Tailscale (VPN) is UP.. But cannot see devices on my edgerouter.

[awardblvr]

I have Tailscale up on my Edgerouter (EdgeRouter 4 v2.0.9-hotfix.4) with the jamesog/tailscale-edgeos method... And from an off-site remote device with Tailscale VPN connected I can see and get into the web interface of my edgerouter (which is at its default address 192.168.1.1)... But, I cannot seem to ping any of the devices 192.168.1.x on my edgerouter nor their device-name.local addresses.

Do I have to provide some kind of routes to those devices?

Do I need to use some scheme remotely to access those devices? (I DO have subnet routes enabled on the Tailscale account interface for that device.) and I started Tailscale on Edgerouter with the command:

sudo tailscale up --accept-routes --advertise-routes 192.168.1.0/24 --authkey tskey-<my_key> --reset

Or is there something preventing me from accessing my home devices on 192.168.1.x due to the nature of 192.168.1.x type addresses?

[jamesog]

Hey @awardblvr. I don't work for Tailscale and this is an unofficial guide for installation, so I'd suggest you talk to Tailscale support directly.

At a guess you need to make some changes on your router to allow that to work. For example, have you looked at your NAT configuration? Is hairpin enabled? Have you tried a tcpdump on the router to see if it gets the packets and isn't forwarding them?

[awardblvr]

svedaker... Thanks here's the result:

$ ip route show
0.0.0.0 dev tailscale0 proto kernel scope link
default proto zebra
	nexthop via 100.64.0.1  dev eth1 weight 1
	nexthop via 10.0.0.1  dev eth0 weight 1
10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.174
100.64.0.0/16 dev eth1 proto kernel scope link src 100.64.87.213
100.93.30.46 dev tailscale0 proto kernel scope link
192.168.1.0/24 dev eth2 proto kernel scope link src 192.168.1.1
192.168.2.0/24 dev eth2.10 proto kernel scope link src 192.168.2.1
192.168.3.0/24 dev eth2.20 proto kernel scope link src 192.168.3.1
192.168.4.0/24 dev eth2.30 proto kernel scope link src 192.168.4.1

and regular table 52...

$ ip route show table 52
100.67.119.2 dev tailscale0
100.75.147.121 dev tailscale0
100.81.170.96 dev tailscale0
100.100.100.100 dev tailscale0
100.110.203.57 dev tailscale0
100.125.41.110 dev tailscale0

[awardblvr]

James.. agains.. so many thanks.. Hopefully this is ll help many folks....

NOT redacted.. nothing really personal here:

set firewall all-ping enable
set firewall broadcast-ping disable
set firewall group network-group PRIVATE_NETS network 192.168.0.0/16
set firewall group network-group PRIVATE_NETS network 172.16.0.0/12
set firewall group network-group PRIVATE_NETS network 10.0.0.0/8
set firewall ipv6-receive-redirects disable
set firewall ipv6-src-route disable
set firewall ip-src-route disable
set firewall log-martians disable
set firewall modify balance rule 10 action modify
set firewall modify balance rule 10 description 'do NOT load balance lan to lan'
set firewall modify balance rule 10 destination group network-group PRIVATE_NETS
set firewall modify balance rule 10 modify table main
set firewall modify balance rule 20 action modify
set firewall modify balance rule 20 description 'do NOT load balance destination public address'
set firewall modify balance rule 20 destination group address-group ADDRv4_eth0
set firewall modify balance rule 20 modify table main
set firewall modify balance rule 30 action modify
set firewall modify balance rule 30 description 'do NOT load balance destination public address'
set firewall modify balance rule 30 destination group address-group ADDRv4_eth1
set firewall modify balance rule 30 modify table main
set firewall modify balance rule 110 action modify
set firewall modify balance rule 110 modify lb-group G
set firewall name Tailscale default-action accept
set firewall name Tailscale description 'Allow incoming stuff to get inside the house'
set firewall name WAN_IN default-action accept
set firewall name WAN_IN description 'WAN to internal'
set firewall name WAN_IN enable-default-log
set firewall name WAN_IN rule 10 action accept
set firewall name WAN_IN rule 10 description 'Allow established/related'
set firewall name WAN_IN rule 10 state established enable
set firewall name WAN_IN rule 10 state related enable
set firewall name WAN_IN rule 20 action drop
set firewall name WAN_IN rule 20 description 'Drop invalid state'
set firewall name WAN_IN rule 20 state invalid enable
set firewall name WAN_IN rule 21 action accept
set firewall name WAN_IN rule 21 destination group address-group ADDRv4_eth2
set firewall name WAN_IN rule 21 log disable
set firewall name WAN_IN rule 21 protocol all
set firewall name WAN_IN rule 21 source group address-group ADDRv4_tailscale0
set firewall name WAN_LOCAL default-action drop
set firewall name WAN_LOCAL description 'WAN to router'
set firewall name WAN_LOCAL rule 10 action accept
set firewall name WAN_LOCAL rule 10 description 'Allow established/related'
set firewall name WAN_LOCAL rule 10 state established enable
set firewall name WAN_LOCAL rule 10 state related enable
set firewall name WAN_LOCAL rule 20 action drop
set firewall name WAN_LOCAL rule 20 description 'Drop invalid state'
set firewall name WAN_LOCAL rule 20 state invalid enable
set firewall options mss-clamp interface-type vti
set firewall options mss-clamp mss 1379
set firewall receive-redirects disable
set firewall send-redirects enable
set firewall source-validation disable
set firewall syn-cookies enable

