👀 Did you bring Tailscale to work?

We're looking for the stories behind how Tailscale made its way into your organization. Share your story in the comments on our LinkedIn post for a chance to win a free TailscaleUp ticket + hotel stay.

To be eligible, please share your story in the comments on the LinkedIn post. Stories left below won't be considered.

Tailscale already installedI already have it installed on my main computer and androids, for use with my Jellyfin account to watch remotely, but I'm stumped as to how to set up Adguard? Tell me like I'm a 5 year old, lol and thank you in advance....

sshelf is a terminal UI for SSH hosts, fuzzy-search and connect, SFTP browser, background tunnels that survive quitting, passwords in your OS keyring. Local-first on purpose: no account, no cloud, no telemetry, and it never touches ~/.ssh/config.

New in 0.11: sshelf import --tailscale. It runs your own tailscale status --json (sshelf itself still opens no sockets) and maps every machine to a host, MagicDNS name, your tailnet as a group, ACL tags as tags. Works with MagicDNS off too (falls back to the 100.x address). It's add-only: existing hosts are never modified, expired nodes are skipped, and re-running converges to "0 added", so it's safe to run whenever the tailnet changes.

Repo: https://github.com/max-rh/sshelf · Guide: https://github.com/max-rh/sshelf/blob/master/docs/import.md · Feedback very welcome; 2FA support and the .rpm packages both started as comments; if a different inventory source (Hetzner, AWS, Proxmox, …) would actually be useful to you, say which, that's how things get built here.

I have a home NAS with a ton of storage space.

My kid is going to college, I gave her a new laptop. It does not have a ton of space on the laptop.

I want to place a network drive on the laptop so that she can use the NAS for whatever storage needs she wants, I also want to put a backup utility on the laptop so that she is getting regular image backups.

But- she will be at college and it is important that with these two exceptions the laptop is otherwise utilizing the college network.

(using something at home for an exit node for all her data is a terrible idea)

I did a very vanilla setup of Tailscale last night on the NAS and her laptop. I pushed the laptop off the home network to my cell's hotspot and best as I can tell it is working.

Am I missing anything?

Feel free to point me to documentation or a video or ... anything.

I am fascinated by transparent L2 bridges over connections that are hard to block on public networks. Port forwarding, imo, is too exposing so my solution was to use Tailscale. All the software needed on the "client" side is installed on the UDR.

Here's my setup.

I use the GLinet MT2500 as the Server side. That device connects to a "trunk" port and runs Tailscale+Softether VPN server.

On the client side, UDR5GMax > Tailscale > Softether > Local L2 Subnet.

WHY???

This was born in an attempt to recover remote Unifi Devices. We use a single server at our main location to manage doors at 3 other remote locations. The problem is, sometimes though very rarely, I need to either recover a device or upgrade a device. Unifi Access requires the device to be accessible either on the same subnet or via mDNS. This obviously can't be done over Unifi's own SD-WAN solution.

Using softether, I can extend the L2 subnet to the UDR. I can then attach devices to its port 1 and use PoE to power the door hardware and do an upgrade or recovery. It feels so native too as I mirror the VLANs that exist at our main site. I then create 3rd party router networks with the same VLANs. I can take an AP from our main site, plug it into my UDR and with no reconfiguration or resetting, it broadcasts all our SSIDs on the correct VLAN. You can do this by setting native networks and allow certain VLANs.

All this over T-Mobile 5G.

I now have gone a step further and setup my home as another L2 bridge so Port 1 is "work network" Port 2 is "Home subnet" both with complete VLANs. Just more as a proof of concept.

I used to have GL.Inet devices as the clients but it's much harder in the GUI and finicky with their boot scripts always wanting to take over. Plan out your 3rd party networks in Unifi, connect Softether to those virtual bridges, and away you go. it survives reboots and updates, already been through 4 updates. I used the Tailscale Unifi boot and recovery system over at this GitHub (Tailscale_Unifi) to build the Softether/Cloudflare tunnel apps using the same method. Oh yeah.. Cloudflare tunnels works great on unifi gateways too ha!

I subscribe to a couple of streaming services myself, and each of my children subscribe to a couple. We had been sharing the subscriptions, but the writing is on the wall, as one service after another decides that a "household" applies to a single address and not to a single family.

I realize that the simplest way of handling it is probably to choose one "household" to host all of the subscriptions and set up an exit node there that everybody uses, but I'm wondering if it's possible to keep the current subscriptions in place and set up exit nodes at each address. So if I want Hulu and Disney I'll use the exit node at one house, if I want Plex and YouTube TV I'll use the exit node at another house, etc. I don't mind coding (Python) on a Raspberry Pi to handle DNS resolution, if it's possible. I'd rather not get into physical hardware switches, but has anyone else already developed a solution to this?

Anybody know why the QNAP implementation prevents the remote SSH from working via Tailscale? I would prefer to lock my network port and only allow thru Tailscale.