Setting Up Tailscale in Proxmox: A Comprehensive Guide

Introduction to Tailscale in Proxmox

In today's interconnected world, secure and efficient network management is crucial for both personal and professional use. Tailscale, a modern VPN solution, offers a seamless way to connect devices and access resources across different networks. This guide will walk you through the process of setting up Tailscale in a Proxmox environment, specifically using an LXC (Linux Containers) container.

Creating the LXC Container

The first step in our Tailscale setup is creating a dedicated LXC container in Proxmox. Here's how to do it:

1. Log into your Proxmox web interface
2. Click on "Create CT" to start the container creation process
3. Assign an ID number (e.g., 101) and choose a hostname (e.g., tailscale-YT)
4. Set the container as privileged for this setup
5. Create a secure password for the container
6. Select Ubuntu 22.04 as the template
7. Allocate resources:
   • Disk space: 8GB (default)
   • CPU: 1 core
   • Memory: 512MB
8. Configure networking:
   • Initially set to DHCP
   • Will be changed to static IP later
9. Review settings and start the container after creation

Initial Container Configuration

Once the container is running, we need to make some initial configurations:

1. Log into the container using the root credentials

2. Modify the SSH configuration:

   nano /etc/ssh/sshd_config
   

   Change "PermitRootLogin prohibit-password" to "PermitRootLogin yes"

3. Get the container's IP address:

   ip a
   

4. Switch to static IP in Proxmox:

   • Go to the container's network settings
   • Change from DHCP to Static
   • Enter the IP address obtained earlier
   • Set appropriate gateway and DNS settings

5. Verify network connectivity:

   ping cloudflare.com
   

Preparing for Tailscale Installation

Before installing Tailscale, we need to update the system and install necessary dependencies:

1. Update and upgrade the system:

   apt update && apt upgrade -y
   

2. Install curl:

   apt install curl -y
   

Installing Tailscale

Now we're ready to install Tailscale:

1. Visit the Tailscale website and copy the installation script

2. Paste and run the script in your container:

   curl -fsSL https://tailscale.com/install.sh | sh
   

3. The installation will complete, but don't run tailscale up yet

Configuring IP Forwarding

To enable subnet advertising, we need to allow IP forwarding:

1. Edit the sysctl configuration file:

   nano /etc/sysctl.conf
   

2. Uncomment these lines:

   net.ipv4.ip_forward=1
   net.ipv6.conf.all.forwarding=1
   

3. Save and exit the file

Additional Container Configuration

For Tailscale to function properly in an unprivileged container, we need to make some changes:

1. Shut down the LXC container

2. On the Proxmox host, edit the container's configuration:

   nano /etc/pve/lxc/<container-id>.conf
   

3. Add these lines:

   lxc.cgroup2.devices.allow: c 10:200 rwm
   lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file
   

4. Save the file and start the container again

Starting Tailscale with Advanced Features

Now we can start Tailscale with subnet advertising and exit node functionality:

1. Run the following command:

   tailscale up --advertise-routes=192.168.1.0/24 --advertise-exit-node
   

   Replace 192.168.1.0/24 with your local network subnet

2. Follow the URL provided to authenticate your Tailscale instance

Verifying Tailscale Configuration

After setting up Tailscale, it's important to verify that everything is working correctly:

1. Check Tailscale status:

   tailscale status
   

   This will show all devices connected to your Tailscale network

2. Log into the Tailscale admin console in your web browser

3. Verify that your new device appears in the list

4. Approve subnet routes and exit node functionality if needed

Understanding Tailscale Features

Subnet Advertising

Subnet advertising allows you to access devices on your home network that don't have Tailscale installed. This is useful for IoT devices or other network-connected appliances.

Exit Node Functionality

The exit node feature turns your Tailscale instance into a private VPN. When enabled on a client device, all internet traffic is routed through your home network, providing an extra layer of privacy when using public Wi-Fi.

Tailscale Network Management

Effective management of your Tailscale network is crucial for maintaining security and functionality:

1. Device Management: Regularly review connected devices in the Tailscale admin console. Remove any unauthorized or outdated devices.

