TailScale

Proven on:

11 (bullseye)

WIP!!!

As always...

Start with:

• sudo apt update
• sudo apt upgrade

TailScale HowTo

• Tailscale quickstart (Get individual machines onto your private TailScale network)

Installing on Linux

A note about LXCs & TailScals

I'd suggest just using the script method that they provide on this page.

• curl -fsSL https://tailscale.com/install.sh | sh

The first time you start it by entering tailscale up it will display a URL. Open a web browser & go to this URL to authorise the machine on your tailnet.

From this point on, tailscale up will be done automatically on bootup.

The Actual Day-to-Day usage

In general, Tailscale is pretty much transparent.

Mostly, you do all the same things you would expect on an IP-based network.

The big difference is that every machine on your tailnet has a secondary address that pretty much ignores the non-tailnet topology. (i.e.: As long as the machine is connected to the Internet in general, it's reachable by the tailnet IP address.)

Reaching it by that address requires that the machine you're accessing from have tailscale installed & running.

TailScale & pfSense

• A Tailscale Package for pfSense! (video)
  • exit node
  • subnet router
  • 6:20 - configuration
  • 7:30 - mention of headscale
  • 16:15 - Subnets
  • 19:30 - Firewall rules
  • 20:32 - routing limitations
  • 27:30 - Outbound NAT
• How to Set Up Tailscale on pfSense

The Steps

Installing

1. Select System, then Package Manager.
2. Search for Tailscale, then install the Tailscale package.
3. Select VPN, then Tailscale to launch the Tailscale settings.
4. At this point, we need to configure the pre-authentication key. This can be created on the Tailscale website. If you don?t already have an account, create one, then log in and select Settings, then Keys.
5. Select generate auth key so that we can create the key for pfSense. Select Generate Key (the settings can stay as default).
6. After the key has been generated, copy it, then go back to the Authentication section of Tailscale on pfSense.
7. Paste the key that was just created, then select save.
8. After saving, select Settings, then enable Tailscale and Save.

Setup

1. Inside the Tailscale settings on pfSense, enable the offer to be an exit node for outbound internet traffic from the Tailscale network option. Also, set the Advertised Routes as your local subnet (that you'd like to be able to access from external networks), then save.
2. On the Tailscale website, select Machines, then the three ellipses next to your pfSense system, then Edit Route Settings.
3. Select use as exit node. The exit node functionality is now set up and can be used by client devices.
4. On whatever application you're using, select Use Exit Node and change the exit node to be pfSense. If you do not want to use the exit node, select None, but ensure that Allow LAN Access is enabled so that you?re able to connect to your local devices. (WTF does this actually mean???)
5. Tailscale is now configured! You can now add other devices or simply connect to Tailscale from an external network to access all of your local devices.

Accessing It

On a Linux machine with TailScale installed

Start Tailscale with the command line:

• sudo tailscale up --accept-routes

At this point, the network maintained by the above pfSense router is accessible by IP addresses from this machine...

Yet to be figured out...

• Going the other direction
  • i.e.: setting up pfSense to add a TailScale shared network to the local network
• Accessing the remote network using hostnames

HeadScale

• Headscale