Service Gateway

Service Gateway

The main feature: let ordinary devices on your existing LAN use specific services on your tailnet — without a Tailscale client on those devices, without moving them to another Wi-Fi and without changing your router.

The LAN client connects to the ESP32's own LAN address and a listen port. The ESP32 admits the connection only if the rule is enabled and not expired, the source is inside the rule's CIDR and protocol and port match; then it carries it over WireGuard to the tailnet destination. The remote peer sees the gateway's tailnet identity, and its own ACLs still decide what it accepts.

Five-minute example

Goal: an MQTT hub at 192.168.1.20 publishes to broker.your-tailnet.ts.net:1883 on another site.

1. Give the ESP32 a fixed LAN address (e.g. 192.168.1.50), join it to your tailnet and allow its identity to reach the broker in your tailnet ACL.
2. Status → Publish a Tailnet service (or Network → LAN → Tailnet). The guide checks the prerequisites and asks you to acknowledge the exposure.
3. Add a rule: TCP, listen 18830, destination broker.your-tailnet.ts.net, port 1883, source 192.168.1.20/32. It is saved disabled.
4. Test destination: the ESP32 makes one bounded TCP handshake (2 s) with the broker through the tunnel, while the rule is still disabled.
5. Enable the rule, optionally set an expiry, and point the hub at 192.168.1.50:18830. Any other LAN device trying that port is refused.

Evidence on each rule

• Destination test result: reachable, no_tcp_answer, udp_unverifiable, control_offline, unresolved… — each states what it does not prove.
• Last accepted and rejected LAN packet, last reply from the service, and the peer path (direct, DERP relay or offline).
• Service watch (optional, off by default) repeats the test for enabled TCP rules and can notify through ntfy/MQTT.
• Rules can be exported and imported; imported rules are forced off.

Limits

Up to 8 rules. A source address is not an identity: restrict each rule to single devices and keep the peer's ACL tight. AP-side port forwarding is a separate feature for devices on the gateway's own Wi-Fi.

Full guide: SERVICE-GATEWAY.md · Troubleshooting rule states.