January 20, 20251 yr Exit node: Tailscale Plugin on my server has been using a mullvad exit node since I set it up. While troubleshooting some issues tonight with containers and Tailscale, I disabled the plugin exit node and now it's unable to be set back? https://github.com/tailscale/tailscale/issues/14372 Containers: When enabling Tailscale in a container and setting an exit node it is not accessible over LAN even when 'enable LAN access' is set? (Example: sabnzb container set to use exit node and allow LAN access, radarr cant see dl client, I can't access web gui, etc. all over LAN) Sharing: Friend group is really into Icarus. I've been playing solo remotely from a dedicated server container on my server. I access it remotely from a laptop when I'm not at home using Tailscale. It shows up as a LAN connection. I added Tailscale to the container and shared it to a friends Tailnet. They can ping the ipv4 address from their windows but nothing we tried could get it to show up in his game client. Direct connect using any address/port combo didn't work either. Is there something I'm just not getting with how this works? TIA, and I love you guys.
January 20, 20251 yr Please post and use the tailscale side of the forum found here: https://forums.unraid.net/forum/111-tailscale/ review:
January 20, 20251 yr Author 4 hours ago, bmartino1 said: Please post and use the tailscale side of the forum found here: https://forums.unraid.net/forum/111-tailscale/ review: Thank you, it seems it has been moved there. Still hoping to see if anyone has any experience setting up anything similar. Edited January 20, 20251 yr by Praetoriate
January 21, 20251 yr 11 hours ago, Praetoriate said: Thank you, it seems it has been moved there. Still hoping to see if anyone has any experience setting up anything similar. This is a known issue with the plugin AFAIK, there is already an issue open about that on GitHub: https://github.com/tailscale/tailscale/issues/14372
January 27, 20251 yr It seems the issue is resolved. Is there also a fix for Unraid required to make docker-based implementation work?
January 28, 20251 yr On 1/27/2025 at 6:43 AM, steve1977 said: Is there also a fix for Unraid required to make docker-based implementation work? Do you mean the toggle switch on the Docker page or do you mean a feature from the Tailscale Plugin. If you are using the bridge or a custom Docker network Tailscale thinks that your local network is the Docker network 172.x.x.x and therefore you can't access it through your LAN. Hope that makes sense and helps.
January 28, 20251 yr I was referring to this issue: https://github.com/tailscale/tailscale/issues/14372, which has been solved / closed. It is about exit nodes, which are working again. It impacted the plugin. Not sure it also impacted the docker. I am still undecided whether I will use the plugin or the docker implementation. Currently exploring both. What I like about the docker implementation is that I can have some dockers outside TS, some dockers using exit node #1, and other dockers using exit node #2. That's quite neat. Ideally, I would use both (plugin and docker), but not sure they play nice together. Not clear what you are referring to above? LAN-access is critical for me. Most of my dockers are in host-mode/ Are you saying that LAN-access will no longer work if I run TS within the docker?
January 28, 20251 yr 1 minute ago, steve1977 said: I was referring to this issue: https://github.com/tailscale/tailscale/issues/14372, which has been solved / closed. It is about exit nodes, which are working again. It impacted the plugin. Not sure it also impacted the docker. The Unraid Tailscale Docker Integration should be not affected by that. 1 minute ago, steve1977 said: Ideally, I would use both (plugin and docker), but not sure they play nice together. They should not interfere with each other, at least I've not heard anything bad about it. 2 minutes ago, steve1977 said: Not clear what you are referring to above? LAN-access is critical for me. Most of my dockers are in host-mode/ Are you saying that LAN-access will no longer work if I run TS within the docker? If you are using a Exit Node in a container with Unraid Docker Integration you can't use the bridge network because Tailscale then thinks that the LAN network is the internal Docker network (172.x.x.x) however there are ways to workaround that. You can read more about that here in the Docs (you have to scroll a bit down to Userspace Networking) : https://docs.unraid.net/unraid-os/manual/security/tailscale/#technical-details Anyways I would recommend that you play around with it and create a new post here if you have any issues.
