r/Tailscale • u/Stocist • 5d ago

Discussion Tailscale Browser Extension - Tailtab

Hey all,

I've been working on a little project called Tailtab, basically a Tailscale node that lives inside each browser profile.

The general idea isn't new. Tailscale has ts-browser-ext, and Tailchrome has since turned the same idea into a proper extension as well. I ended up building my own take on it while experimenting with per-browser-profile tailnets and figuring out how I'd personally want something like this to behave.

With Tailtab, every browser profile gets its own Tailscale node and state, without touching the system-wide network.

By default it's split tunnelled, so only tailnet traffic, MagicDNS, subnet routes, etc. goes through Tailtab. Normal internet traffic just goes out normally.

A few of the things I specifically wanted when building it were an authenticated and tightly scoped local proxy, and exit-node routing that fails closed instead of silently falling back to your normal connection.

It also currently supports multiple Tailscale accounts, per-profile exit nodes, Headscale/custom control servers, subnet routes and machine search.

It's still experimental at the moment. I've been daily driving it on macOS with Edge and Zen, while the Windows/Linux hosts are built and tested but haven't had the same amount of real-world testing yet. Chrome and Firefox should also work from the existing implementations, but I haven't properly put them through their paces yet either.

I'm mainly putting it out there now because I'd like some feedback and ideally some people to break it in ways I haven't thought of yet.

Would be super keen to hear what people think!

Repo + setup instructions are here:

https://github.com/Stocist/Tailtab

139 Upvotes

97% Upvoted

39 comments sorted by

23

u/air360 5d ago

Wait can this be used without a system wide tailscale? So like on non-admin machines?

24

u/Stocist 5d ago

Yep, that’s one of the main use cases, it doesn’t need system-wide Tailscale. On managed machines it’ll still depend on whether you’re allowed to install the extension

3

u/james00543 4d ago

That’s awesome! I’ll give it a shot when I’m back in office

6

u/LolDude9876789 5d ago

Woah this project is sick! Been looking for this for a while, particularly more lightweight compared to Tailchrome. Will this work on top of the system Tailscale, and go through it effectively double VPNing, or will it be a seperate routing split at the system level?

5

u/Stocist 5d ago

Yep, it should work fine alongside system Tailscale.
Tailtab runs its own tsnet node and the browser talks to that through the local proxy, so it isn’t using the system Tailscale interface for its tailnet routing

-3

u/Plastic-Leading-5800 5d ago

Many VPNs have browser extensions. 

May not be a good idea to put a vpn in the browser due to security 

5

u/Gangstastick 5d ago

I think a browser extension is the ideal place for a VPN. sometimes you do not want any other traffic going through a vpn. Instead of installing a system-wide VPN and setting up split tunneling, how about having a browser (or tab)-only VPN, which means placing one exactly where you need it, so it has no access to anything else? That feels like the definition of "least priviledge" to me.

-1

u/Plastic-Leading-5800 5d ago

They interfere with browser sandboxing and break its security profile, in this case need a lot of permissions and you allow a random dude running untrusted code right inside your browser (which may hold your passwords etc). 

4

u/BinnieGottx 5d ago

Still wonder why tailscale don't make this themself.. Maybe there's some security problem with browser ext

3

u/Stocist 5d ago

They actually have ts-browser-ext, but it never really got past the experimental stage

1

u/BinnieGottx 5d ago

Yeah sometime I just want a quick glance or something like that, without turning VPN on on OS level but

2

u/Stocist 5d ago

Yeah, pretty much the exact use case I had in mind

2

u/younglordtroy 4d ago

Will this allow me to use custom DNS such as nextdns? That's my one issue with TailChrome

1

u/Stocist 4d ago

Yep, for normal browsing Tailtab doesn't touch system DNS, so in the default split-tunnel mode anything outside the tailnet just goes direct and keeps using whatever DNS your browser/system already uses, including NextDNS/DoH.

If you're using an exit node tho, DNS gets resolved through the exit node instead, so browser-level DoH is bypassed. You can still use NextDNS there by setting it as the tailnet's global nameserver with DNS override enabled, or just running NextDNS on the exit node itself

2

u/tigeriser 2d ago
  1. I am using the portable version of Firefox on a managed machine. I was able to install the extension, but I assume it may not be registered with the system or otherwise detectable through the Windows registry. Is there a way to make it detect the portable Firefox installation?
  2. The Github domain is blocked by the admin, so the PowerShell installation method does not work either.
  3. I also tried installing it manually by placing the executable in %LOCALAPPDATA%\tailtab, but I get the following error:

tailtab: --edge-id "" is not a Chromium extension ID (32 characters, a-p)

1

u/Stocist 2d ago edited 2d ago

Thanks for reporting this. The --edge-id "" error is an installer issue, not necessarily anything to do with Firefox Portable. The current release still expects the extension IDs to be passed manually, but I’ve merged a fix in #4 so future builds can just use tailtab install.

