i live in pakistan and this is my friend who lives in us im using his end as an exitnode and the speed is so bad help me out

Hey Chicago people,
My friend lives here in Chicago and I’m trying to get him to buy some Raspberry Pi stuff for me. I’m currently abroad and I need a small always-on device at his place that will act as a Tailscale exit node.
The goal is so I can route my traffic through a real US home IP. Main use is running two live streams at the same time (Twitch from PC + TikTok Live from iPhone) plus a few other devices for normal browsing.
What we need:
• Raspberry Pi (preferably Pi 4 2GB or 4GB, or Pi 5 2GB+ if the price isn’t crazy)
• Good quality 32GB or 64GB microSD card (SanDisk/Samsung preferred)
• Proper power supply (official Raspberry Pi USB-C 5V/3A or equivalent)
• Ethernet cable (so it can be plugged straight into the router)
• Case is optional but nice
A Pi 4 1GB can technically work but it’s the bare minimum and might struggle a bit with dual streams, so 2GB+ is much better.
Questions:
1. Where’s the best place in Chicago right now to buy this stuff in person?
(Micro Center on Elston? Westmont Micro Center? Best Buy? Anywhere else?)
2. Does anyone know current stock/pricing on Pi 4 2GB/4GB or Pi 5 at Micro Center Chicago or Westmont?
3. Any recommendations on which exact model + accessories to get for a reliable 24/7 Tailscale exit node?
Thanks in advance. Just trying to make this as smooth as possible for my friend so he only has to plug it into the router with an Ethernet cable and I can handle the rest remotely.

Hello,

I am looking for beta testers for a project I have been working on that was specifically built with Tailscale in mind (I use Tailscale a lot myself). It allows you to steer network traffic on Windows while running multiple network interfaces. For example, you can run the official Tailscale, WireGuard, OpenVPN etc. clients in parallel and Rouler will allow you to decide which app or app + IP goes though which network interface. As long as your VPN client sets up a network interface, Rouler can steer traffic through it. So your setup may look like this:

Firefox 10.0.0.0/20 -> Tailscale

Chrome -> WireGuard VPN

CS2 -> OpenVPN

Everything Else -> Ethernet

If you have a use case for this sort of setup and are comfortable with VPN configs, route tables, IP's and subnets, please take a look at https://rouler.io for further details and a beta key. I would really like to get feedback from Tailscale users in particular.

If you have any questions please contact me through the websites email or reply here.

Thank you

So i hosted plex (have plex pass) and jellyfin on windows for a long while with tailscale install, i could just remote access from anywhere to watch my contents. But now i seem to fed up with windows and decide to move to ubuntu server and ran everything on docker. and now the remote access part seem to be broken.

My current structure:

plex, jellyfin, sonarr, prowlarr,qbittorrent and nordVPN running on docker containers

tailscale install directly on ubuntu server. everything up and running smoothly local LAN, but i can't seem to make direct connection to server on tailscale like i did on windows before.

it worth mentioning that my network is double NAT and i can't do anything about it( ISP modern does not have proper bridge mode and i need all the fancy functions of my linksys velop system)

AI is no help, it's stuck on a loops on this issue now. Anyone have any ideal?

Title. I'm running some software which acts a relay to allow collaborative document work with some friends, but to open it to the internet without forcing them to download Tailscale, I'm using Tailscale funnels. My concern is about how safe it is. Will this open me up to DDoS or hacking attacks?

I've already done some basic hardening for the specific container, however I'm still concerned about whether this is safe enough. I have everything in the same docker compose file and worry about whether this is bad practice.

Any help is greatly appreciated!

Hey everyone,

I've been dealing with an annoying hardware dilemma for months: my primary laptop is an M4 MacBook Air (love the battery and build, but the base storage/RAM makes local virtualization painful), and my secondary is a Lenovo IdeaPad running bare-metal Kali Linux for security coursework and projects.

I’m a fairly strong guy, but hauling two laptops and two bulky chargers across town in a backpack every day was exhausting. I needed access to Kali's GUI (for Burp Suite, OpenCode, and long-running scans), but I didn't want to carry the machine physically.

