Setting up Tailscale

Nobody has claimed this yet.

https://tailscale.com/kb/1036/install-arch

### Setup tailscale and add your computer

1. `pamac install tailscale`
1. (probably need to restart your computer as I was running into problems when trying to bring up tailscale)
- `journalctl -u tailscaled` -> `kernel/drivers/net/tun.ko found on disk, but not for current kernel; are you in middle of a system update and haven't rebooted? found: /lib/modules/`
1. `sudo systemctl enable --now tailscaled`
1. `sudo tailscale up`, click the link in the terminal output and add the device to your tailnet

### See logs

```
journalctl -u tailscaled
```

### CLI Reference

- https://tailscale.com/kb/1080/cli
- https://tailscale.com/kb/1241/tailscale-up

### Have someone else add a new device to your tailnet

You can generate one-off auth keys to give to someone to add a new device, https://tailscale.com/kb/1085/auth-keys

In the Tailscale admin console: **Settings** -> **Keys** -> **Generate auth key**

Usage:
```
sudo tailscale up --auth-key=tskey-abcdef1432341818
```

### Add an exit node

1. Enable IP forwarding on the machine you're going to use as the exit node, see https://tailscale.com/kb/1408/quick-guide-exit-nodes?tab=linux#advertise-a-device-as-an-exit-node
- Here are some Linux specific instructions (if you're on a different platform, refer to the link above):
1. First, check if you already have IP forwarding enabled (you might already if you have Docker) (enabled = 1, disabled = 0):
```shell
$ sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
$ sysctl net.ipv6.conf.all.forwarding
net.ipv6.conf.all.forwarding = 1
```
1. Enable IP forwarding (persists over restarts):
```shell
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf
```
3. If you want to undo the IP forwarding, `rm /etc/sysctl.d/99-tailscale.conf`, then manually set each property via `sudo sysctl -w net.ipv4.ip_forward=0` and `sudo sysctl -w net.ipv6.conf.all.forwarding=0`
- If you don't do this step, you will probably see the following warning in the Tailscale admin console:
> Unable to relay traffic
> This machine has IP forwarding disabled and cannot relay traffic. Please enable IP forwarding on this machine to use relay features like subnets or exit nodes.
1. `sudo tailscale up --advertise-exit-node` or `sudo tailscale set --advertise-exit-node`
1. Then go into the Tailscale admin console, select the relevant machine -> **Edit route settings** -> **Use as exit node** to approve it for use.
- You could also adjust your ACL's to auto-accept/approve the exit node

### Use specific exit node to route traffic through

Then on other devices, you can choose which exit node to use via the following command:

```
sudo tailscale set --exit-node=
```

You might also be interested in this extra command: `--exit-node-allow-lan-access=true`: "Allow the client node access to its own LAN while connected to an exit node. Defaults to not allowing access while connected to an exit node." ([source](https://tailscale.com/kb/1241/tailscale-up)). This makes it so that your local LAN traffic doesn't go through the exit node so you can still access all of your local devices.

List available exit nodes:

```
sudo tailscale exit-node list
```

You can also have Tailscale recommend an exit node based on latency and performance information:

```
sudo tailscale exit-node suggest
```

Reference:

- https://tailscale.com/kb/1392/auto-exit-nodes

### Add a new WiFi network to your OpenWRT router that will direct all traffic through a tailnet exit-node

Aka: How to connect your Smart TV to the Tailscale network

We're going to create a new WiFi network (like `my_wifi_5g_tailnet`) that you can connect your Smart TV to and have all of the traffic go through a Tailscale exit node (like your parents house that is set as the Netflix "household"). This is useful to get around the pesky single household streaming policies that have been implemented to crackdown on password sharing (hypothetical). Or trying to access content that is "Geo-blocking" (geographical restrictions).

This kind of setup is also just useful in general for situations where you can't install a Tailscale client on a device but want all of the traffic to go through the tailnet.

