25 minutes ago, ulischultz said:

Settings Tailscale state dir to: /config/.tailscale_state
Enabling userspace networking! Tailscale DNS not available
Setting host name to "AdGuard"
Starting tailscaled with log file location: /var/log/tailscaled
Starting tailscale

Did you also enable to use the container as exit node? I don't see that in your log:

I get this errors in the log now...

 

Executing Unraid Docker Hook for Tailscale

Detecting Package Manager...
Detected Alpine Package Keeper!
Installing packages...
Please wait...
ERROR: Installing packages!
fetch https://dl-cdn.alpinelinux.org/alpine/v3.18/main/x86_64/APKINDEX.tar.gz
WARNING: updating and opening https://dl-cdn.alpinelinux.org/alpine/v3.18/main: temporary error (try again later)
fetch https://dl-cdn.alpinelinux.org/alpine/v3.18/community/x86_64/APKINDEX.tar.gz
WARNING: updating and opening https://dl-cdn.alpinelinux.org/alpine/v3.18/community: temporary error (try again later)
4 unavailable, 0 stale; 20 distinct packages available
fetch https://dl-cdn.alpinelinux.org/alpine/v3.18/main/x86_64/APKINDEX.tar.gz
WARNING: updating and opening https://dl-cdn.alpinelinux.org/alpine/v3.18/main: temporary error (try again later)
fetch https://dl-cdn.alpinelinux.org/alpine/v3.18/community/x86_64/APKINDEX.tar.gz
WARNING: updating and opening https://dl-cdn.alpinelinux.org/alpine/v3.18/community: temporary error (try again later)
ERROR: unable to select packages:
  jq (no such package):
    required by: world[jq]
  wget (no such package):
    required by: world[wget]
ERROR: Unraid Docker Hook script throw an error!
       Starting container without Tailscale!

Starting container...

=======================

2 minutes ago, ulischultz said:

       Starting container without Tailscale!

Please post your docker run command and a screenshot from your Docker template.

19 minutes ago, ulischultz said:

ERROR: Installing packages!

This indicates a issue with your network.

I assume you just set "Be a Tailscale Exit Node" to Yes just now, correct?

 

Make a dummy change by changing one field and back again to be able to click Apply again.

 

However I think you are running in a DNS issue because your AdGuard is not running when it tries to update and grab the packages which are needed for Tailscale.

 

What DNS servers are set on your Unraid Server, I assume you are using AdGuard...

Please do keep in mind that you should always use a DNS Server for your Unraid server without AdBlocking in front of it since you will run into such issues.

I would recommend that you set the DNS from Unraid manually to something you are comfortable with like 1.1.1.1 or 8.8.8.8 or the DNS server from your provider since Unraid needs unrestricted access to the Internet.

Yes, I used the adguard container as DNS also for unraid.

Changed that to 1.1.1.1 now.

 

Disabled "Be a Tailscale Exit Node" in the container setup.

 

Still same problem:

 

Executing Unraid Docker Hook for Tailscale

Detecting Package Manager...
Detected Alpine Package Keeper!
Installing packages...
Please wait...
ERROR: Installing packages!
fetch https://dl-cdn.alpinelinux.org/alpine/v3.18/main/x86_64/APKINDEX.tar.gz
WARNING: updating and opening https://dl-cdn.alpinelinux.org/alpine/v3.18/main: temporary error (try again later)
fetch https://dl-cdn.alpinelinux.org/alpine/v3.18/community/x86_64/APKINDEX.tar.gz
WARNING: updating and opening https://dl-cdn.alpinelinux.org/alpine/v3.18/community: temporary error (try again later)
4 unavailable, 0 stale; 20 distinct packages available
fetch https://dl-cdn.alpinelinux.org/alpine/v3.18/main/x86_64/APKINDEX.tar.gz
WARNING: updating and opening https://dl-cdn.alpinelinux.org/alpine/v3.18/main: temporary error (try again later)
fetch https://dl-cdn.alpinelinux.org/alpine/v3.18/community/x86_64/APKINDEX.tar.gz
WARNING: updating and opening https://dl-cdn.alpinelinux.org/alpine/v3.18/community: temporary error (try again later)
ERROR: unable to select packages:
  jq (no such package):
    required by: world[jq]
  wget (no such package):
    required by: world[wget]
ERROR: Unraid Docker Hook script throw an error!
       Starting container without Tailscale!

Starting container...