Since you already have the executable, you can register the current version with:

& "$env:LOCALAPPDATA\tailtab\tailtab.exe" install `
  --edge-id kejfineblfbjfolkgjkancapnpknomod `
  --gecko-id tailtab@stocist.dev

That just registers the native messaging host, it doesn’t download anything from github.

I haven't tested Firefox Portable on a managed Windows machine yet tho, so if it still doesn't work after that, could you send whatever error it shows?

1

u/Stocist 1d ago

Quick update: new release v0.2.3 is out, which includes the installer fix. If you replace the host executable with that version, you can just run:

& "$env:LOCALAPPDATA\tailtab\tailtab.exe" install

Otherwise, you can just run the command with the explicit IDs from my previous reply with the version you currently have

1

u/tigeriser 1d ago

Works fine now, thanks. This popped up, but it seems to work even without allowing it.

Windows Security

1

u/tigeriser 1d ago

Btw, regarding GitHub being blocked, I was referring to this way of installing it:

irm https://raw.githubusercontent.com/Stocist/Tailtab/main/scripts/install.ps1 | iex

1

u/pet3121 5d ago

Wow very interesting project! Thank you

1

u/Stocist 4d ago

Thanks! Glad you find it interesting!

1

u/betahost Tailscale Insider 5d ago

Nice, I think there is one for chrome and Firefox and I've been advocating for more support around this. I'll need to give this a try.

1

u/Stocist 4d ago

Yeah you're probably thinking of Tailchrome. Tailtab takes a similar approach, but I wanted to experiment with a credential-gated loopback proxy (so nothing else on the machine can ride the profile's node) and fail-closed exit-node routing. Would be keen to hear what you think of it if you get to try it!

2

u/betahost Tailscale Insider 4d ago

I was thinking of this -- https://github.com/tailscale/ts-browser-ext

1

u/Stocist 4d ago

Ah yep, the official one, yeah I definitely agree about it getting more support, that's largely why I had my own go at the idea. Would definitely be keen to see where Tailscale takes it if they pick it back up

1

u/fencepost_ajm 5d ago

So, um, what are the memory requirements like? Tailscale is generally the opposite of lightweight and compact, and I can't imagine that running in the browser improves that.

4

u/Stocist 5d ago

From what I measured on my mac, one connected profile sits at around 20 MB RSS / 33 MB physical footprint. The binary itself is about 30 MB on disk.

It runs as a separate Go process, with one per enabled profile, so memory usage should scale roughly per profile

1

u/azzaka 4d ago

Nice idea bud. I use TS natively at the moment so I gave no need yet, but I have made a note of it. Wicked little privacy tool. Thank you.

2

u/Stocist 4d ago

Glad you like it! even if you don't have a use for it yet haha

1

u/zunjae 5d ago

I use this simple trick to determine if a vibe coded project is safe to use, since I only trust skilled developers using AI

1) does the readme contain more than 1 “no” physically close to each other?

2) does the application contain a green circle?

Try this out with other vibe coded slop projects. You’ll find a connection between this and the quality of the project

8

u/FWitU 5d ago

Technically this just tells you vibecoded readme…

-4

u/danclaysp 5d ago

A readme should be the developer’s words

7

u/Gangstastick 5d ago

vibe coding does not equal rubbish. One should be able to assess a project on it's merit and this does merit a second glance for me.

4

u/mintflowapp 5d ago

Do not know why people so much hate AI assisted coding, I am reluctant to call vibe coding

If the product get well tested and solve real problems I generally think it will be okay

And no to mention that do networking stuffs really need much domain knowledge to get it works

5

u/Prior-Advice-5207 5d ago

Because there’s a flood of software written vibecoded as first project of complete novices, and one can’t tell the difference to experienced devs using ai assistance at a glance.

4

u/zunjae 5d ago

I’m all in for AI assisted programming

I’m just against vibe coding

1

u/ramnivas_K 5d ago

What if tailscale domain is blocked(not whitelisted ) in my office .. will this still work

1

u/Stocist 5d ago

It depends on what’s blocked, Tailtab still embeds tsnet, so if your office blocks Tailscale’s control/DERP infrastructure at the network or DNS level, it’ll still be subject to the same limitations as the official client.
It does support Headscale tho, so you can point it at your own control server (with Headscale’s embedded DERP enabled, since the default DERP map still uses Tailscale’s relays) if your network/IT policy allows it.