My specs:

- Linksys WRT1200AC v1 router
- https://openwrt.org/toh/linksys/wrt1200ac
- Flashed with OpenWrt 23.05.5

Reference:

- https://openwrt.org/docs/guide-user/services/vpn/tailscale/start
- https://www.youtube.com/watch?v=UvniZs8q3eU

#### Install an up-to-date version of Tailscale on OpenWRT

While the version of Tailscale that is available in the package manager will probably work, it's pretty out-of-date and old. It's probably best to to update to the latest version with known security vulnerabilities patched.

1. `ssh root@192.168.1.1`
1. `opkg update`
1. `opkg install tailscale`
1. If you're using OpenWRT 22.03 or later:
`opkg install iptables-nft kmod-ipt-conntrack kmod-ipt-conntrack-extra kmod-ipt-conntrack-label kmod-nft-nat kmod-ipt-nat`
`service tailscale restart`
- > OpenWrt 22.03 and later, use [nftables](https://openwrt.org/docs/guide-user/firewall/misc/nftables) (superseding iptables) as a backend to [firewall4](https://openwrt.org/releases/22.03/notes-22.03.0#firewall4_based_on_nftables). Tailscale alone is [unable to configure nftables automatically](https://github.com/tailscale/tailscale/issues/4086) and this prevents the tailscale daemon from initializing properly and forwarding traffic. Additional packages must be installed (OpenWRT versions 22 or 23)
>
> *-- https://openwrt.org/docs/guide-user/services/vpn/tailscale/start#iptables-nft_issue*
1. You will probably end up with an out-of-date old `tailscale version` -> `1.58.2`
1. `service tailscale stop`
1. In order to update on a storage constrained device (like my router), we need to go [through some steps](https://openwrt.org/docs/guide-user/services/vpn/tailscale/start#installation_on_storage_constrained_devices) ([more docs from Tailscale](https://tailscale.com/kb/1207/small-tailscale)). You can try running `tailscale update` to see if it will just work but chances are you will run out of disk space (don't forget to cleanup to free disk space after trying):
1. Run the following on your normal computer (not on the router): `git clone git@github.com:tailscale/tailscale.git` (https://github.com/tailscale/tailscale)
1. `git checkout v1.78.1`
1. Generate a combined binary that can act as `tailscale` and `tailscaled` (saves space): `env GOOS=linux GOARCH=arm go build -o tailscale.combined -tags ts_include_cli,ts_omit_aws,ts_omit_bird,ts_omit_tap,ts_omit_kube -trimpath -ldflags="-s -w" ./cmd/tailscaled`
- To find the relevant architecture we should compile for to set `GOARCH` appropriately:
```sh
$ opkg print-architecture
arch all 1
arch noarch 1
arch arm_cortex-a9_vfpv3-d16 10
$ uname -m
armv7l
```
- The [`tailscale/tailscale`](https://github.com/tailscale/tailscale) repo also includes a `build_dist.sh --extra-small` script to do the same thing but I'm not sure how to adjust the architecture with it.
- This produces a binary that is `du -hs tailscale.combined` -> `22M tailscale.combined`
1. Repack the binary to be even smaller: `upx --lzma --best tailscale.combined`
- This produces a binary that is `du -hs tailscale.combined` -> `5.4M tailscale.combined`
1. Copy the binary to the router: `scp -O ./tailscale.combined root@192.168.1.1:/tmp/tailscale.combined`
- We're using `scp -O` to use the legacy scp fallback mode since OpenWrt doesn't include `sftp-server`.
1. Back on the router, test that the binary runs and works:
```
$ /tmp/tailscale.combined --version
1.78.1-dev20241205
tailscale commit: c80eb698d5057b04d826b5ae2004d4c464ae28f6-dirty
go version: go1.23.1
```
1. Move the binary to its new home: `cp /tmp/tailscale.combined /usr/sbin`
1. Remove the old binaries: `rm /usr/sbin/tailscaled` and `rm /usr/sbin/tailscale`
1. Symlink the new binary to the proper names: `cd /usr/sbin` and `ln -s tailscale.combined tailscaled` and `ln -s tailscale.combined tailscale`
1. Verify that the new version is being used: `tailscale --version` and `tailscaled --version` should both print `1.78.1-dev20241205`
1. `service tailscale start`
1. `service tailscale status` -> `running`
- If you're seeing `Warning: client version "1.78.1-dev20241205-tc80eb698d-dirty" != tailscaled server version "1.58.2-1 (OpenWrt)"`, you probably just need to kill the old version that's running `ps | grep tailscale` and `kill` the process ID or just `service tailscale stop` -> `service tailscale start`

