Using Tailscale And Custom DERP Server

Tailscale

Installing

Tailscale is a zero config VPN for building secure networks. Install on any device in minutes. Remote access from any network or physical location.

https://tailscale.com/download/

Running

Subnet

Subnet routers act as a gateway，

Tailscale 网络上的节点访问子网内的机器，流量都会经过这个节点，所以说作为此子网的网关

Example:

作为子网网关节点 --advertise-routes=192.168.0.0/24,10.0.1.0/24

接受其它的子网 --accept-routes

Subnet routers and traffic relay nodes

Learn how to relay traffic from your Tailscale network onto your physical subnet.

https://tailscale.com/kb/1019/subnets/

Exit Node

Exit Node 功能允许您将所有非 Tailscale 互联网流量路由通过您网络上的特定设备。负责路由流量的设备称为“出口节点”。

Example:

作为 Exit Node: --advertise-exit-node

使用某个 Exit Node: --exit-node node_name

Exit Nodes (route all traffic)

See how to route all internet traffic through a specific device on your network.

https://tailscale.com/kb/1103/exit-nodes/

DNS

when you enable MagicDNS, Tailscale automatically adds search domains to your network. With these search domains you only need to type the machine name to access a device.

MagicDNS

Find out how to automatically register DNS names for devices in your Tailscale network.

https://tailscale.com/kb/1081/magicdns/

Tailscale SSH

Use Tailscale SSH to manage the authentication and authorization of SSH connections on your tailnet.

https://tailscale.com/kb/1193/tailscale-ssh/

Example:

启用 SSH --ssh

Derp Server

Running with docker

Mount tailscaled.sock 并且设置 DERP_VERIFY_CLIENTS=true , 则只允许 Tailscale 子网的机器使用这个 DERP server

DERP_ADDR 这个可以设置成 443，则可以使用 letsencrypt 自动生成证书，其它的端口需要手动生成证书，证书的名称必须为 $domain.key 和 $domain.crt

运行成功后访问 https://$domain:1443, 出现下面的截图则表示成功

ACL 配置

完整的配置：

tailcfg package - tailscale.com/tailcfg - Go Packages

https://pkg.go.dev/tailscale.com/tailcfg#DERPMap

Docker 镜像

derper-docker

fredliang44 • Updated Nov 7, 2024

官方说明文档

Custom DERP Servers

Find out when you might want to run your own DERP server and how to do it.

https://tailscale.com/kb/1118/custom-derp-servers/