=======================

2024/12/19 13:25:29.987164 [info] AdGuard Home, version v0.107.55
2024/12/19 13:25:29.992691 [info] tls: using default ciphers
2024/12/19 13:25:30.005301 [info] Initializing auth module: /opt/adguardhome/work/data/sessions.db
2024/12/19 13:25:30.005464 [info] auth: initialized.  users:1  sessions:4
2024/12/19 13:25:30.005469 [info] web: initializing
2024/12/19 13:25:30.100838 [info] dnsproxy: upstream mode is set mode=parallel
2024/12/19 13:25:30.100849 [info] dnsproxy: cache enabled size=4096
2024/12/19 13:25:30.100853 [info] dnsproxy: max goroutines is set count=300
2024/12/19 13:25:30.100874 [info] dnsproxy: cache ttl override is enabled min=600 max=10800
2024/12/19 13:25:30.100876 [info] dnsproxy: ratelimit is enabled rps=100 ipv4_subnet_mask_len=24 ipv6_subnet_mask_len=56
2024/12/19 13:25:30.100878 [info] dnsproxy: server will refuse requests of type any
2024/12/19 13:25:30.100881 [info] dnsproxy: upstream mode is set mode=parallel
2024/12/19 13:25:30.100883 [info] dnsproxy: cache enabled size=990000000
2024/12/19 13:25:30.100885 [info] dnsproxy: max goroutines is set count=300
2024/12/19 13:25:30.100991 [info] addrproc: processing addresses
2024/12/19 13:25:30.101395 [info] AdGuard Home is available at the following addresses:
2024/12/19 13:25:30.101480 [info] go to http://127.0.0.1:80
2024/12/19 13:25:30.101483 [info] go to http://[::1]:80
2024/12/19 13:25:30.101484 [info] go to http://192.168.2.10:80
2024/12/19 13:25:30.805480 [info] dnsproxy: starting dns proxy server
2024/12/19 13:25:30.805497 [info] dnsproxy: creating udp server socket addr=0.0.0.0:53
2024/12/19 13:25:30.805547 [info] dnsproxy: listening to udp addr=[::]:53
2024/12/19 13:25:30.805553 [info] dnsproxy: creating tcp server socket addr=0.0.0.0:53
2024/12/19 13:25:30.805570 [info] dnsproxy: listening to tcp addr=[::]:53
2024/12/19 13:25:30.805609 [info] dnsproxy: entering udp listener loop addr=[::]:53
2024/12/19 13:25:30.805786 [info] dnsproxy: entering listener loop proto=tcp addr=[::]:53
 

7 minutes ago, ulischultz said:

Yes, I used the adguard container as DNS also for unraid.

Changed that to 1.1.1.1 now.

Ah okay, my fault...

Sorry...

 

I see now that you are using a dedicated IP for the container and this will mean that it get the DNS from your router which is probably set to AdGuard too correct?

 

May I ask what you want to achieve anyways? Do you want to have AdGuard as a DNS provider or do you want to use AdGuad as a exit node?

 

You can tell the container to use also a dedicated DNS server by adding:

--dns=1.1.1.1

to the Extra Parameters (with advanced view enabled), if you add that then it should work.

 

This setup is pretty complicated since you run into multiple chicken egg problems...

Yes, the router also uses AdGuard as DNS.

Changing to dedicated DNS for the adguard container worked.

Was able to authenticate the container in tailscale now.

 

But now this is the log:

 

xecuting Unraid Docker Hook for Tailscale

Detecting Package Manager...
Detected Alpine Package Keeper!
Installing packages...
Please wait...
Packages installed!
Tailscale not found, downloading...
Please wait...
Download from Tailscale version 1.78.1 successful!
Installation Done!
Settings Tailscale state dir to: /opt/adguardhome/work/.tailscale_state
Enabling userspace networking! Tailscale DNS not available
Setting host name to "AdGuard"
Configuring container as Exit Node! See https://tailscale.com/kb/1103/exit-nodes
Starting tailscaled with log file location: /var/log/tailscaled
Starting tailscale
Some peers are advertising routes but --accept-routes is false
ERROR: Enable MagicDNS and HTTPS on your Tailscale account to use Tailscale Serve/Funnel.
See: https://tailscale.com/kb/1153/enabling-https
ERROR: Unraid Docker Hook script throw an error!
       Starting container without Tailscale!

Starting container...

=======================
 

 

Actually I only need a tailscale exit node on my unraid.

I wanted to use my unraid itself as exit node, but it does not work, as I mentioned above.

So I thought I just install tailscale in the AdGuard Container and use this as exit node.

 

If I could use unraid as exit node, I would not need any tailscale in the AdGaurd container at all.

2 minutes ago, ulischultz said:

ERROR: Enable MagicDNS and HTTPS on your Tailscale account to use Tailscale Serve/Funnel.
See: https://tailscale.com/kb/1153/enabling-https

Please read the error message again, you are probably using Tailscale Server and need to enable MagicDNS and HTTPS.

 

You have two ways, if you don't need Serve set it to No, or you just make sure that MagicDNS and HTTPS is enabled in your Tailscale Admin Dashboard.

 

You of course have to restart the container afterwards.

Ok, I got this working now...

 

However, is there any way to use unraid directly as an exit node?

Is there any downside (performance?) if using a docker container like I do now as an exit node?

1 minute ago, ulischultz said:

Is there any downside (performance?) if using a docker container like I do now as an exit node?

Not that I'm aware of.

 

1 minute ago, ulischultz said:

However, is there any way to use unraid directly as an exit node?

Didn't you already linked a GitHub issue where @EDACerton asked about that but didn't receive an answer?

Maybe also post in that issue that you are also interested why they wont allow this.

 

However why do you want to use Unraid as a Exit Node?

Couldn't you just set up routes so that you can get into your LAN if that's what you want to do?