#### OpenWRT configuration part 1: Tailscale network interface - Get Tailscale access available in OpenWRT

We're going to create a new network interface that allows us to interact with Tailscale and our tailnet:

1. `service tailscale status` -> `running`
1. Run `tailscale up` and add the device to your tailnet
- If you're seeing `Warning: client version "1.78.1-dev20241205-tc80eb698d-dirty" != tailscaled server version "1.58.2-1 (OpenWrt)"`, you probably just need to kill the old version that's running `ps | grep tailscale` and `kill` the process ID or just `service tailscale stop` -> `service tailscale start`
1. To verify things are working, running `tailscale status` should show other device that are on the tailnet
1. Create a new unmanaged interface via LuCI (visit http://192.168.1.1): **Network** -> **Interfaces** -> **Add new interface**
- Name: `tailscale`
- Protocol: `Unmanaged`
- Device: `tailscale0`
1. Verify that the interface has your Tailscale address assigned: `ip address show tailscale0`
1. Create a new firewall zone via LuCI: **Network** -> **Firewall** -> **Zones** -> **Add**
- Name: `tailscale`
- Input: accept
- Output: accept
- Forward: accept
- Masquerading: on
- MSS Clamping: on
- Covered networks: `tailscale`
- Allow forward to destination zones: unspecified (leave blank)
- Allow forward from source zones: unspecified (leave blank, this will be filled in later)
1. Save & Apply
1. `tailscale up --exit-node= --exit-node-allow-lan-access=true`
- `--exit-node-allow-lan-access=true`: "Allow the client node access to its own LAN while connected to an exit node. Defaults to not allowing access while connected to an exit node." ([source](https://tailscale.com/kb/1241/tailscale-up))
- **Note:** "If you're using OpenWrt == 22.03 you will also need to specify `--netfilter-mode=off`. For versions 23+ do NOT include `netfilter-mode`." ([source](https://openwrt.org/docs/guide-user/services/vpn/tailscale/start#force_lan_traffic_to_route_through_exit_node))
1. If anything starts going wrong, you can run `tailscale down` to stop Tailscale. You can also go into the Tailscale admin console (https://login.tailscale.com/admin/machines) and remove your `openwrt` machine from the network.
- For example, when I was trying to figure everything out, I ran into an issue where I couldn't access the router anymore after running the `tailscale up` command with just the exit node specified. I was able to get access again by removing the router from the tailnet using the Tailscale admin console. Then finally figured out I needed `--exit-node-allow-lan-access=true` option to resolve that issue.

> [!WARNING]
>
> I still have a problem that whenever I use `tailscale up --exit-node= --exit-node-allow-lan-access=true`, my normal traffic on the other networks starts failing for half of the websites. Tailscale should only be affecting the specific Tailscale network when enabled but it seems like something is going wonky (probably DNS related) and affecting the whole device. Everything goes back to normal once I `tailscale down`.
>
> For example, here is a list of sites that do and don't work (not sure what the differentiator is):
>
> - :x:`github.com`, `reddit.com`, `discord.com`, `x.com`, `zig.news`
> - :white_check_mark: `google.com`, `ericeastwood.com`, `news.ycombinator.com`, `gitlab.com`, `matrix.org`, `tailscale.com`

References:

- As described in the Tailscale page in the OpenWRT docs: https://openwrt.org/docs/guide-user/services/vpn/tailscale/start
- Perhaps another way to configure this would be with an "app connector" which allow you to forward only specific domains to a node on the tailnet: https://tailscale.com/kb/1281/app-connectors

#### OpenWRT configuration part 2: Create a WiFi network that will forward all traffic to the exit node

Then we're going to create a new WiFi network that will forward all of the traffic through the Tailscale network interface:

