Tailscale¶
Tailscale is the remote-access layer for the whole estate. One subnet router (the ops LXC)
advertises the home LAN, so every tailnet device can reach 192.168.1.x addresses directly —
no per-host Tailscale installs on LAN machines, no ProxyJump needed.
How it works¶
flowchart LR
mac["MacBook / iPhone / tablet<br/>(anywhere in the world)"] -. "tailnet<br/>(WireGuard mesh)" .-> ops["ops · LXC 104<br/>100.89.199.114<br/>subnet router"]
vps["VPS<br/>(accept-routes<br/>still pending)"] -. "tailnet" .-> ops
ops == "advertises<br/>192.168.1.0/24" ==> lan["Entire home LAN<br/>NAS · Proxmox UI · Kopia :51515<br/>gaming PCs (Moonlight)"]| Tailnet member | Notes |
|---|---|
| ops (LXC 104) | Subnet router for 192.168.1.0/24 — the linchpin |
| vps | 100.75.121.110 — has NOT run --accept-routes yet, so it cannot see the LAN |
| elliotts-macbook-pro | Accepts routes by default |
| elliott-diag-tablet | On the tailnet — ACL tightening pending (below) |
| Windows PCs | Recommended path for Apollo/Moonlight remote streaming |
The ops container needed a tun device added to its LXC config to run tailscaled —
remember that if the container is ever rebuilt.
Adding a device to the tailnet¶
The clean way to enrol a new machine — especially one you don't want to sign your own account into (a family member's Mac) — is a pre-authorised auth key, not an interactive login.
- Mint a key. Admin console → Settings → Keys → Generate auth key. Make it
single-use, set a sensible expiry, and (for least-trusted devices) add a tag such as
tag:familyso an ACL can scope it. Copy thetskey-auth-…value — treat it as a secret, it is not recorded in this wiki. -
Join from the device. Install Tailscale, then:
sudo tailscale up --auth-key tskey-auth-XXXXXXXXSet Tailscale to start at login / stay connected so the tunnel is always up. The device now appears in your admin console and can be removed there at any time. 3. Scope it. By default a new device inherits the ops subnet route and can reach the whole
192.168.1.0/24. Least-trusted devices should be limited by ACL to only what they need — see the tablet note below and the family-device example on the Remote desktop page.
For what the device is usually being onboarded for — RustDesk screen sharing — continue with Add a new device.
Gotchas (each one has bitten already)¶
Approving the device does NOT approve the route
When a subnet router joins, the admin console approval is two separate steps: approving the machine and approving its advertised route. The route lives under Machines → ops → Edit route settings. If tailnet devices can ping ops's 100.x address but nothing on 192.168.1.x, this is why.
Linux clients must opt in to routes
macOS, iOS and Windows accept subnet routes by default. Linux does not:
sudo tailscale set --accept-routes
The VPS still hasn't run this (needs interactive sudo — Elliott must run it), which is why the VPS cannot reach the LAN over the tailnet yet.
\"Tailscale is stopped\" — the first suspect
After a reboot (seen on the MacBook), Tailscale can silently fail to reconnect. Any remote-access failure: check Tailscale is actually running on the client first, before suspecting ops, the router, or the target host. Confirmed cause of "everything is down" false alarms from Scotland. See also Unreachable.
Key expiry¶
The ops node key expires 2027-02-05. If it lapses, all remote access to the LAN dies at once.
- The monitoring stack warns via ntfy starting 30 days before expiry.
- Better fix (pending operator action): disable key expiry for ops in the admin console (Machines → ops → Disable key expiry). A subnet router is exactly the machine that should never silently drop off the tailnet.
Recommended: tighten the ACL for the tablet¶
The tailnet currently runs the default allow-all ACL, which means the diagnostic tablet can reach the entire home LAN through the subnet route. The tablet is the least-trusted, most-losable device on the tailnet (see Lost device).
Pending operator action (Security posture): add an ACL that limits
the tablet to only what it needs, instead of 192.168.1.0/24 wholesale.