January 29, 20251 yr Thanks. This has been helpful. Basically, I'd need to set my docker up with their own local IPs (custom br0). Drawback is that I can no longer access the dockers remotely with TS (plugin) from the Unraid GUI, but could do so via their dedicated IPs. However, in my home network, this should work. At least in theory... I still can't get it to work to access dockers from local-IP (custom br0). To keep things simple, I kept exit nodes disabled (no / none). Userspacing is disabled, so is SSH. Tailscale serve is set to "serve". Any idea what I am missing? ***update*** It works once I set tailscale-serve to "none". Assume this restricts functionality though? ***update2*** It works with "none", but no longer access to the Internet. Do I need to figure out how to add a cert to the container? Seems fairly complex for what I would have hope is a simple thing? Edited January 29, 20251 yr by steve1977
January 29, 20251 yr 6 hours ago, steve1977 said: At least in theory... I still can't get it to work to access dockers from local-IP (custom br0). To keep things simple, I kept exit nodes disabled (no / none). Userspacing is disabled, so is SSH. Tailscale serve is set to "serve". Please describe what you want to do so that I can test, maybe a few example containers and from where they should be reachable. Do you want to use a Exit Node in container and be able to access it through your local IP? Do you just want to use Serve? Do you need Serve at all? If you are not using a Exit Node you should be still be able to access the container through your LAN IP and probably via the Tailscale IP but only if the machine that you want to access via Tailscale IP has Tailscale installed.
January 29, 20251 yr 1 hour ago, ich777 said: Please describe what you want to do so that I can test, maybe a few example containers and from where they should be reachable. Do you want to use a Exit Node in container and be able to access it through your local IP? Do you just want to use Serve? Do you need Serve at all? If you are not using a Exit Node you should be still be able to access the container through your LAN IP and probably via the Tailscale IP but only if the machine that you want to access via Tailscale IP has Tailscale installed. Thanks for offering help. Let me elaborate what I am trying to do with specific example. One premise is that I won't be able to install TS on all devices in my local network, so would love to be able to access Unraid UI and dockers throught the local-LAN IP (not the TS IP). There are various things that I am trying to accomplish, but let me start with something easy. Once this works, everything else may also work: 1) TS-plugin with exit node. Unraid GUI can be accessed with local IP (from TS- and non-TS-devices) with local IP. And with TS-IP from remote TS-devices. [this works very well now] 2) Prowlarr docker container that is not routed through an exit-node, but has TS enabled within docker container. Accessible via local-IP from home network. Ideally also via TS-IP for remote TS-devices. [I tried. I need to use br0 to access the docker via local-IP. But it seems that the Internet is not working once TS is enabled within the container]
January 29, 20251 yr 1 hour ago, steve1977 said: Thanks for offering help. Let me elaborate what I am trying to do with specific example. It will take me probably one or two days to test that since I'm currently really busy but I will get back to you as soon as I have set up a similar test environment.
January 29, 20251 yr 1 hour ago, ich777 said: It will take me probably one or two days to test that since I'm currently really busy but I will get back to you as soon as I have set up a similar test environment. Thanks for your help. Hope you haven't yet started. I realized that my issue is of totally different nature. I did some more trouble-shootingl. The issue is that something blocks the TS download within the docker. The package. Likely my ISP doesn't like whereever it is hosted. This wasn't obvious before as I use an exit-node with the plugin. So as long as the docker goes through the plugin-exit-node, all is good and it downlaods. Once I move the docker to br0, it in fact fails to download the TS implementation from within the docker. What I don't understand is why I cannot download TS within the docker. I can access the TS web-site. Also, I can download the TS-plugin without any issue. Do you where the TS package is hosted that gets download from within the container?
January 29, 20251 yr 3 minutes ago, steve1977 said: I did some more trouble-shootingl. The issue is that something blocks the TS download within the docker. The package. Likely my ISP doesn't like whereever it is hosted. Do you possibly have Unifi network gear on your network, I had a few issues already where IDS/IPS on those devices is a bit to strict since (not only with Tailscale). 4 minutes ago, steve1977 said: Do you where the TS package is hosted that gets download from within the container? Sure thing, it works like that: The json is pulled to determine the latest version from: https://pkgs.tailscale.com/stable/?mode=json The latest version is pulled based on Step 1 (as time of writing): https://pkgs.tailscale.com/stable/tailscale_1.78.1_amd64.tgz Please do keep in mind if you have Unifi network gear this is possible the culprit, I had many issues in the past with Unifi and IDS/IPS with the GitHub API, SteamCMD and even wget in some Docker containers.