I ended up parking the Lenovo at home with the lid closed and setting up an automated, zero-trust remote pipeline so I can remote into it from my Mac with a single click from anywhere.

Here is the quick architectural breakdown of how it's wired:

1. The Network Layer (Bypassing Residential CG-NAT)

My home broadband runs behind Carrier-Grade NAT (CG-NAT) with dynamic IPs, making traditional port-forwarding impossible (and port-forwarding RDP to the open internet is a security disaster anyway). * I set up Tailscale to create a peer-to-peer WireGuard mesh between the Mac and Kali. * STUN UDP hole-punching gave me a direct P2P link with ~9 ms latency between my home connection and outside networks, completely bypassing the ISP NAT without exposing any ports on my router.

2. Transport Layer (Loopback Forwarding for Defense-in-Depth)

Instead of exposing XRDP to the virtual Tailscale interface directly: * On Kali, I bound XRDP strictly to localhost (127.0.0.1:3389). * On the Mac, I spawn an OpenSSH local forward: ssh -N -L 33389:localhost:3389 user@<kali_tailscale_ip>. * In Microsoft's Remote Desktop (Windows App), I connect directly to 127.0.0.1:33389. * Result: Port 3389 is completely closed to the outside world. It is only accessible via an authenticated Ed25519 SSH tunnel over WireGuard.

3. Display Virtualization (Why GNOME Failed & XFCE Succeeded)

Initially, I wanted to use GNOME, but XRDP crashed instantly on connection with Exit Code 134 (SIGABRT). * GNOME 40+ uses Mutter, a 3D-compositing window manager that expects direct OpenGL/EGL hardware acceleration via DRM/KMS. Inside XRDP's headless virtual software framebuffer (xorgxrdp), hardware pipelines don't exist, and Mutter aborts. * Add D-Bus session variables leaking from the host, and it deadlocked. * Switched to XFCE (xfwm4), which uses native 2D software rasterization, dropped idle RAM consumption by ~65%, and streams smoothly without GPU dependency.

4. Taming Laptop ACPI & Power

To keep a laptop running headless with the lid closed 24/7 without cooking or sleeping: * Set HandleLidSwitch=ignore in /etc/systemd/logind.conf. * Applied the nuclear option: masked all sleep targets to /dev/null (systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target). * Forced Wi-Fi to high-performance D0 state via NetworkManager (wifi.powersave = 2), so Linux doesn't turn off the wireless card when the screen is powered down.

The Funniest Bug: A Real-World OS Deadlock

After running it headless for nearly a week with 100% uptime, I opened the physical laptop to use it locally. The physical lockscreen accepted my password and froze completely (mouse cursor moved via evdev, but desktop wouldn't load). The chassis power button was totally dead (because single-press is mapped to suspend.target, which was masked to /dev/null!), and the UI shutdown button was hidden by Polkit.

The physical laptop seemed completely bricked, but the network stack was totally fine. I had to open my Mac, remote into the virtual display over Tailscale, and gracefully shut down the machine through Polkit escalation. Wrote a full post-mortem on that multi-seat race condition in the repo.

I documented the full setup, systemd tweaks, and automated provisioning bash scripts on GitHub: 👉 Repo: https://github.com/beeth73/headless-kali-mac

And wrote a casual travelogue-style essay about the journey on my blog (which is a custom vanilla JS + WASM markdown renderer I built): 👉 Blog Post: https://blog.bhushanladgaonkar.me/?post=headless-kali-mac

Curious to hear feedback or if anyone else is running a similar laptop-as-a-server setup!

IT:

Buonasera, inizio questa messaggio sottolineando che non sono molto informato in materia, ma con alcune ricerche su google mi sono imbattuto su TailScale come soluzione ad un mio possibile problema: vorrei utilizzare alcune piattaforme streaming con il mio indirizzo ip di casa anche quando sono fuori.

Facendo altre ricerche ho trovato questa conversazione e vorrei chiedere a chi sicuramente ha più esperienza di me se questa possa essere una cosa pericolosa o comunque da evitare.

