Documentation
Tailscale VPN
Require: Symcon >= 7.1
This module offers the possibility to use Tailscale VPN on the SymBox.
This module is only available for the SymBox!
Range of functions
- Downloading and updating Tailscale VPN
- Authentication via Auth Keys
- Access via VPN to the SymBox (incl. SSH)
- Access to devices behind the SymBox (subnets)
- Activate/deactivate VPN via variable
- Activate VPN automatically when the SymBox starts
- Optional use of MagicDNS
Software installation
- Install the 'Tailscale VPN' module via the Module Store.
Set up the instances in IP-Symcon
- Under "Add instance" the 'Tailscale VPN' module can be found using the quick filter.
- Further information on adding instances in the Documentation of the instances
Set up Tailscale
- Create Auth Key: https://login.tailscale.com/admin/settings/keys
- Open Tailscale instance
- Press the buttons to download, install and start Tailscale.
- The authentication can then be carried out using the Auth Key created at the beginning. The Auth Key is no longer required afterwards and does not need to be saved anywhere.
The Tailscale binaries and the state (authentication, settings) are stored permanently under /mnt/data on the SymBox and survive a reboot.
- Switch the VPN in IP-Symcon off and on again.
- To access devices behind the SymBox, the "Advertise Routes" function must be set up
- To do this, enter the subnet e.g. 192.168.178.0/24 in the CIDR notation in the list and accept the configuration.
- The routes must still be activated in the Tailscale Dashboard. To do this, open the following page: https://login.tailscale.com/admin/machines
- Select the correct machine there, click Review and confirm the activation of the subnet.
Changes to the Advertise Routes are applied immediately as long as the Tailscale service is running. The tunnel does not need to be restarted.
MagicDNS
Tailscale can take over the DNS configuration of the SymBox (MagicDNS), so that other devices in the tailnet can be reached by name. Since MagicDNS occasionally breaks DNS resolution on the SymBox completely, this feature is disabled by default and should only be enabled via the "Use MagicDNS" option if required.
If name resolution on the SymBox stops working, disable the "Use MagicDNS" option and apply the configuration. Tailscale then restores the original DNS configuration.
Updating Tailscale
Each version of the module contains a fixed Tailscale version. If the installed version differs, an "Update" button is offered in the instance instead of the "Download" button. During the update, the tunnel and the service are stopped briefly and restarted automatically afterwards. The authentication is preserved.
Configuration page
| Name | Description |
|---|---|
| Activate VPN on startup | Starts the Tailscale service and the tunnel automatically after the SymBox has booted |
| Use MagicDNS | Allows Tailscale to take over the DNS configuration. Disabled by default, see section MagicDNS |
| Advertise Routes | Subnet to be shared in CIDR notation e.g. 192.168.178.0/24 |
Actions
| Name | Description |
|---|---|
| Download/Update | Downloads the Tailscale version matching the module, verifies its checksum and installs it |
| Start Service | Starts the Tailscale service (tailscaled). Only shown while the service is not running |
| Authenticate with Tailscale | Registers the SymBox in the tailnet using an Auth Key. Only shown while the SymBox is not authenticated |
| Start/Stop Tunnel | Establishes or disconnects the VPN connection. Equivalent to switching the "VPN" variable |
| Reset completely | Stops Tailscale and removes the binaries and all data including the authentication |
| Show Status (Debug) | Shows the complete status output of Tailscale for troubleshooting |
Status variables
| Name | Type | Description |
|---|---|---|
| VPN | Boolean | Switches the tunnel on or off. Synchronized with the actual state every 10 seconds |
| Status | String | "Connected!" while the tunnel is up. Otherwise the health messages from Tailscale (e.g. "Tailscale is stopped.") or the error of the last start |
Troubleshooting
- If starting the tunnel fails, the error message from Tailscale is shown in the "Status" variable and the "VPN" switch stays off.
- Every Tailscale call is logged to the debug window of the instance, including exit code and output.
- The module only manages the hostname, the Advertise Routes, accepting routes (always disabled) and MagicDNS. All other Tailscale settings, e.g. changed via SSH using
tailscale set, are preserved when the tunnel is started. - Tailscale can be removed completely via the "Reset completely" button. The SymBox then has to be authenticated again.