January 29, 20251 yr Mmh... Guess that's the issue. I can acccess both URL... I guess the only solution is to change my routers?
January 29, 20251 yr 51 minutes ago, steve1977 said: I guess the only solution is to change my routers? I'm not sure what you mean exactly with that? Do you have a Unifi router with IDS/IPS enabled? Some users said they deactivated it entirely and some changed their rules for IDS/IPS to get it working on Unifi. I'm sorry but I really can't help with that if it's Unifi related because I don't have Unifi hardware over here. This was the most recent report: (I have also some similar reports about that on my Gameserver and Application Support threads)
February 1, 20251 yr What unifi device do you have. Depending on your IDP/IDS this can be an issue... In my testing, I have not had issues with default unifi setting for IDS/IPS blocking tailscale... It is possible by caching to custom or high for "more advance" that there are some ids/ips that will block parts of tail scale per the solution from the other uses in ICH777 posts.... did you use the user script to finish the end node at first array start to tell tailscale that its up with xyz and to route to the lan? tailscale up --accept-routes --accept-dns=true --advertise-routes=192.168.1.0/24 in the tail scale plugin, what is the output of your info page at the bottom? --I'm intrested in the last 2 items there is some sensitive data there... As I had top run the above terminal command to get tailscale to enable and use it: without the command its set to no and when set to no the tail scale will not route!... are you having a dns issues? Setting up a end node may cause the plugin and tale scale to overwrite the resolv.conf whcih can case dns issues at the host and container level... as seen here:
February 2, 20251 yr Thanks. it should be unrelated to my settings. Once i turn off the plugin, i cannot even install TS inside the container. As you say, it is likely related to my home network. For now, i just use the plugin, which works very well and serves 80% of my needs. I may do some changes to my home network, which hopefully will resolve the issue. I’ll revert in a few weeks.
February 9, 20251 yr Thanks again for your help. I have some time again to play around and try to get it to work. Context: No more Unifi devices. I use an OpenWRT mini-pc as Router together with Asus Zenwifi devices throughout the house. Tailscale plugin works with and without using an exit node. I cannot get the docker-internal implemenation of Tailscale to work if I disable the plugin. Reason is that the docker cannot download/install tailscale within the docker. I checked the information you asked me above: Tailscale health: This is an unstable version of Tailscale meant for testing and development purposes. Please report any issues to Tailscale. Some peers are advertising routes but --accept-routes is false. Accept Routes: No Accept DNS: Yes Thanks for any thoughts you may have. Happy to provide more logs or information as needed.
February 9, 20251 yr 1 hour ago, steve1977 said: Accept DNS: Yes Please try to disable Tailscale DNS in the plugin settings and see if the download works afterwards. It is really strange that Unraid or better speaking the container is not able to download the archive. Please also provide your container log with the exact error message.
February 9, 20251 yr One clarification: It downloads within the docker as long as the plugin is active. I need to double-check, but likely it works as long as I go through the exit plugin node. Once I turn off the plugin, it no longer works from within the docker.
February 9, 20251 yr Just disabled the plugin. Enabled within the container. In the log, I am seeing below: Executing Unraid Docker Hook for Tailscale Detecting Package Manager... Detected Alpine Package Keeper! Installing packages... Please wait... Stays likes this forever... Let me wait to see whether there is eventually an error message / time-out message.
February 9, 20251 yr Do you mean the tailscale plugin? Yes, that needs to be enabled for tailscale to work.
February 9, 20251 yr 2 hours ago, steve1977 said: Stays likes this forever... Let me wait to see whether there is eventually an error message / time-out message. Which container are you trying? Are you also sure that the message to authenticate is not somewhere at the top? The log from Unraid is sometimes a bit weird: Please note that this is the stage where it actually adds packages to the container to be able to download Tailscale. 2 hours ago, strike said: Do you mean the tailscale plugin? Yes, that needs to be enabled for tailscale to work. Nope, he means the Unraid Tailscale Docker Integration.
February 9, 20251 yr Unfortunately not. I received this in the past (when keeping the plugin activated). I may face some broader network issue, which may well be unrelated to Tailscale (but surfaces). Since I made network changes, my Plex container is now also broken (which has never been exposed to TS), so I must have some other unrelated annoying network issue...
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.