Nice presentation. I think you could also mention and make this guide more inclusive, by showing the way to create split or full tunnels for the clients.
Thanks @MRPtech for such a useful video. It explained in exactly the right level of detail so I could get my Tailscale instance up and running in Proxmox, after previously struggling a bit with some of the steps needed. My only stumble was getting access to my LAN from my phone. It took me a while to realise that I needed to allow it to use the exit node. Then all worked perfectly!
Your welcome. Exit node will route all your traffic from your phone via your home network. Imagen it as VPN (Nord VM, Private Internet Access VPN and others). This is useful when you connected to public WiFi and all traffic goes from your phone back to your home network and then via ISP router to internet. I found this sometimes a bit slow as it need to go from my phone/laptop > home > router > ISP > internet If you want to access home network without Exit node, your tailscale instance at home can be converted into route-advertise node. Which makes that if you time local ip address for example 192.168.123.456 - tailscale will take that and push all traffic to your home network and everything else will go to World Wide Web.
Good point. I don't want to route internet traffic that way, just access those machines on my local network. So I guess I just need to use the advertise-routes argument and not the advertise-exit-node. I'm slowly beginning to understand it better. I hope!
Great tutorial, thanks a lot. I am unable to use Homekit Bridge with this setup. I enter the homekit pair code and it says unable to add accessories. What may be the problem?
Great video... thanks! Can you clear out something for me. Why do you need to SSH into that LXC container when you are already login on the terminal via proxmox?
Thank you so much for this excellent video. Worked like charm. For others, what I did not know is that you can access all remote IP's in that network directly from your computer if they are both connected to tailscale. Not sure what happens if both of the networks share the same IP range... but that is not the case for me.
What happened with your setup is "subnet advertising" Let's say you have two devices and they are 1000 miles apart. One is in Europe and another one in US. Both are connected to same Tailscale Tailnet. You have turned on in EUROPE server. that means that when you connecting from US to Europe server you can access not only Europe server but all other devices that are in same network as Europe server. I hope that make sense
He's asking what happens when both sides have the same network scheme, like 192.168.1.x on both sides. Can you still access or will you have to change one of the networks?
With your very food guide I was able to install tailscale in a Proxmox lxc. But how can I access my proxmox VM remotely? Es. In one VM I've installed home assistant and I would like to access It from my phone where I've installed tailscale.
You need to switch advertising-routes=A.B.C.0/24 inside that tailscale. And switch that option on in tailscale dashboard. Once you done that you can access all services that are in home network from you phone from anywhere in a world as long as you have tailscale running in your home lab and your phone.
Good video and step by step very informative. So, the video just seemed to finish. How do we actually connect to our different home machines from outside world?
Because tailscale lxc has subnet advertising on. using any other device with tailscale install and same account used to login you can access your local network devices from anywhere in the world. I have tailscale app on my phone. and used same account to login. now i can access home NAS from anywhere in the world because tailscale lxc has --advertise-routes ON
Dear Mr P: Can you provide the order of videos to have the ubuntu lxc template created and other settings needed to complete this tutorial? You mention that the ubuntu template was created in a previous video but I could not find it. Are you using a specific version of ubuntu 22.04, server or reguluar? Am I setting up the datacenter like you advise in your first proxmox video, to just have one pve and not local, local lvm and local network? You provide great content, just sometimes miss things that are crucial for us newbies. on another video I followed your guidance for a zfs cluster until I learned that my random old computer's mix of hardware could not run it- too late. Then I had to uninstall everything. It would be great to have some successes! thanks for doing this !
Hi, Setting up LXC Template : ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE--CtSNleMNfI.htmlsi=tsCuZ-URrQwKndxV If your setup has two drives inside, i suggest to remove Local-LVM and use 2nd drive to store your ISOs, Temaplate, VM Disks. 1st drive - leave that to Proxmox OS.
@@MRPtech Thanks. Got it up and running. For those other newbies there is a feature when you create an lxc that allows you to choose a template. I was under the impression that one had to be created, like in mr p's video in the proxmox playlist.
