tailscale

Identity

• Unit: tailscaled.service
• CLI: tailscale (client commands) + tailscaled (daemon)
• Config: /etc/default/tailscaled (daemon flags); ACLs managed via Tailscale admin console (HuJSON)
• State: /var/lib/tailscale/
• Logs: journalctl -u tailscaled
• Install: curl -fsSL https://tailscale.com/install.sh | sh (review before running) or package repo at pkgs.tailscale.com

Key Operations

Expected State

• tailscale status shows self and connected peers
• tailscale ip returns a 100.x.x.x address (Tailscale's CGNAT range: 100.64.0.0/10)
• Interface tailscale0 is present in ip link show

Health Checks

1. systemctl is-active tailscaled → active
2. tailscale status → shows self entry and peer list
3. tailscale ping <peer> → pong from <peer> (<ip>) via <relay/direct> in Xms
4. tailscale ip -4 → returns a 100.x.x.x address

Common Failures

Pain Points

• Subnet routing requires three steps: The server advertises (tailscale up --advertise-routes=192.168.1.0/24), an admin approves the routes in the admin console, and clients enable tailscale up --accept-routes. All three must be true for routing to work.

• Exit node requires three steps: The device advertises (--advertise-exit-node), an admin approves it in the console, and clients select it (tailscale set --exit-node=<name>). Missing any step means no traffic is rerouted.

• ip_forward is required for subnet routing and exit nodes: The advertising device must have IP forwarding enabled.

  echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.conf
  sudo sysctl -p
  

• MagicDNS: Tailscale assigns <device>.<tailnet>.ts.net names to each device. Split DNS (forwarding only tailnet names through Tailscale) is configurable in the admin console under DNS settings. Disabling MagicDNS entirely (--accept-dns=false) is the escape hatch if Tailscale's DNS overrides conflict with local resolver setup.

• Tailscale SSH: Tailscale can manage SSH access without a running sshd, using Tailscale identity for authentication. Enable with tailscale up --ssh. SSH keys and authorized_keys are not involved — access is governed by ACLs in the admin console. This is additive: existing sshd continues to work.

• CGNAT range conflict: Tailscale uses 100.64.0.0/10. This range is also used by some ISPs for carrier-grade NAT and may conflict with other VPNs (e.g., WireGuard tunnels, OpenVPN). If there is a conflict, check the Tailscale docs for custom address range options (available on paid plans).

• Funnel: tailscale funnel 443 exposes a local port on the public internet via Tailscale's infrastructure, reachable at https://<device>.<tailnet>.ts.net. For development and testing only — not intended for production traffic. Must be enabled per-device in the admin console.

• tailscale up rewrites flags: Running tailscale up with a subset of flags resets unspecified flags to defaults. Always pass all desired flags together, or use tailscale set for individual flag changes without resetting others.

References

See references/ for:

• configuration.md — tailscale up flags, daemon config, ACL structure, and setup patterns
• docs.md — official documentation links