Yes, but I also want to use my home Internet-Access as VPN when in public accesspoimts, etc...

11 minutes ago, ulischultz said:

Yes, but I also want to use my home Internet-Access as VPN when in public accesspoimts, etc...

You now basically doing that when using your AdGuard Exit Node, you can test this by enabling your AdGuard container as an Exit Node on the end device.

Then simply go to a site that shows your public IP address "what is my ip address" and you should see your home public IP.

Yes, I think I keep it like this now... But if unraid would be able to directly serve as an exit node, I would not need to have it in a seperate container.

But for now it's good like this!
Thank you so much for your help and time!!

Just 1 more question...
I would like to make my tailscale clients also to use my adguard as dns when connected.

If I put the tailscale IP of my adguard container here in the tailscale DNS settings as global nameserver it stops working.

Do you know, how I could achive this?

 

 

Edited December 19, 20241 yr by ich777
Removed image with MagicDNS

5 minutes ago, ulischultz said:

Yes, I think I keep it like this now... But if unraid would be able to directly serve as an exit node, I would not need to have it in a seperate container.

I'm on the complete opposite site of the spectrum, I would not want to have my entire Unraid server in my Tailnet and I rather like to have the individual containers in my Tailnet.
First because I really don't want to give anyone accidentally access to my server (I never know what I might configure wrong... ) and another benefit from using the Unraid Tailnet Docker integration is that you can use Serve and access all containers individually over https.

 

4 minutes ago, ulischultz said:

If I put the tailscale IP of my adguard container here in the tailscale DNS settings as global nameserver it stops working.

I think you are referring to that:

 

I think you can't use a Exit Node as DNS but I've never tried to use a Exit Node as DNS.

 

BTW I removed the image from your previous post since you've exposed your MagicDNS.

Ok, thank you!! So you say that using the tailscale docker container instead of the new unraid plugin is still the better way?

1 minute ago, ulischultz said:

So you say that using the tailscale docker container instead of the new unraid plugin is still the better way?

Not really, this is personal preference and always depends on the individual user.

 

TBH I think I do many things differently than most other users...

8 hours ago, ulischultz said:

Ok, thank you!! So you say that using the tailscale docker container instead of the new unraid plugin is still the better way?

It's not a one-or-the-other thing.

 

The plugin gives you access to the WebGUI/NFS/SMB/bridged containers.

 

The docker method lets you create unique Tailscale machines for different containers, which is useful if you want to share them with other people (but not your whole Unraid server).

 

You can use either, or both, it all depends on what you want to do

You should probably let the Snort people know that there is a false positive on your plugin usage tracking. I get hundreds of warnings about a sign of possible infection in my network. When I hunted down the details it's because of accessing plugin-usage.edacerton.win and there is a Snort rule that any access to a .win domain could indicate compromise. I don't know if they except specific domains like yours that are known to not be bad.

 

Snort - Rule Docs: https://snort.org/rule_docs/1-44077

 

I turned off usage data collection, assuming that will clear up those warnings.

Edited December 19, 20241 yr by SteveHiner

3 minutes ago, SteveHiner said:

You should probably let the Snort people know that there is a false positive on your plugin usage tracking. I get hundreds of warnings about a sign of possible infection in my network. When I hunted down the details it's because of accessing plugin-usage.edacerton.win and there is a Snort rule that any access to a .win domain could indicate compromise. I don't know if they except specific domains like yours that are known to not be bad.

 

Snort - Rule Docs: https://snort.org/rule_docs/1-44077

 

I turned off usage data collection, assuming that will clear up those warnings.

Eh, probably easier to migrate to something that’s not .win — I just happen to use .win because they’re cheap for long registrations. I doubt the snort people care about me 😂

Edited December 19, 20241 yr by EDACerton

1 hour ago, EDACerton said:

Eh, probably easier to migrate to something that’s not .win — I just happen to use .win because they’re cheap for long registrations. I doubt the snort people care about me 😂

 

If the plugin is part of the unraid official repos now then for consistency and security, shouldn't any URL calls use official unraid URLs, not random third party domains.

22 hours ago, eagle470 said:

ot happy with the required use of an OAuth provider. I don't want any of my authentication tied to one of the big tech companies. 

You can authenticate with github.

14 hours ago, trurl said:

You can authenticate with github.

 

I'm pretty sure that qualifies as one of the big tech companies - it's owned by Microsoft.

 

  

On 12/18/2024 at 11:54 PM, eagle470 said:

I'm looking at dropping my published domain and switching to tailscale, but I'm not happy with the required use of an OAuth provider. I don't want any of my authentication tied to one of the big tech companies. 

 

To run without oauth you can run your own Headscale. The best way to do that is to use your domain connected to a vhost/VPS running somewhere out on the inernet, and then run docker there, and install headscale plus a reverse proxy.

 

But, you should also be able to set up your own authenticator (OIDC) like Authentik and tie Tailscale to that. I recall it being listed at the bottom of the options when first signing up. I'm sure it'll take a deep dive into the documentation to set up.

 

 

Edited December 20, 20241 yr by Espressomatic

Is it possible to have this plugin forward any requests *.domain.com to my SWAG container on 192.168.40.3