Any luck forwarding traffic?

[darconeous]

Hello,

I was trying to use this to set up tailscale on my router so that I could have normal hosts on my network use the tailscale hosts without needing to actually have tailscale installed.

Unfortunately, I cannot seem to get this to work. I can ping my tailscale hosts just fine from my edgerouter:

admin@edgerouter:~$ ping 100.102.162.30
PING 100.102.162.30 (100.102.162.30) 56(84) bytes of data.
64 bytes from 100.102.162.30: icmp_seq=1 ttl=64 time=718 ms
64 bytes from 100.102.162.30: icmp_seq=2 ttl=64 time=27.6 ms
64 bytes from 100.102.162.30: icmp_seq=3 ttl=64 time=26.7 ms
64 bytes from 100.102.162.30: icmp_seq=4 ttl=64 time=26.3 ms
^C
--- 100.102.162.30 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3003ms
rtt min/avg/max/mdev = 26.351/199.760/718.324/299.393 ms
admin@edgerouter:~$ 

And when I use ip route get I can see how it does it (via routing table 52):

admin@edgerouter:~$ ip route get 100.102.162.30
100.102.162.30 dev tailscale0 table 52 src 100.115.216.28 
    cache 
admin@edgerouter:~$ 

But when I try to ping from another device on my network it's no dice:

darco@Bellatrix .ssh % ping 100.102.162.30                                 
PING 100.102.162.30 (100.102.162.30): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
Request timeout for icmp_seq 4
Request timeout for icmp_seq 5
Request timeout for icmp_seq 6
Request timeout for icmp_seq 7
Request timeout for icmp_seq 8
Request timeout for icmp_seq 9
^C
--- 100.102.162.30 ping statistics ---
11 packets transmitted, 0 packets received, 100.0% packet loss
darco@Bellatrix .ssh % 

And when I try to simulate that from my edge router via ip route get, I get an error:

admin@edgerouter:~$ ip route get 100.102.162.30 from 172.28.0.50
RTNETLINK answers: Invalid argument
admin@edgerouter:~$ 

Unless I use the source address of the router:

admin@edgerouter:~$ ip route get 100.102.162.30 from 172.28.0.2 
100.102.162.30 from 172.28.0.2 dev tailscale0 table 52 
    cache 
admin@edgerouter:~$ 

Forwarding is enabled:

admin@edgerouter:~$ sysctl -a | grep forward | grep tail
net.ipv4.conf.tailscale0.forwarding = 1
net.ipv4.conf.tailscale0.mc_forwarding = 0
net.ipv6.conf.tailscale0.forwarding = 1
net.ipv6.conf.tailscale0.mc_forwarding = 0
admin@edgerouter:~$ 

So I'm kinda stumped. Any ideas? It's not easy to just add a route to tailscale0 because tailscale0 isn't an actual network interface as far as Vyatta is concerned. :/

[darconeous]

For what it's worth, IPv6 routing seems to work excellent, it's only IPv4 that is having these sorts of routing problems. :/

[yubiao]

I see this post about adding an NAT rule: https://tky.io/2020/11/running-tailscale-on-a-ubiquiti-edgerouter/

[darconeous]

NAT shouldn't be necessary since I've added a route to the tailscale network. In any case, there should still be a route out to the tailscale network, I can't even resolve that.

[adrianmihalko]

Just add the NAT rule and it will work.

[bartaspoz]

Did you guys got it working? I have the same use case currently