Tailscale always relay never direct

Installing and Using OpenWrt
1

I do not have tailscale installed on openwrt, it is installed on proxmox. While testing tailscale I noticed that its always using the relayed connections.

The tailscale docs recommend enabling NAT-PMP and UPnP, but I would like to avoid enabling these do to security risk, is NAT-PMP safe?

The openwrt tailscale wiki does not specify needing port 41641 to be open, so is this not required when installed on openwrt?

However, this thread directly suggest port 41641 needs to be open as well as the linked reddit thread.

So what is the best way to get direct connection working with tailscale and openwrt?

2

Does tailscale traffic cross OpenWrt at all?

3

The router running openwrt is my main router connected to my ISP, so I guess yes?

4

It was not clear from your post.
Sure, enable miniupnpd-nftables using luci-app-upnp. It is decent version and properly configured by default, ie no open control interfac€ to the internet.

5

noted on this, but why isn't that needed when using tailscale openwrt package?

I forward port 41641 and have direct connection, so it's a good start but have two nodes on my lan for tailscale. So, if one goes down, I can still connect and will look into miniupnpd-nftables.

6

That would be dynamically opening port when needed.

7

are you referring to miniupnpd or tailscale openwrt package?

The reason I'm hesitant on using miniupnpd, is that any device on my lan would be able to dynamically open ports, but I guess that's my only option.

8

You can restrict that to one port or disable dservice if you dont like it.

9

thanks, but looks like luci app is broken on the latest 24 release.

As i understand miniupnp works just doesn't show open ports in luci?

10

Your observation is correct.

11

Not sure what you are doing but this works for me.

MacBook Pro(Tailscale) + OpenWrt Router <-- Internet --> ER-4 Router(Tailscale Exit Node) + LAN

Tailscale Exit Node is installed on the EdgeRouter running EdgeOS and is my Production Router.

Tailscale was installed on the OpenWrt Router as per the OpenWrt Tailscale Wiki some months ago and is my Test Router.

Tailscale was just disabled on the OpenWrt Router for this test.

root@usg-3p:~# tailscale down
root@usg-3p:~# tailscale status
Tailscale is stopped.
root@usg-3p:~#

To verify connection type:
1 MacBook Pro selects ER-4 as the Exit Node.
2 SSH into ER-4 and run tailscale status, the connection type confirmed as direct.

12

Unchecked 'Enable UPnP IGD protocol'
Checked 'Enable PCP/NAT-PMP protocols'

It is working just as expected, so I hope disabling upnp, this order and rules are correct?


config upnpd 'config'
        option enabled '1'
        option internal_iface 'lan'
        option upnp_lease_file '/var/run/miniupnpd.leases'
        option enable_upnp '0'
        option uuid 'deleted-uuid-for-privacy'

config perm_rule
        option comment 'Allow Tailscale'
        option int_addr 'x.x.x.x/32'
        option int_ports '41641'
        option ext_ports '41641'
        option action 'allow'

config perm_rule
        option action 'deny'
        option ext_ports '0-65535'
        option int_addr '0.0.0.0/0'
        option int_ports '0-65535'
        option comment 'Default deny'
13

You need to make sure its a direct connection my ping your external nodes, the first few pings use DERP relay but then you should get a direct conection.

you can also check tailscale netcheck.

14

I get a direct connection, tailscale status confirms that.

ubnt@ER-4:~$ tailscale status
100.xxx.xxx.xxx   er-4                xxx@    linux   idle; offers exit node
100.xxx.xxx.xxx   atv-1               xxx@    tvOS    idle; offers exit node
100.xxx.xxx.xxx   atv-2               xxx@    tvOS    active; direct xxx.xxx.xxx.xxx:41641, tx 315886464 rx 39734200
100.xxx.xxx.xxx   macbookpro          xxx@    macOS   active; direct xxx.xxx.xxx.xxx:41641, tx 275667328 rx 31882000
15

maybe because you are running directly on the routers, I am not.

16

Can you post a screenshot that shows the device is using the DERP Servers?

Note, tailscale netcheck will show the nearest DERP Server and also list global DERP Servers, but that does not indicate the device is connecting through a DERP Server.

17

It's working after I setup miniupnp.

1 Like
18

Please mention whether your ISP is mobile (CGNAT) or conventional? Thanks.

19

conventional FTTH

1 Like
20

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.