I can access the subroutes, however i cant connect to my truenas smb share? any settings I need to fiddle with in proxmox or the tailscale container to get it to work?
Open your tailscale console via Proxmox and check file /etc/ssh/ssh_config check if line bellow is active (remove # from the start of that line) PasswordAuthentication yes This way you will be able to ssh into Tailscale VM/LXC using username + password.
When i started to mess around with Proxmox, i used to install a lot of stuff directly to Proxmox HOST. And one day Proxmox stopped working. Was it because i installed other stuff on the HOST or something else ... don't know. Now i follow a rule - do not install anything on Proxmox HOST unless o have no other option. For example Zabbix - i had to install Zabbix agent on Proxmox host to monitor each node, for Tailscale - there is no extra benefits to have tailscale inside proxmox host compared to LXC.
Great video. I just have one question: at 08:16 do we need to add the advertise options everytime the server comes up or just for the first time? I get a warning message saying that UDP GRO forwarding is suboptimally configured on eth0. Thanks for this awesome step-by-step!
During first initial setup you need to put advertising tag. If you restar lxc container, tailscale automatically will enable advertising on. If you run command "sudo tailscale down" and later you want to turn it on by running command "sudo tailscale up" you will have to add advertising on again as inside your tailscale net this node will be with advertising flag which means you need to initiate advertising again. I hope all this makes sense :)
Hello, I have a question. I am new to proxmox, container and so on.... I am wondering, If I could run 2 stuff in the same container? I have one container with lxc "turnkey mysql" running And after I watched your video I have one container lxc "Tailscale" running Can I do one single container with both tailscale running and mysql running on it? And how do I do that?
If you want to have one LXC container with MySQL and Tailscale - i suggest to start with Ubuntu LXC container and install MySQL and Tailscale inside it. For more easier installation process i would go with Ubuntu Server VM.
@@MRPtech Oh, cool thanks, do I win something in resourses and so on to have one single container that manage small stuff like MySQL and Tailscale in the same container, or do I want separate containers for MySQL and Tailscale running?
1. With Wireguard for some reason i get slower speed connecting to server from outside home network. With tailscale i get close to full speed 2. Tailscale is based on wireguard so technically i am using wireguard.
I am using tailscale and its feature called "smart dns" which resolves all my local IPs in to hostnames. Alternative would be to use PiHole and its Local DNS option.
Why are you doing a static IP in the dhcp pool? Your DHCP server now may assign the same IP to another computer.... Instead do a DHCP static mapping on your DHCP server and apply your MAC address, or do a static IP in the LXC outside of your DHCP server pool range. IE 192.168.1.1/24 is your LAN. Setup your DHCP pool to be 192.168.1.100-254. That way you have ~99 IPs to use for static IPs depending on where your Gateway is (could be 1.1, could be 1.254 or anywhere in between)
Yes, you can do that. I set static IP in LXC config as it is much easier and same for everyone. I can't explain each and every router configurations and how to complete them. Plus - tailscale LXC container is my gateway to home network from outside and it is always running and Proxmox HA setup done. Maximum downtime 5 - 10 min. DHCP server will release IP to another device if Tailscale LXC container will end up offline for 15 days.
For some reason after following your guide, when I enable advertise-route from the admin panel of tailsce, my entire home network doesn't have a data connection anymore. When I disable advertise routes the devices on my network can connect to the outside Internet again. Very strange... Do you have any idea?
Great video and thanks for making it. I followed you video precisely and I even double checked my work and I cannot access the proxmox admin console remotely. I can access the tailscale lcx container via ssh. What am I missing? Thanks again.
1. Do you have subnet advertising active on tailscale node? 2. If subnet advertising active, did you approved that via tailscale admin dashboard for that node?
