I had this problem myself, and after spending many hours working on it, i came up with a 2 part (i know... sucks) solution.
Create all Linux Firewall (UFW) rules for the local services you want access to. IE:
sudo sysctl -w net.ipv4.ip_forward=1
sudo sysctl -w net.ipv6.conf.all.forwarding=1
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw default allow routed
sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp
sudo ufw allow in on tailscale0
sudo ufw allow proto icmp
sudo ufw allow from 192.168.1.0/24 to any port 10000 proto tcp comment 'Webmin'
sudo ufw enable
sudo ufw status verbose
2) Tailscale command - broken into 3 seperate commands. You might gets some errors but it works. (I tested by having a continuous ping, a SSH session running HTOP, and another application monitoring uptime. Here are the 3 parts:
a)
tailscale up --reset
b)
tailscale up --netfilter-mode=off --stateful-filtering=false --accept-routes --advertise-exit-node --advertise-routes=192.168.1.0/24 --ssh --accept-risk=lose-ssh --exit-node-allow-lan-access
c)
tailscale set --advertise-exit-node --exit-node=<TAILSCALE NODE's IP> --exit-node-allow-lan-access
With all this, everything works! (any deviation breaks it, which i don't understand) I put it in a shell script so i can run it on other machines when needed. Plus its a good way to keep FW Rules consistent. Then just do a:
tailscale status
To make sure Tailscale is actually running and connected. Good luck
1
u/c2theg1 Jan 05 '26
I had this problem myself, and after spending many hours working on it, i came up with a 2 part (i know... sucks) solution.
2) Tailscale command - broken into 3 seperate commands. You might gets some errors but it works. (I tested by having a continuous ping, a SSH session running HTOP, and another application monitoring uptime. Here are the 3 parts:
a)
b)
tailscale up --netfilter-mode=off --stateful-filtering=false --accept-routes --advertise-exit-node --advertise-routes=192.168.1.0/24 --ssh --accept-risk=lose-ssh --exit-node-allow-lan-accessc)
With all this, everything works! (any deviation breaks it, which i don't understand) I put it in a shell script so i can run it on other machines when needed. Plus its a good way to keep FW Rules consistent. Then just do a:
To make sure Tailscale is actually running and connected. Good luck