---
layout: post
title: "Late to the Tailscale Party"
date: 2025-03-16
tags: ["Geek", "Networking"]
---

I have been hearing about [Tailscale](https://tailscale.com/) for a few years now. I think it was probably first on the [Accidental Tech Podcast](https://atp.fm) by [Casey Liss](https://www.caseyliss.com/2024/10/15/tailscale-example) and I honestly dismissed it as another one of his wild goose chases (see raspberry pi garage door sensor). But it has popped up more than once and I recently listened to an interview with Tailscale's Co-founder, [Avery Pennarun](https://stratechery.com/2025/an-interview-with-tailscale-co-founder-and-ceo-avery-pennarun/) on Stratechery that I found very interesting. His road to networking and computers felt very similar to mine although he obviously carried it quite a bit further by founding a company. I had been noodling with the idea of trying it for my use case and this pushed me over the edge.

I already have a very well developed home network so I am not the traditional user. I am some odd hybrid of a "personal" use case and a level of "business" complexity. I have two use cases that I currently use [OpenVPN](https://openvpn.net) for.

- Remote access for my and my wife's personal devices when we are outside the home. This is mostly to route internet traffic through our home connection when we are on untrusted network, but occasionally to access services hosted at home.
- To connect two servers that exist outside our home network to the home network for more secure and easy access.

Many people seem to use Tailscale to connect *all* of their devices. That was not of interest to me. I already have the physical network at home set up and segmented the way I want it and recreating that with the mesh network was of no interest to me (and would involve dozens of devices, not all of which are capable of running it). So my initial goal was to have a simpler to manage version of what I was doing with OpenVPN.

I chose to set up my [OPNsense](https://opnsense.org) router as the central node of the network and make it both a subnet router and exit node. The big change that I made from what it seems is a "standard" installation is normally an exit node will SNAT the packets going out so that they seem to be coming from the exit node. I am perfectly happy having the `100.0.0.0/8` addresses coming into my internal network. I want the tailnet to appear just as another segment to my network so that even non-Tailscale can send traffic to hosts inside the tailnet.

In order to do this, I configured the core router with:

{% highlight shell %}
tailscale up --snat-subnet-routes=false
{% endhighlight %}

Because Tailscale was no longer doing the SNAT, I also had to configure OPNSense to do the proper outbound NAT for anyone with those addresses. And I set up my DNS server to forward requests for hosts in my `ts.net` MagicDNS zone to the Tailscale DNS server `100.100.100.100`.

I set up the core router to also advertise several routes for my internal network (to subnets that I trust the clients to get to). When installing `tailscaled` on my two remote unix hosts I needed to explicitly tell them to use those routes via:

{% highlight shell %}
tailscale set --accept-routes=true
{% endhighlight %}

It took me less than a day of putzing with things occasionally to have it all set up. The "fixed" servers could talk to hosts in my local network. All the clients inside my network could talk to the hosts that were connected via Tailscale using their `100.0.0.0/8` addresses or MagicDNS names even though they dont have `tailscaled` running. And for remote access on my mobile devices, I set up the Tailscale app and they are able to connect and use my home network as an exit node.

Overall I am pleased with how easy it was to set this up. I was a little nervous of the security implications but was pleased to see the [Tailnet lock](https://tailscale.com/kb/1226/tailnet-lock) function that prevents unauthorized devices from being added to your network even if Tailscale is acting maliciously or compromised.

So far so good. I still need to see how well Tailscale can punch through restrictive networks to build tunnels. But happy so far.