Exit Node and Adding subnets

[Blindside10]

Hello, I was just wondering how you would go about adding this device as a exit note and pushing routes if possible.

Thank you so much for making this script it worked first try out of the box and just simply worked.

[notheotherben]

Great question, you'd just need to run /mnt/data/tailscale/tailscale up --advertise-exit-node --advertise-routes=10.0.0.0/24,10.0.1.0/24 and it should work from that point onwards (including after reboots). This is, for all intents and purposes, the same as what you'd do if it were a normal Linux server (and the rest of Tailscale's docs should also work without any major effort).

[Blindside10]

I should have known that. I for some reason just didn't think it would persist after reboot or firmware upgrades. I'll give that a go thanks for promptly replying!

[notheotherben]

Cool, feel free to reach out if there are any issues (so we can document them and help anyone else that runs into them).

[Blindside10]

I don’t know if I am just doing it wrong, but I changed the command above to update the routes according to my network. It is not actually passing the traffic. It is only letting me hit the gateway IP. The only part I changed was my ips. 10.52.3.0/24,192.168.2.0/24
Any thoughts? @notheotherben

[notheotherben]

Without knowing more about your configuration it is hard to say, I've not had any issues once these appear on the Tailscale dashboard and have enabled routing to those subnets and configured my other machines to accept these routes.

[Blindside10]

I mean, all that I really did was used the guide here and then added the exit node and routes. Like this
/mnt/data/tailscale/tailscale up --advertise-exit-node --advertise-routes=10.52.3.0/24,192.168.2.0/24
What specifically would be more helpful? Typically when I have done this it kind of just works after enabling the routes in Tailscale, because my clients I access them from automatically update the routes accordingly.

[Blindside10]

I have tested this on now 2 UDMPs and the exit node function works perfectly fine. However, the routes do not outside of the gateway IP. Which seems odd. My UDMPs are on firmware version 1.10.0. I do notice tailscale claims that it is out of date, but I don't think that would break this functionality.

[notheotherben]

Ah interesting, I'm able to reproduce that myself - I'll need to look into whether this is a side effect of any firewall rules on the UDM, but if you do manage to figure out the cause before me, please let me know.

[Blindside10]

My current firewall is just all default nothing custom on it at all. Only thing custom about it is I made a couple VLANs, but that's all. No drop rules or anything yet. If you want a picture or something let me know.

[notheotherben]

Just to circle back here, I've had a few cases here where I've seen timeouts establishing connections between (in my case, my Android device running on mobile data and devices on a dedicated VLAN whose addresses are exposed via subnet advertisement on the UDM). Unfortunately (or perhaps fortunately) that is short lived and I am usually able to connect with only limited retries - and once it is working, it's rock solid.

The command I'm using to configure Tailscale on the UDM is as follows: ./tailscale up --accept-dns=false --advertise-exit-node --advertise-routes=192.168.32.0/20,192.168.96.0/20 --advertise-tags "tag:network-infra"

Let me know if any of that helps you and I'd strongly suggest tail -f /var/log/tailscaled.log to see what Tailscale's view of the world is there.

[Blindside10]

Alrighty. I am trying it and this is what I am getting so far

Welcome to UniFi Dream Machine!
/mnt/data/tailscale/tailscale up --accept-dns=false --advertise-exit-node --ad
vertise-routes=10.52.3.0/24,192.168.2.0/24 --advertise-tags "tag:network-infra"
too many non-flag arguments: ["tag:network-infra"]

[Blindside10]

Actually, maybe it's just because the spacing was off in the command

[Blindside10]

Well, I went ahead and adjusted the command and still cannot seem to ping devices on the advertised routes.

[notheotherben]

Tell you what, would you mind opening an issue on tailscale/tailscale about what you're seeing and have the experts take a look, I suspect they're going to be better able to troubleshoot than I am. The one piece of good information is that at least we know it does work in at least one scenario, so the rest should be diagnosable with the right know-how.

[MBombeck]

Sorry for open the issue again.
@Blindside10 Did you resolve the issue? If not did you open a issue at tailscale/tailscale?
Sitting in the same boat here. Quite sure the the issue is related to VLAN

[Blindside10]

@MBombeck I have not reached out to them yet. I suppose I am confused about what I should actually include in the report, because there really isn't much considering everything is reporting correctly other than the subnet routes not working...
Also, I do think this issue shouldn't of been auto closed. So, if an admin see this I would personally appreciate it if you opened it back up or made a new one regarding it. I'll link my reported issue once it is submitted.
Updated tailscale/tailscale#2883 (comment)

[Blindside10]

This seems to be working properly now. I really appreciate the time patience and all the effort that went into resolving this for me. You rock! Keep on doing your thing I really appreciate your work.