Setting Up Tailscale and Access Local Resources
Recently I needed to access a resource locally on my network whilst I was away and I had no way to do this. Straight away, I knew what I needed to do. I have used Tailscale before so I knew this was the solution for me.
Tailscale is a great tool which lets you securely connect devices across networks. It uses WireGuard behind the scenes and creates a peer-to-peer network called a tailnet and only devices in your private network can communicate with each other. You can also set it up to work as a conventional VPN by acting as a hub.
Setup
I am running this in a Proxmox LXC and there are some pre-requisites if you are running Tailscale in the same fashion. Follow the information in this link or see the below screenshot.
Next, in Proxmox create a new LXC. My LXC is the setup using Debian. Then install Tailscale using following the screenshot below and this link. Do not run tailscale up yet because we need to set a few parameters first.
The first two command are below as the screenshot hides this.
curl -fsSL https://pkgs.tailscale.com/stable/debian/bookworm.noarmor.gpg | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null
curl -fsSL https://pkgs.tailscale.com/stable/debian/bookworm.tailscale-keyring.list | sudo tee /etc/apt/sources.list.d/tailscale.list
Next, we need to setup and run a few commands. We need to setup the exit node and enable local network access, and then we want to advertise a route.
Exit node - Routes all your public internet traffic by setting a device on your network as an exit node. By default, Tailscale acts as an overlay network, it only routes traffic between devices running Tailscale, but doesn't touch your public internet traffic, such as when you visit Google or Twitter.
Run the below commands. When you run tailscale up it should pop open a window asking you to login. When advertising your route, you need to use your IP range and the correct CIDR.
tailscale set --advertise-exit-node
tailscale set --exit-node-allow-lan-access
tailscale set --advertise-routes 192.168.50.0/24
tailscale up
Now you will have to head over to the admin panel and Disable Key Expiry. This will prevent the need to Tailscale to re-authenticate. You will also need to select a "Use as exit node" option by clicking on the three dots of you machine in the admin panel and clicking "route settings"
And that is it! Now on your phone you download Tailscale, authenticate and select the exit node. This means that when I am out, all my traffic goes through my home network. This is where I have an adblocker setup so I can go out and not have to worry about adverts when browsing outside of my home. It allows me to connect to my local resources so I can diagnose issues if needed.