FR: Reverse serve a HTTP endpoint/TCP port

[nagisa]

What are you trying to do?

I have a setup similar to that described in https://tailscale.dev/blog/tailscale-sucks, wherein there's a “weird” device on which I’m trying to put tailscale on.

Tailscale does work swimmingly with --tun=userspace-networking and I am able to initiate connections to it from the rest of the tailnet.

Unfortunately, this device also wants to have an ability to talk to specific peers on the tailnet over TCP. In this particular instance SOCKS5 as described in this document is not applicable in my case – the application in question does not support proxies.

How should we solve this?

In my case being able to write something along the lines of:

# The exact interface is subject to bikeshed...
tailscale --socket /tmp/tailscale/tailscaled.sock \
    serve tcp:{LOCAL PORT} tcp://{PEER HOSTNAME}:{REMOTE PORT}

would be great. This command would have Tailscale create a TCP socket listening on 127.0.0.1:{LOCAL PORT} and proxy all communications over to {PEER HOSTNAME}. From the application’s perspective this should largely be indistinguishable from connecting directly to the TCP socket at {PEER HOSTNAME}:{REMOTE PORT} with a proper kernel tun.

This concept could also be extended to UDP packets as well.

What is the impact of not solving this?

The only alternative I can think of is creating a program that would do pretty much the same and send the data over to the tailscale’s SOCKS endpoint.

Anything else?

No response

[bradfitz]

I don't think "tailscale serve" is the right place for it, but this is a cute idea.

You could probably just do it yourself with a helper program that runs alongside tailscaled that listens on 127.0.0.1:1234 and forwards those connections over tailscaled's existing SOCKS and/or HTTP outbound proxies.

[nagisa]

After looking into this a little further, socat looks like something that almost fits the use-case. It is fairly easy to (cross-)compile into a static binary, and is able to create the listener socket and pass on the data over to a SOCKS proxy:

socat TCP-LISTEN:1234,fork SOCKS4A:127.0.0.1:100.64.0.2:1234,socksport=1055

Problem is: upstream socat does not support SOCKS5 (although, somebody did go through an effort to make a fork with patches which I’ll test tonight;) and SOCKS4A appears to be incompatible enough that it does not work with tailscaled’s SOCKS5 proxy.

Would still be great to have something like this in tailscaled proper, but I can also appreciate if y'all would rather keep tailscaled leaner.

(EDIT: yes, the socat fork with SOCKSv5 support does work alright)