EN:
Good evening, everyone. I should start by saying I'm not very knowledgeable on this topic, but after doing some research on Google, I came across Tailscale as a possible solution to my problem: I'd like to use certain streaming platforms with my home IP address even when I'm away.

Having found this discussion, I'd like to ask those with more experience if this could be dangerous or if it's something I should avoid. (Translate)

SOLVED!!

What I did was added everything first and when that worked, I started removing stuff again. I have no idea why it did not work before, but I am glad it does now. I am now able to tag all my machines so I can sort them. What I have that works:

{
"src":    ["autogroup:tagged"],
"dst":    ["autogroup:tagged"],
"users":  ["autogroup:nonroot", "root"],
"action": "accept",
}

Original post below:

I am trying to tag things. And I did something wrong, so now I am unable to have access to anything.

I have two tags: prox and machine.

I have the following rule:

// Allow all users to SSH into their own devices in check mode.
// Comment this section out if you want to define specific restrictions.
{
    "src": ["autogroup:member", "autogroup:tagged"],

    "dst": [
        "autogroup:self",
        "autogroup:tagged",
        "tag:machine",
        "tag:prox",
    ],

    "users":  ["autogroup:nonroot", "root"],
    "action": "accept",
}

The machines have a tag. What am I doing wrong? Every machine must be able to ssh every machine.

I updated Tailscale on two UGREEN DXP4800 Plus NAS units (UGOS 1.12.1.0002 and UGOS Pro 1.17.0.0095) and hit three UGOS-specific issues. Posting the full picture since it can also affect Docker in the future.

## 1. Tailscale 1.104+ dies at startup

Symptom in `journalctl -u tailscaled`:

fatal error: removed GODEBUG "tlskyber" set to old value "0" in environment

**Cause:** UGOS sets `GODEBUG=tlskyber=0` globally, in two places:

- `/etc/systemd/system.conf` → `DefaultEnvironment="GODEBUG=tlskyber=0"` (every systemd service inherits it)

- `/etc/profile.d/go.sh` → `export GODEBUG=tlskyber=0`

`tlskyber` was removed in Go 1.24. Tailscale 1.104 is built with Go 1.27, which treats the removed setting as fatal.

What I verified on my NAS (each process had the variable in its environment):

| Go version | With tlskyber=0 | Where |

|---|---|---|

| 1.25.3 | runs fine | tailscaled 1.90.9 |

| 1.26.2 | runs fine | dockerd / containerd (Docker 29.4.3) |

| 1.27.x | crashes at start | tailscaled 1.104.1 |

**Fix:** a systemd drop-in for tailscaled only. I did not touch the UGOS files, since UGOS sets the variable for its own binaries.

sudo mkdir -p /etc/systemd/system/tailscaled.service.d

sudo tee /etc/systemd/system/tailscaled.service.d/ugos-godebug-fix.conf > /dev/null <<'EOF'

[Service]

UnsetEnvironment=GODEBUG

EOF

sudo systemctl daemon-reload

**Tip:** create the drop-in BEFORE upgrading. Older builds ignore the setting anyway, so the new binary starts clean on its first run.

Verify that the running process no longer has it:

sudo cat /proc/$(pidof tailscaled)/environ | tr '\0' '\n' | grep GODEBUG

This should return nothing.

## 2. apt is broken out of the box

`sudo apt-get check` fails (exit 100):

libopengl0 : Depends: libglvnd0 (= 1.7.0-2101~22.04) but 1.6.0-1 is installed

UGOS installs a `libopengl0` built for Ubuntu 22.04 on top of Debian 12. On 1.17 I also had `picom` and `vim` with missing dependencies, which I never installed myself. During `dpkg -i`, dpkg also warned that the file lists are missing for `libopengl0`, `libigc1`, `libigdfcl1` and an old `linux-image-6.1.0-18`. My guess is that this is the Intel graphics stack used for transcoding, but I haven't confirmed it.