2. Access Controls: Use Tailscale's ACLs (Access Control Lists) to define which devices can communicate with each other. This helps in creating a secure network topology.

3. Key Expiry: Consider enabling key expiry for added security. This requires devices to re-authenticate periodically.

4. Monitoring: Keep an eye on network activity and bandwidth usage through Tailscale's monitoring features.

5. Updates: Regularly update Tailscale on all devices to ensure you have the latest security patches and features.

Integrating Tailscale with Other Services

Tailscale can be integrated with various services to enhance your home server setup:

1. Remote Desktop Access: Install remote desktop software like Remmina or Apache Guacamole in another LXC container. Use Tailscale to securely access these services from anywhere.

2. File Sharing: Set up a file server (e.g., Nextcloud) and use Tailscale for secure remote access.

3. Media Streaming: Configure Plex or Jellyfin servers and access them remotely through your Tailscale network.

4. Home Automation: Securely access home automation systems like Home Assistant over Tailscale.

5. Development Environments: Use Tailscale to securely access development servers or databases hosted on your home server.

Troubleshooting Common Issues

While setting up Tailscale in Proxmox is generally straightforward, you might encounter some issues. Here are some common problems and their solutions:

1. Connection Issues:

   • Ensure that the container has internet access.
   • Check if the Tailscale service is running: systemctl status tailscaled
   • Verify firewall settings in both Proxmox and the container.

2. Subnet Advertising Not Working:

   • Double-check the IP forwarding configuration in sysctl.conf.
   • Ensure the correct subnet is advertised in the Tailscale up command.
   • Verify that subnet routes are approved in the Tailscale admin console.

3. Exit Node Functionality Issues:

   • Confirm that the exit node is approved in the Tailscale admin console.
   • Check if your client device is configured to use the exit node.

4. Performance Problems:

   • Ensure the LXC container has adequate resources.
   • Consider using a dedicated network interface for Tailscale traffic.

5. Authentication Errors:

   • Re-run the tailscale up command and go through the authentication process again.
   • Check if your Tailscale account has any restrictions or if you've reached device limits.

Best Practices for Tailscale in Proxmox

To ensure optimal performance and security of your Tailscale setup in Proxmox:

1. Regular Updates: Keep both Proxmox and the LXC container updated.

2. Backup Configuration: Regularly backup your Tailscale and container configurations.

3. Monitoring: Set up monitoring for the Tailscale container to track resource usage and uptime.

4. Security: Use strong passwords and consider implementing two-factor authentication for Proxmox and Tailscale access.

5. Documentation: Keep detailed documentation of your setup, including network configurations and any custom settings.

6. Testing: Regularly test your Tailscale connection from various devices and locations to ensure consistent performance.

Advanced Tailscale Configurations

For users looking to further customize their Tailscale setup:

1. Split Tunneling: Configure Tailscale to only route specific traffic through the VPN, improving performance for other applications.

2. Custom DNS: Set up custom DNS servers for your Tailscale network to enhance privacy or implement content filtering.

3. Multi-Factor Authentication: Implement MFA for Tailscale authentication to add an extra layer of security.

4. API Integration: Utilize Tailscale's API for automation and integration with other systems.

5. Network Segmentation: Use Tailscale ACLs to create separate network segments for different purposes (e.g., IoT devices, work-related services).

Conclusion

Setting up Tailscale in a Proxmox LXC container provides a powerful and flexible way to manage your home network and access resources remotely. By following this guide, you've created a secure, efficient, and scalable networking solution.

Remember to regularly update and maintain your Tailscale setup to ensure optimal performance and security. As your needs grow, explore additional features and integrations to make the most of your Tailscale network.

With Tailscale configured in Proxmox, you now have a robust foundation for building a sophisticated home server environment with secure remote access capabilities. Whether you're managing smart home devices, accessing media servers, or working on development projects, Tailscale provides the connectivity and security you need.

Continue experimenting with different configurations and use cases to fully leverage the power of Tailscale in your Proxmox environment. Happy networking!

Article created from: https://youtu.be/QJzjJozAYJo?si=kJrAHxX_tmcDyTKT