1. Create a new device via LuCI (visit http://192.168.1.1): **Network** -> **Interfaces** -> **Devices** -> **Add device configuration...**
- Device type: `Bridge device`
- Device name: `br-tail`
- Bridge ports: unspecified (leave blank)
- Bring up empty bridge: checked ✅
1. Create a new network interface via LuCI: **Network** -> **Interfaces** -> **Add new interface...**
- Name: `TAIL` (TODO: better name?)
- Protocol: `Static address`
- Device: `br-tail`
- Click **Create interface**, then configure the rest of the details
- **General Settings** tab:
- IPv4 address: `192.168.77.1`
- (this is just an address that is separate from your other address ranges used for `lan` and other interfaces)
- IPv4 netmask: `255.255.255.0`
- **DHCP Server** tab -> **Setup DHCP Server**
- (the defaults should be fine)
- **Firewall Settings** tab
- Create / Assign firewall-zone: (leave blank for now but this will be `TailZone` once we create it below)
1. Create a new firewall zone via LuCI: **Network** -> **Network** -> **Firewall** -> **Zones** -> **Add**
- Name: `TailZone`
- Input: reject
- We don't expect any incoming traffic. Just devices going out onto the tailnet through the exit node.
- Output: accept
- We want our devices to be able to go out onto the tailnet through the exit node.
- Forward: reject
- Masquerading: off
- MSS Clamping: off
- Covered networks: `tail`
- Allow forward to destination zones: `tailscale`
- Allow forward from source zones: unspecified (leave blank)
1. Create some new firewall traffic rules via LuCI: **Network** -> **Firewall** -> **Traffic Rules** -> **Add**
- Name: `tailzone DHCP and DNS`
- Protocol: `TCP` and `UDP`
- Source zone: `TailZone`
- Destination zone: `Device (input)`
- Destination port: `53 67 68`
- Action: `accept`
1. Create a new WiFi network via LuCI: **Network** -> **Wireless** -> Click **Add** for the relevant radios (I created one for the 2.4 GHz (as `my_wifi_2g_tailnet`) and 5 Ghz (as `my_wifi_5g_tailnet`) radios)
- Mode: Access Point
- ESSID: `my_wifi_5g_tailnet`
- Network: `TAIL`
- Hide ESSID: unchecked
- WMM Mode: checked
- Wireless Security:
- Encryption: WPA2-PSK
- Cipher: auto
- Key: (pick a WiFi password)
- 802.11r Fast Transition: unchecked
- 802.11w Management Frame Protection: Disabled
- Enable key reinstallation (KRACK) countermeasures: checked
1. Save & Apply
1. You should now be able to connect to the `my_wifi_5g_tailnet` WiFi network and have all your internet traffic go through the exit node. Once connected, you can check that the public IP of your exit node is shown you search for "my ip" in your favorite search engine. You can also verify things are working by running `traceroute google.com` and seeing the Tailscale IP of the exit node in the second or so hop in the chain.

References:

- What we're doing here is essentially the same as setting up a guest network as described in [this video by OneMarcFifty](https://www.youtube.com/watch?v=UvniZs8q3eU). We're just forwarding the traffic to the `tailscale` interface instead of `wan`.
- The OpenWRT docs have a section on how to [*Force LAN traffic to route through Exit Node*](https://openwrt.org/docs/guide-user/services/vpn/tailscale/start#force_lan_traffic_to_route_through_exit_node) which is in the same vein of what we're trying to setup but instead of forcing our normal LAN traffic over the tailnet, we want to create a whole new separate network so you can choose. we can still have normal LAN traffic and then you can connect devices to the `my_wifi_5g_tailnet` WiFi network if you want to.

### Other references

- Hardware Haven - Tailscale on an OpenWRT router: https://www.youtube.com/watch?v=XGefV0Rf9QQ&t=1440s

No repository file or test is identified; start by locating the project's existing documentation structure and deciding which parts of this Tailscale/OpenWrt guide belong there. Done means the setup, exit-node, and router instructions are organized in the appropriate documentation and remain consistent with the linked references.

Written by the indexing model from the issue text.