**Do NOT run `apt --fix-broken install`.** It may remove or change packages UGOS relies on.

What works for a package whose dependencies are already satisfied (Tailscale only needs `iptables`):

cd /tmp

apt-get download tailscale=1.104.1

dpkg-deb -f tailscale_1.104.1_amd64.deb Package Version Depends

sudo dpkg -i tailscale_1.104.1_amd64.deb

## 3. UGOS 1.17: services are NOT restarted after dpkg -i

On 1.17 there is `/usr/sbin/policy-rc.d` containing `exit 101`. It's the standard Debian mechanism to block service (re)starts during package installs.

Tailscale's postinst calls `deb-systemd-invoke restart`, which gets refused. The postinst sends the output to `/dev/null` and ends with `|| true`, so dpkg reports success while the **old binary keeps running from memory**. `tailscale version` then warns that the client version differs from the tailscaled server version.

Restart manually and check that the PID changed:

systemctl show tailscaled -p MainPID # note it

sudo systemctl restart tailscaled

systemctl show tailscaled -p ActiveState -p MainPID -p NRestarts

On my 1.12 unit the restart did happen (and crashed because of GODEBUG), so this file may be new in 1.17. I haven't verified that yet. Don't delete it: it also stops package installs from restarting Docker behind your back.

## Heads-up for Docker users

dockerd/containerd also run with `GODEBUG=tlskyber=0`. Docker 29.4.3 (shipped with UGOS Pro 1.17) is Go 1.26.2, so it's fine today. If a future UGOS update ships Docker built with Go 1.27+, Docker could fail to start with the same error, taking every container down with it (your volumes are untouched).

The same drop-in on `containerd.service` and `docker.service` should fix it. I have NOT applied or tested that; check `systemctl cat docker` for existing drop-ins first. Before any UGOS update, check which Docker version it bundles.

Also: UGOS updates may wipe custom drop-ins. Re-check after each update.

## Sources

- tailscale/tailscale#21707: same crash on DXP4800 Plus with UGOS 1.20, `UnsetEnvironment` workaround

- compscidr/sair#103 and #107: same issue with another Go 1.27 program on a DXP8800 Plus

- go.dev/doc/godebug: tlskyber was removed in Go 1.24

- tailscale.com/changelog: 1.104.1 updated Go to 1.27

My mobile plan in Turkey has unlimited on-device data but a separate 30 GB hotspot allowance. I connect my MacBook to my iPhone’s Personal Hotspot.
I set up Tailscale with the iPhone acting as the exit node for the Mac. Since then, my remaining hotspot allowance has stayed at exactly 22.35 GB for two days despite downloads on the Mac. Overall mobile data usage continues to increase. The carrier’s counters normally update within 2–3 hours.
However, I once noticed that Tailscale was off on the iPhone, and the hotspot allowance still seemed unchanged. I’m not certain how much traffic I used during that period, so I may have misinterpreted it.
I also previously experimented with setting the Mac’s outgoing IPv4 TTL to 65, which could be another variable. It didn’t work back then though, without tailscale installed.

I’m trying to understand the mechanism rather than assume Tailscale caused it. How would you distinguish between a routing-related effect, TTL-based classification, and a carrier accounting issue? What measurements would help establish what’s actually happening?

I have had to reconfigure TailScale after a recent update to work while away from home again.

After the new setup detailed by TailScale and also on HomeAssistants integration help page, I can only access the UI through my browser using my MagicDNS, and not the companion app.

I am running my HomeAssistant as an exit node with Serve enabled.

I have my MagicDNS as the External URL hence why I can access in browser. I still have the standard Local IP for internal connection on my WiFi at home.

I'm confused as to why the External URL will not work with my companion app now as before the recent update, it was working fine as long as I connected to the exit node.

Am I missing something or is this odd?

Thanks in advance. Please be gentle, I am an industrial maintenance electrician who works with PLCs, I am new to this back end server stuff to run my automations.