Hi, apt update // upgrade will do that for you. When you installing tailscale via command line, tailscale repo URLs added to a list of all the repos that apt update/upgrade need to do, tailscale will be one of them.
i followed the guide step by step but the tailscale doesn't work also kindly did u post the following video for the apps u mentioned at the end (remena guacamole?) 13:35
You need to install tailscale client on each device and login with same account to use DNS server. In my case i have local DNS server, this server IP is logged inside tailscale dashboard and any device (with tailscale client installed) hits that DNS server first before going to 1.1.1.1
@@MRPtech it doesn't make a "connection" it makes a tunnel and a virtual network between the server and one or several clients. It also can route traffic from and to the LAN. So i really don't get what else tailscale can do...
@@MRPtech also, wireguard is 100% private, yours, non internet or outside dependant. Everything i need to my wireguard to work is my own wireguard server... Nothing else. Is it ease of use? I can't see other reason really.
Can wireguard: a) allow me to connect to wireguard nodes via SSH using browser? b) allow me to expose service to a public via tunnel? c) give me split DNS feature? d) provide me with custome domain? for example ibis-galaxy.net ? e) provide me an easy way to setup ASL rules?
@@MRPtech I don't think you understand how it works really... Wireguard it's a VPN, same as tailgate. ASL rules, split DNS and all you mentioned are handled by the server at your home. It just routes traffic to the tunnel, what you do with that traffic is up tou you... You want to split DNS? Then you just have to config it as such... You can do anything you want as if the client was in LAN, that's the point. You basicaly deal with wireguard trafic as you would deal with a VLAN. So yes... You can do all that and more, depends on your setup.
Hi, I am facing this issue for " tailscale status # Health check: # - Some peers are advertising routes but --accept-routes is false" I cant ping the IPs from the routes IP range given in the LXC tailscale-up command.
1. Where is your main tailscale setup located? LXC/VM? 2. Which device you are using to try to ping local network IPs ? 3. Have you enabled "--advertise-routes=192.168.X.0/24" during first Tailscale run and turned on "IPV4 Forwarding" ?
@@MRPtech Hi, followed your guide. So I have it in an lxc. I am getting this message from a remote server with tailscale on it. That server still can't ping anything in 192.168.1.0/24.
@@MRPtech Ok, the solution was that on my other tailscale instances I had to spin down tailscale and bring them up with "tailscale up --accept-routes".
Because i want to give SSH access to ROOT user. If i leave that commented, root user can't connect via SSH, only normal users will. This is not recommenced. If someone will guess root password and gain access via SSH, they will have access to entire system. I done it just out of convenience and not necessity
Instead of using root you can login with normal user. If you don't have a user created: first - login as user and type adduser Finish setting this up, next you need to add user to SUDO group, command: usermod -aG sudo On next fresh USER login SUDO will be activated. Now you can SSH with user instead of ROOT. Suggestion - create SSH keys for better security.
to be honest ... i don't mind. As long as it works when i need to use it ... i am fine with that. Haven't said that, i am messing round with headscale - self-hosted tailscale server. This way i can host everything in my server, but at this moment i am not confident that i can do that fully and migrate all my connection to self-hosted state.
Got this setup and everything connected, but I can't seem to figure out how to get my phone to connect over my data. I think it's working as I'm able to access my VMs from other VLANs like IoT and Guest, but not when I disconnect from wifi. I'm running Arista NG Firewall (untangled) so not sure if maybe that could be blocking things.
@@MRPtech Fixed it! Turns out it doesn't work if you are using it as an exit node on data. Not sure if that is a bug or feature..still new to how all of this works haha
I finally was able to follow your video and setup Tailscale. Thanks a lot for this helpful video! I have a quick question btw, is router-advertising for the whole LAN devices a security concern? Let’s say I want to exclude one LXC from being exposed in Tailscale, is there any rule that I can set up? Many thanks!
Yes. but it is not that easy to tell in words. Basically - setting up Tailscale ACL security and assigning tags to your tailscale NODES. For example TAG_1 can only access TAG_2 and TAG_3 machines. if you LXC container is tagged with TAG_4 that makes it outside allowed list and can't be accessed. I am planning to get that video done over weekend in hope to be live by mid next week.
@@MRPtech Thank you, I ended up setting specific IP being exposed like this, tailscale set --advertise-routes=192.168.68.x/32,192.168.68.x2/32,192.168.68.x3/32
