Run Tailscale on Render

Tailscale is a zero-config VPN service built on top of Wireguard. It's great for accessing devices and applications behind firewalls, and you can use it to connect to all your private services on Render with this repo.

A Tailscale subnet router acts as a gateway to your Render private network, enabling connections to any and all internal IPs (of the form 10.x.x.x) in your Render network.

Deployment

One Click Deploy

Use the button below to deploy a Tailscale subnet router on Render. Generate a Tailscale auth key and provide that as the TAILSCALE_AUTHKEY environment variable in Render. Use a one-off key for maximum security.

Usage

Deploying this repo will create a subnet router in your Tailscale network. The first time you deploy, you'll need to enable the subnet routes you want access to from the Tailscale admin panel. Once the subnet router is up and running, you can connect to other private services in your Render network. To find the internal IP address for a Render private service, go to the web shell for your subnet router service and run dig with the private service's host name as the only argument.

Peer Relay

This service supports acting as a Tailscale Peer Relay, providing a high-throughput relay path for tailnet devices that can't establish direct connections. This is useful when other devices in your tailnet are behind strict NATs and DERP server latency is unacceptable.

Enable peer relay

Set the RELAY_SERVER_PORT environment variable to any open UDP port (e.g. 40000). The Render firewall must allow inbound UDP on that port from other tailnet devices.

Optionally, set RELAY_SERVER_STATIC_ENDPOINTS to a comma-separated list of ip:port pairs to advertise additional endpoints (useful behind a load balancer or port-forwarding rule):

RELAY_SERVER_PORT=40000
RELAY_SERVER_STATIC_ENDPOINTS=203.0.113.10:40000

Grant policy

After enabling the relay, add a tailscale.com/cap/relay grant in your tailnet ACL policy to allow devices to use it. The src should be the devices that need to be reached through the relay (typically those behind a strict NAT), and the dst should identify this Render service (by tag or hostname).

{
  "grants": [
    {
      "src": ["tag:render-ohio", "autogroup:member"],
      "dst": ["tag:render-subnet-router"],
      "app": {
        "tailscale.com/cap/relay": []
      }
    }
  ]
}

Verify

Once traffic is flowing, confirm peer relay is active:

tailscale status | grep peer-relay

To disable peer relay, set RELAY_SERVER_PORT to an empty string and redeploy.