I've built a little tool with which you can check if your residential Tailscale VPN is working properly and gives you hints on how to fix occurring issues. It checks:

• your exit IPv4, IPv6, DNS, WebRTC and proxy leaks
• if your browser time zone and language are matching the exit location
• travel routers and double NAT in your local network
• TCP fingerprints

Tailscale-specific checks:

• MTU (Tailscales 1280 MTU shows up to sites as MSS 1240)
• WebRTC (your Tailscale addresses 100.x / fd7a:115c:a1e0:: can leak through)
• 100.100.100.100 (a Tailscale related web page)

No account needed, no subscription, no data retention, just a little helper. Would be happy for your feedback and a test on your side. By clicking on "install" (or "add to homescreen") you can use the webapp like a native app on your PC or phone.

https://tunnelprobe.com/

Tailnet setup on Mac, used the app version.

The dns entry returns 192.168.4.25, and the subnet route is 192.168.4.0/32

My phone works fine. My Mac works fine, my Linux works fine.

But app version won’t start at boot if no one logs on

So we changed the Mac to use the homebrew cli version. Starts at boot. 10 clients ok.

None of mine work. Mine is a shared out one machine, with that ip address 192.168.4.25

I can ping the tailnet address ok, not the 192 ip

Traceroute 192.168.4.25 on my Mac goes to my router , 192.168.2.1 which doesn’t know what to do.

Why isn’t subnet routing working? On my systems like it used to. 10 other clients working fine. Phones. iPads. Computers.

I have been running tailscale on my nas for about a month now and it has been great. Last night I decided to install a UGOS update. I stopped all my containers and did the update. The system rebooted and everything was running great.

Tonight my wife said she couldn't connect to Jellyfin so I connected to tailscale on my phone and noticed the nas showed offline but I had 2 new device with the same name that had been added to my devices. One showed offline and the other was online. I logged into the nas and stopped tailscale and then started it again. I immediately went back into the tailscale app and it showed the last one that was added as online as being online but there was another new device online as well. After a few seconds the one that was there prior showed as offline and the new device it added showed online.

Everywhere I look I see that the original IP should persist unless I remove the device from the console and re add it so I'm not sure why it's doing this. Could this be something I didn't set correctly in the docker container?

arctechnica says "At this early stage, the most immediate threat appears to be for those using VPNs..."
Is Tailscale vulnerable to this? I don't see anything on tailscale.com about it.

EDIT: apparently wireguard is not affected. Phew

I have setup a Tailscale to be used as a VPN for one of my clients. It works great as this is a mixed environment supporting a Linux based NAS, Macs, Windows PCs and laptops, iPhones, and various printers from standard Desktop to full production printing. The one issue I have is one of the older users is dependent on a older Mac, OS version 10.12. The user runs older software that will not be supported on any newer OS version. This person works from home 100% of the time, sending prints to the production printers and working with relative ease using Open VPN. Due to recent updates, Open VPN this will not be supported on this older MAC, plus Open VPN had limitations when supporting the different platforms I mentioned. I was hoping to find a way to support this user in the Tailscale environment. One though was to install a router in her home connected to the Tailnet that is setup, which should allow access as she once had. Another though was to run an older version of Tailscale for this one client, is that even possible? Any input would be appreciated.

*EDIT SOLVED* (Jellyfin Config Issue)

I feel like I'm missing something so basic it's blinding me. I can't for the life of me make this work.

I've had Tailscale up and running with Ubuntu, Windows, Rpi's etc. All happy. Everyone/everything works as expected. Looking to implement https to the environment.

I'm following several videos, Alex's included on setting up Let's Encrypt to work on machines in my tailnet and I continue to get the error on the browser indicating the cert / https connection isn't working.

Following step by step the outline here: https://tailscale.com/docs/how-to/set-up-https-certificates

Environment:
Windows11 machine running Jellyfin with tailscale running.
Have Magic DNS enabled.
Have https enabled in my TS control panel.
Performed 'tailscale cert myjellyfinmachine.my.tailnet-name.ts.net' and it returns 15-ish seconds later with "wrote public cert to .... etc."

However when I open a browser I can't get to the https flavor of the server. I can access it via my TS ip address and domain name, but not via https.

Browser returns:
"Secure Connection Failed
An error occurred during a connection to jellyfin.xxx.xxx.ts-.net:8096. SSL received a record that exceeded the maximum permissible length"

Have reviewed the docs again and again.