AS you can see I had STARTED a Tailscale rule, but via the GUI, there was no way of specifying the 'tailscale0' interface.

[jamesog]

Thanks @awardblvr. Is that everything from the match? I was expecting to also see some set interfaces ethernet ... commands to show which interfaces have which rules set.

Also, are there no rules for the internal interface?

Something else to try: start a tcpdump to watch packets.

On the EdgeRouter:

sudo tcpdump -vni tailscale0

And on another device run a ping (not tailscale ping) and see what you see on the router. You should see something like this:

19:35:19.282042 IP (tos 0x0, ttl 64, id 4407, offset 0, flags [DF], proto ICMP (1), length 84)
    100.x.x.x > y.y.y.y: ICMP echo request, id 59512, seq 2, length 64
19:35:19.282419 IP (tos 0x0, ttl 63, id 28488, offset 0, flags [none], proto ICMP (1), length 84)
    y.y.y.y > 100.x.x.x: ICMP echo reply, id 59512, seq 2, length 64

What I'm looking for here is whether you even see that first echo request packet or if that's getting dropped somewhere.

[awardblvr]

OK... sorry for long delay... I had to clean up some historical firewall trial-and-error since my last messaging... I also was able to create a guest vlan that had no internal access so I could be sure I was going put instead of pinging stuff locally.

Current state after all this is that Tailscale is UP and from remote locations, I CAN access devices on my home net via IP address! Now the next hurdle is to get the DNS name like homeauto (or homeauto.local) to be accessible remotely by name, instead of just by IP address. I kinda thought the MagicDNS thing would peer in and grab all the .local address from my Edgerouter4 and populate them in its DB. OK... Still another trick to learn... BTW.. Here are the firewall rules which appear to help.

