscale.

Supposing the network device you'll be using is called <code>eth0</code>, you can add the following to your <code>configuration.nix</code>:<syntaxhighlight lang="nixos">

services = {

networkd-dispatcher = {

enable = true;

rules."50-tailscale" = {

onState = ["routable"];

script = ''

${lib.getExe ethtool} -K eth0 rx-udp-gro-forwarding on rx-gro-list off

'';

};

</syntaxhighlight>

@@ Line 1: / Line 1: @@
-From [https://tailscale.com Official Website]
+== Basic setup ==
+To enable Tailscale, add the following to your configuration:
+{{File|3={
+  services.tailscale = {
+    enable = true;
+    # Enable tailscale at startup
+    # If you would like to use a preauthorized key
+   #authKeyFile = "/run/secrets/tailscale_key";
+  };
+}|name=/etc/nixos/configuration.nix|lang=nix}}
+After enabling, you can login to your Tailscale account with:<syntaxhighlight lang="console">
+# tailscale login
+</syntaxhighlight>If you are using features like subnet routers or exit nodes you will also need to set <code><nowiki>services.tailscale.useRoutingFeatures</nowiki></code> to "server", "client" or "both" depending on the role of your machine.
+For more configuration option, refer to <code>[https://search.nixos.org/options?show=services.tailscale services.tailscale]</code> .
-<blockquote>
+== Split DNS ==
-Tailscale makes networking easy
+Tailscale supports "Split DNS" where you can access local services (not exposed to the internet) on a different network (e.g. your friend's house) as if you are in that local network.
-Tailscale lets you easily manage access to private resources, quickly SSH into devices on your network, and work securely from anywhere in the world.
+See KTZ Systems Split DNS overview: https://www.youtube.com/watch?v=Uzcs97XcxiE
-</blockquote>
-== Basic setup ==
+Combined with Let's Encrypt using the "DNS-01" challenge you can get browser-trusted HTTPS certificates for local services (not exposed to the internet) and access them with Tailscale from anywhere.
-Enabling tailscale is as simple as adding <code><nowiki>services.tailscale.enable = true;</nowiki></code> to your Nix config.
-If you are using features like subnet routers or exit nodes you will also need to set <code><nowiki>services.tailscale.useRoutingFeatures</nowiki></code> to "server", "client" or "both" depending on the role of your machine.
+See Wolfgang's Channel Local HTTPS overview: https://www.youtube.com/watch?v=qlcVx-k-02E
 == Configuring TLS ==
+{{Expansion|
+* Set up Systemd service to run this command at regular intervals to avoid cert expiration.
+* Show how to run for multiple services on a single machine.
+}}
 Per [https://tailscale.com/kb/1153/enabling-https/?q=tls#provision-tls-certificates-for-your-devices Enabling HTTPS in the Tailscale documentation], run the following:
@@ Line 19: / Line 40: @@
 }}
-{{Expansion|
+As an alternative, you can set up [https://wiki.nixos.org/wiki/Caddy Caddy] to create and manage SSL certs automatically as [https://tailscale.com/kb/1190/caddy-certificates Caddy recognizes Tailscale urls]. After replacing <code><MACHINE_NAME></code>, <code><TAILNET_NAME></code>, <code><port></code> with your tailscale machine name, tailscale tailnet name, and the port of the local service you want to forward, you can add the following to your <code>configuration.nix</code>:<syntaxhighlight lang="nixos">
-* Set up Systemd service to run this command at regular intervals to avoid cert expiration.
+services.caddy = {
-* Show how to run for multiple services on a single machine.
+  enable = true;
-}}
+  virtualHosts."<MACHINE_NAME>.<TAILNET_NAME>".extraConfig = ''
+    reverse_proxy 127.0.0.1:<port>
+  '';
+};
+# Allow the Caddy user(and service) to edit certs
+services.tailscale.permitCertUid = "caddy";
+</syntaxhighlight>
 == Known issues ==
-If you encounter issues with IPv6 not working through your NixOS-based exit node, this might be an issue with the tailscale client's detection of whether IPv6 NAT is supported. This is the "checkSupportsV6NAT" function in the tailscale codebase. Enabling <code><nowiki>networking.nftables.enable = true;</nowiki></code> and then rebooting may fix this issue if you are using iptables.
+=== IPv6 ===
+If you encounter issues with IPv6 not working through your NixOS-based exit node, this might be an issue with the Tailscale client's detection of whether IPv6 NAT is supported. This is the "checkSupportsV6NAT" function in the Tailscale codebase. Enabling <code><nowiki>networking.nftables.enable = true;</nowiki></code> and then rebooting may fix this issue if you are using iptables.
+=== DNS ===
 There is also a known issue with DNS when using the default NixOS configuration; see [https://github.com/tailscale/tailscale/issues/4254 GitHub issue 4254]. Enabling [[systemd-resolved]] seems to be some part of the solution to this problem, as well as ensuring that DHCP is not enabled on the "tailscale0" network interface. Please see the GitHub issue for more information.
+=== No internet when using exit node ===
+When you turn on exit nodes, NixOS's reverse path filter immediately starts dropping all incoming traffic related to wireguard tunnels, tailscale's control plane connection, etc. etc.
+The quick fix for NixOS users is to set the following option in your NixOS config:
+<code>networking.firewall.checkReversePath = "loose";</code>
+[https://github.com/tailscale/tailscale/issues/4432#issuecomment-1112819111 Issue in Tailscale tracker]
 == Running multiple Tailnet-accessible services on a single machine ==
@@ Line 47: / Line 85: @@
 * Set up Systemd services for the additional host names
 }}
+== Optimize the performance of subnet routers and exit nodes ==
+Tailscale gives [https://tailscale.com/kb/1320/performance-best-practices#enable-on-each-boot recommendations] on how to optimize UDP throughput of your node.
+You need to have <code>ethtool</code> and <code>networkd-dispatcher</code> installed, and to create the appropriate rule for Tailscale.
+Supposing the network device you'll be using is called <code>eth0</code>, you can add the following to your <code>configuration.nix</code>:<syntaxhighlight lang="nixos">
+services = {
+  networkd-dispatcher = {
+    enable = true;
+    rules."50-tailscale" = {
+      onState = ["routable"];
+      script = ''
+        ${lib.getExe ethtool} -K eth0 rx-udp-gro-forwarding on rx-gro-list off
+      '';
+    };
+  };
+};
+</syntaxhighlight>