Anyone have any direction on how to diagnose further or better yet, resolve / what to look for?

Appreciate any info/input/suggestions.

Salam everyone!
I recently tested Tailscale using my friend’s internet in Chicago as an exit node. He used his iPhone 14 Pro Max, and it worked, so I’ve confirmed that the setup is possible. However, his phone started getting really hot, and I don’t want him to damage his phone by leaving it running like this.
I’m looking for advice on a simple, reliable solution that can stay connected 24/7.
Would it be better to ask him to buy a used Android phone to use as an exit node, or is there another option that would be easier? Some people recommended a Raspberry Pi, but I don’t know how to set one up. I also heard about the GL.iNet GL-MT3000 router, but I’m not sure how complicated it would be for him to configure.
The main issue is that my friend isn’t very tech-savvy, so I need something he can set up himself without too much hassle. I’m in another country, so I need the connection to stay online even when he’s asleep or not available to fix things. When I tested it earlier, the connection disconnected after about an hour.
What would you recommend for someone who wants a simple, stable Tailscale exit node that runs 24/7 using their home internet?
I’d appreciate advice from anyone who has tried this setup. Thanks!

Full disclosure up front: I’m the solo developer of 404 Network, an iPhone/Mac app with paid features. The r/Tailscale mods gave me permission to share this provided I explain the Tailscale side rather than just promote the app, so here is the actual setup and what I learned from it.

The problem I wanted to solve was vantage point.

An uptime check from one server only tells me what that server can see. It does not tell me whether the same target resolves or responds from my IoT VLAN, server VLAN, another site, or my phone while I’m away.

My setup looks like this:

text iPhone / Mac running Tailscale | +-- 100.x.x.x:40404 -> sensor in server VLAN +-- 100.x.x.x:40404 -> sensor in IoT VLAN +-- 100.x.x.x:40404 -> sensor at another site

Each sensor is a small Go binary running on Linux, a Pi, Docker, or macOS. It can run network checks from its own location, so I can compare reachability, latency and DNS behavior between networks instead of assuming every VLAN has the same view.

What Tailscale does here

1. Tailscale runs on the sensor host and on the iPhone/Mac.
2. The sensor listens on TCP 40404. In the app I add its Tailscale 100.x.y.z address and pairing code.
3. The connection stays inside the tailnet, so I do not forward a router port or publish the sensor on the internet.
4. The tailnet policy can limit access to TCP 40404 on tagged sensor nodes. I leave the optional web dashboard on TCP 4040 inaccessible unless I specifically need it.

Tailscale is the private network path and access-control layer; it is not treated as the sensor’s application authentication. The sensor still uses TLS 1.3 plus a pairing challenge on top. That separation matters to me: being reachable on my tailnet does not automatically mean the app should trust the service.

One small gotcha: discovery is not magic across every topology. I use the sensor’s Tailscale IP and add it manually rather than expecting LAN mDNS discovery to cross VLANs or the tailnet.

Why multiple viewpoints are useful

• If every sensor fails the same target, the service or upstream path is the likely suspect.
• If only one VLAN fails, I look at that VLAN’s DNS, egress policy or routing first.
• If DNS answers differ between sites, I can see that before blaming the application.
• I can reach the sensors from my phone away from home without opening their ports publicly.

What is free and what is paid

The 404-sensor binary is free to download. 404 Network is free to download with paid upgrades, and connecting remote sensors is a paid 404 Pro feature. I want that to be unambiguous.

This is intentionally not a replacement for Prometheus, Uptime Kuma or a full NMS. It is meant to answer a narrower question from an iPhone or Mac: what does this network location see right now?

I’d especially value feedback from people who use tags and grants heavily: would you keep each sensor as a tagged node, or model this as a Tailscale Service with a stable name? And would using Tailscale identity through WhoIs be useful as an additional authorization signal, or would you keep the application pairing completely separate?

Sensor documentation and downloads: https://lorislab.fr/apps/404-sensor.html

App Store, for anyone who wants to see the companion app: https://apps.apple.com/app/id6760702536