$ show configuration commands |match firewall
set firewall all-ping enable
set firewall broadcast-ping disable
set firewall group network-group PRIVATE_NETS network 192.168.0.0/16
set firewall group network-group PRIVATE_NETS network 172.16.0.0/12
set firewall ipv6-receive-redirects disable
set firewall ipv6-src-route disable
set firewall ip-src-route disable
set firewall log-martians disable
set firewall modify balance
set firewall name BLOCK_IN default-action accept
set firewall name BLOCK_IN description ''
set firewall name BLOCK_IN rule 1 action accept
set firewall name BLOCK_IN rule 1 description 'Accept Established/Related'
set firewall name BLOCK_IN rule 1 log disable
set firewall name BLOCK_IN rule 1 protocol all
set firewall name BLOCK_IN rule 1 state established enable
set firewall name BLOCK_IN rule 1 state invalid disable
set firewall name BLOCK_IN rule 1 state new disable
set firewall name BLOCK_IN rule 1 state related enable
set firewall name BLOCK_IN rule 2 action drop
set firewall name BLOCK_IN rule 2 description 'Drop PRIVATE_NETS'
set firewall name BLOCK_IN rule 2 destination group network-group PRIVATE_NETS
set firewall name BLOCK_IN rule 2 log disable
set firewall name BLOCK_IN rule 2 protocol all
set firewall name BLOCK_LOCAL default-action accept
set firewall name BLOCK_LOCAL description 'Accept DNS'
set firewall name BLOCK_LOCAL rule 1 action accept
set firewall name BLOCK_LOCAL rule 1 description 'Accept DNS'
set firewall name BLOCK_LOCAL rule 1 destination port 53
set firewall name BLOCK_LOCAL rule 1 log disable
set firewall name BLOCK_LOCAL rule 1 protocol udp
set firewall name BLOCK_LOCAL rule 2 action accept
set firewall name BLOCK_LOCAL rule 2 description 'Accept DHCP'
set firewall name BLOCK_LOCAL rule 2 destination port 67
set firewall name BLOCK_LOCAL rule 2 log disable
set firewall name BLOCK_LOCAL rule 2 protocol udp
set firewall name WAN_IN default-action accept
set firewall name WAN_IN description 'WAN to internal'
set firewall name WAN_IN enable-default-log
set firewall name WAN_IN rule 10 action accept
set firewall name WAN_IN rule 10 description 'Allow established/related'
set firewall name WAN_IN rule 10 state established enable
set firewall name WAN_IN rule 10 state related enable
set firewall name WAN_IN rule 20 action drop
set firewall name WAN_IN rule 20 description 'Drop invalid state'
set firewall name WAN_IN rule 20 state invalid enable
set firewall name WAN_IN rule 21 action accept
set firewall name WAN_IN rule 21 destination group address-group ADDRv4_eth2
set firewall name WAN_IN rule 21 log disable
set firewall name WAN_IN rule 21 protocol all
set firewall name WAN_IN rule 21 source group address-group ADDRv4_tailscale0
set firewall name WAN_LOCAL default-action drop
set firewall name WAN_LOCAL description 'WAN to router'
set firewall name WAN_LOCAL rule 10 action accept
set firewall name WAN_LOCAL rule 10 description 'Allow established/related'
set firewall name WAN_LOCAL rule 10 state established enable
set firewall name WAN_LOCAL rule 10 state related enable
set firewall name WAN_LOCAL rule 20 action drop
set firewall name WAN_LOCAL rule 20 description 'Drop invalid state'
set firewall name WAN_LOCAL rule 20 state invalid enable
set firewall options
set firewall receive-redirects disable
set firewall send-redirects enable
set firewall source-validation disable
set firewall syn-cookies enable
set interfaces ethernet eth0 firewall in name WAN_IN
set interfaces ethernet eth0 firewall local name WAN_LOCAL
set interfaces ethernet eth1 firewall in name WAN_IN
set interfaces ethernet eth1 firewall local name WAN_LOCAL
set interfaces ethernet eth2 vif 30 firewall in name BLOCK_IN
set interfaces ethernet eth2 vif 30 firewall local name BLOCK_LOCAL
set port-forward auto-firewall enable

[jamesog]

Great news @awardblvr. Do you know exactly what you did to make it work, in case it helps others? Was it just the firewall rule (WAN_IN rule 21?)

For hostnames: .local addresses use multicast DNS and typically only work on the same subnet, although the EdgeRouter can also turn on multicast routing (I use this to announce mDNS over different VLANs). So, it's not straightforward to use Tailscale devices outside of your local network to resolve those names.

If you run your own DNS server somewhere in the LAN you can set MagicDNS to give that out to clients. That server may be able to respond to and forward mDNS hostnames, although that would be unusual. Better would be to host a normal DNS zone.

[svedaker]

ip router show table all, maybe some other table that interfere. Using load balancing that could interfere? It could be you need a rule to not load balance tailscale devices.

[awardblvr]

Earlier I had load balancing present... I have painstakingly removed all traces of it...

I think you meant 'ip route show table all' ?

