Comments (3)
Based on Discussion #51, I was able to get the daemon up and running in TUN mode, and now I can:
- ping remote tailscale IPs and the networks behind them from the UDM Pro shell,
- ping the local tailscale IP from my hosts,
- not ping the remote tailscale IPs from my hosts, let alone the networks behind them.
from tailscale-udm.
@FearNaBoinne FWIW, I also had same problem as you, but I figured it out. Leaving my comments here, as it took me a very long time to figure out, and hopefully it can help others.
First off, you absolutely need ip rule add priority 5225 fwmark 0x80000 lookup 201
but you knew that already. And remove --tun userspace-networking
from the tailscaled options.
Then, do tailscale up --exit-node-allow-lan-access --exit-node=YOUR_EXIT_NODE
this is the vital step. Also, using a exit node like this will temporarily knock your UDM off the internet, so it is VITAL that you don't forget --exit-node-allow-lan-access
or you'll be in a world of pain trying to recover your UDM, probably via factory reset if you don't have a console cable.
tailscale puts its routes in table 52 (ip route show table 52
)
you'll need to remove the default route, and if you are doing any sort of split networking (https://github.com/peacey/split-vpn) then also remove the the subnet from the throw route. (if using split-vpn script, be sure to add a route to the exit node before running the updown.sh script.)
All put together
cat /etc/default/tailscaled
# Set the port to listen on for incoming VPN packets.
# Remote nodes will automatically be informed about the new port number,
# but you might want to configure this in order to set external firewall
# settings.
PORT="41641"
# Extra flags you might want to pass to tailscaled.
#FLAGS="--state /data/tailscale/tailscaled.state --tun userspace-networking"
FLAGS="--socket /var/run/tailscale/tailscaled.sock --state /data/tailscale/tailscaled.state"
ip rule add priority 5225 fwmark 0x80000 lookup 201
tailscale up --exit-node-allow-lan-access --exit-node=YOUR_EXIT_NODE
root@McDreamy:~# ip route show table 52
default dev tailscale0
throw 10.142.142.0/24
throw 10.200.200.0/24
throw my.private.ip.x/19
100.73.228.78 dev tailscale0
100.74.64.31 dev tailscale0
100.78.144.20 dev tailscale0
100.85.37.93 dev tailscale0
100.85.138.75 dev tailscale0
100.88.44.129 dev tailscale0
100.95.34.38 dev tailscale0
100.97.182.33 dev tailscale0
100.100.100.100 dev tailscale0
100.113.129.93 dev tailscale0
100.115.181.22 dev tailscale0
100.116.76.85 dev tailscale0
100.122.47.9 dev tailscale0
100.125.112.79 dev tailscale0
throw 127.0.0.0/8
throw 192.168.4.0/24
throw 192.168.99.0/24
ip route del default dev tailscale0 table 52
ip route del throw 192.168.3.0/24 table 52
and your good to go.
Btw, apparently 'exit node' is not just a simple routing rule. It appears that the exit node is saved into a preference file, and uploaded to the control plane. I wasn't able to make this work by NOT running it in --exit-mode.
Note - instead of exit node, you could try to just advertise default routes --advertise-routes=0.0.0.0/0
but I haven't tried this.
Now, after all that work, I might not use tailscale after all because a tailscale node act as both an exit node and use an exit node. :-( Probably going to end up using straight wireguard.
from tailscale-udm.
tailscale up --exit-node-allow-lan-access --exit-node=YOUR_EXIT_NODE
My UDM Pro is my exit-node, but when I used it's name in the --exit-node parameter, it tells me invalid value "YOUR_EXIT_NODE" for --exit-node; must be IP or unique node name
(Using it's IP tells me no node found in netmap with IP 1.2.3.4
)
from tailscale-udm.
Related Issues (20)
- support for UDR HOT 5
- Incorrect readme HOT 1
- Undefined function `tailscale_update` in `manage.sh`
- tailscale missing after firware upgrade HOT 11
- reinstall fails due to modified `/etc/default/tailscaled`
- Version '11 (bullseye)' for 'tailscale' was not found HOT 1
- Failed to configure Tailscale to use userspace networking HOT 1
- Kernel mode networking allows subnet routing to other machines on the local network HOT 1
- Make `TAILSCALE_ROOT` in on-boot.sh firmware version agnostic
- `TAILSCALE_ROOT` undefined when firmware version 2+
- Not possible to install on my Dream machine pro HOT 1
- 2.5.17 - debian stretch-backports no Release file. HOT 2
- Install fails due to upstream apt repository issues (404 Not Found/401 Unauthorized) HOT 4
- Exit Node Issue
- Unable to Install on UDMP HOT 4
- TAILSCALE_FLAGS unused in 2.x version HOT 1
- Exit Node selected but offline HOT 1
- While on Dream Machine Pro, cannot ping or resolve other tailnet devices HOT 1
- tailscaled.service is masked, unable to start service (and therefore unable to connect to tailnet) HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from tailscale-udm.