$ ip route show table all
100.X.Y.2 dev tailscale0 table 52
100.X.Y.121 dev tailscale0 table 52
100.X.Y.96 dev tailscale0 table 52
100.100.100.100 dev tailscale0 table 52
100.X.Y.57 dev tailscale0 table 52
100.X.Y.110 dev tailscale0 table 52
0.0.0.0 dev tailscale0 proto kernel scope link
default via 10.0.0.1 dev eth0 proto zebra
10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.174
10.10.0.0/24 dev eth2.30 proto kernel scope link src 10.10.0.1
100.X.30.46 dev tailscale0 proto kernel scope link
192.168.1.0/24 dev eth2 proto kernel scope link src 192.168.1.1
192.168.2.0/24 dev eth2.10 proto kernel scope link src 192.168.2.1
192.168.3.0/24 dev eth2.20 proto kernel scope link src 192.168.3.1
broadcast 10.0.0.0 dev eth0 table local proto kernel scope link src 10.0.0.174
local 10.0.0.174 dev eth0 table local proto kernel scope host src 10.0.0.174
broadcast 10.0.0.255 dev eth0 table local proto kernel scope link src 10.0.0.174
broadcast 10.10.0.0 dev eth2.30 table local proto kernel scope link src 10.10.0.1
local 10.10.0.1 dev eth2.30 table local proto kernel scope host src 10.10.0.1
broadcast 10.10.0.255 dev eth2.30 table local proto kernel scope link src 10.10.0.1
local 100.X.30.46 dev tailscale0 table local proto kernel scope host src 100.X.30.46
broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1
broadcast 192.168.1.0 dev eth2 table local proto kernel scope link src 192.168.1.1
local 192.168.1.1 dev eth2 table local proto kernel scope host src 192.168.1.1
broadcast 192.168.1.255 dev eth2 table local proto kernel scope link src 192.168.1.1
broadcast 192.168.2.0 dev eth2.10 table local proto kernel scope link src 192.168.2.1
local 192.168.2.1 dev eth2.10 table local proto kernel scope host src 192.168.2.1
broadcast 192.168.2.255 dev eth2.10 table local proto kernel scope link src 192.168.2.1
broadcast 192.168.3.0 dev eth2.20 table local proto kernel scope link src 192.168.3.1
local 192.168.3.1 dev eth2.20 table local proto kernel scope host src 192.168.3.1
broadcast 192.168.3.255 dev eth2.20 table local proto kernel scope link src 192.168.3.1
fd7a:115c:a1e0::/48 dev tailscale0 table 52 metric 1024  pref medium
unreachable default dev lo proto kernel metric 4294967295  error -128 pref medium
unreachable default dev lo proto kernel metric 4294967295  error -128 pref medium
fd7a:115c:a1e0:ab12:4843:cd96:625d:1e2e dev tailscale0 proto kernel metric 256  pref medium
fe80::/64 dev eth0 proto kernel metric 256  pref medium
fe80::/64 dev eth2 proto kernel metric 256  pref medium
fe80::/64 dev eth2.20 proto kernel metric 256  pref medium
fe80::/64 dev eth2.10 proto kernel metric 256  pref medium
fe80::/64 dev eth2.30 proto kernel metric 256  pref medium
fe80::/64 dev tailscale0 proto kernel metric 256  pref medium
unreachable default dev lo proto kernel metric 4294967295  error -128 pref medium
local ::1 dev lo table local proto none metric 0  pref medium
local fd7a:115c:a1e0:ab12:4843:cd96:625d:1e2e dev lo table local proto none metric 0  pref medium
local fe80:: dev lo table local proto none metric 0  pref medium
local fe80:: dev lo table local proto none metric 0  pref medium
local fe80:: dev lo table local proto none metric 0  pref medium
local fe80:: dev lo table local proto none metric 0  pref medium
local fe80:: dev lo table local proto none metric 0  pref medium
local fe80:: dev lo table local proto none metric 0  pref medium
local fe80::7a8a:20ff:fedf:b926 dev lo table local proto none metric 0  pref medium
local fe80::7a8a:20ff:fedf:b928 dev lo table local proto none metric 0  pref medium
local fe80::7a8a:20ff:fedf:b928 dev lo table local proto none metric 0  pref medium
local fe80::7a8a:20ff:fedf:b928 dev lo table local proto none metric 0  pref medium
local fe80::7a8a:20ff:fedf:b928 dev lo table local proto none metric 0  pref medium
local fe80::f7c4:a37a:ac79:f8ae dev lo table local proto none metric 0  pref medium
ff00::/8 dev eth0 table local metric 256  pref medium
ff00::/8 dev eth2 table local metric 256  pref medium
ff00::/8 dev eth2.20 table local metric 256  pref medium
ff00::/8 dev eth2.10 table local metric 256  pref medium
ff00::/8 dev eth2.30 table local metric 256  pref medium
ff00::/8 dev tailscale0 table local metric 256  pref medium
unreachable default dev lo proto kernel metric 4294967295  error -128 pref medium