From da981a7b40b203225ecb864dde76f1dc60fc8589 Mon Sep 17 00:00:00 2001 From: Kaloyan Danchev Date: Tue, 3 Nov 2026 21:51:49 +0200 Subject: [PATCH] docs: Unraid exit node approved Approved in the Tailscale admin console, so xtrm-unraid now shows as "offers exit node" and appears in tailscale exit-node list. The tailnet has two exit nodes: mikrotik-tailscale (primary) and xtrm-unraid (fallback). Neither has been exercised from the Mac. Noted that without --exit-node-allow-lan-access an exit node cuts the client's own LAN access, which would break an SSH session routed over Tailscale. Co-Authored-By: Claude Opus 5 --- docs/09-TAILSCALE-VPN.md | 19 ++++++++++++++----- docs/CHANGELOG.md | 2 +- 2 files changed, 15 insertions(+), 6 deletions(-) diff --git a/docs/09-TAILSCALE-VPN.md b/docs/09-TAILSCALE-VPN.md index fe61cd8..2923ef0 100644 --- a/docs/09-TAILSCALE-VPN.md +++ b/docs/09-TAILSCALE-VPN.md @@ -191,7 +191,7 @@ Tailscale VPN running as a container on MikroTik hAP ax³, providing remote acce | Tailscale IP | Device | Status | |--------------|--------|--------| | 100.74.219.35 | MikroTik hAP ax³ (container) | Online | -| 100.100.208.69 | xtrm-unraid (Unraid plugin) | Online | +| 100.100.208.69 | xtrm-unraid (Unraid plugin, offers exit node) | Online | | 100.100.208.70 | xtrm-unraid (old node, deleted 2026-11-03) | Removed | | 100.112.103.7 | hapax3 (old native install) | Offline | | 100.75.93.123 | mikrotik-tailscale (previous container) | Offline | @@ -230,7 +230,7 @@ logged out since roughly May 2026 and was re-enrolled on 2026-11-03. |------|-------|--------| | `--advertise-routes` | none | The old `192.168.31.0/24` advertisement was dropped. That subnet is only the macvlan shim (`br0-shim` holds `192.168.31.250/32` with one host route to `192.168.31.4`) — nothing reachable lives there. | | LAN subnet routing | not advertised | The MikroTik container is primary for `192.168.10.0/24`, `.20`, `.25`, `.30`. A second advertiser for a subnet Unraid itself sits on would create a routing conflict. | -| `--advertise-exit-node` | on | Redundant with the hAP today, kept as a fallback on the 24/7 box. **Needs approval in the admin console** before it appears in `tailscale exit-node list`. | +| `--advertise-exit-node` | on | Redundant with the hAP today, kept as a fallback on the 24/7 box. **Approved in the admin console 2026-11-03** — shows as `offers exit node` and appears in `tailscale exit-node list`. | | `--accept-routes` | **false** | Critical. Unraid is *on* `192.168.10.0/24`; accepting the hAP's route for its own subnet would loop. This is why `tailscale status` reports the health warning "Some peers are advertising routes but --accept-routes is false" — expected here, not a fault. | | `--accept-dns` | false | Keeps local AdGuard resolution intact (Unraid AdGuard is config master). | | `--ssh` | on | Tailscale SSH. Needed — see the sshd caveat below. | @@ -287,7 +287,16 @@ AllowTcpForwarding yes # limetech - permit only root SSH tunneling Any non-root account added later will not be able to open tunnels. -### Open item +### Exit node -- Approve the advertised exit node for `xtrm-unraid` in the Tailscale admin - console (Machines -> xtrm-unraid -> Edit route settings). +Approved 2026-11-03. The tailnet now has two exit nodes: + +| IP | Node | +|----|------| +| `100.74.219.35` | `mikrotik-tailscale` (primary) | +| `100.100.208.69` | `xtrm-unraid` (fallback, 24/7 box) | + +Select one with `tailscale set --exit-node=xtrm-unraid`. Not exercised in anger +yet — note that without `--exit-node-allow-lan-access` an exit node cuts the +client's own LAN access, which will break an SSH session that is itself routed +over Tailscale. diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 5e37a82..7d5dc7e 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -10,7 +10,7 @@ - **[NETWORK]** Dropped the node's old `192.168.31.0/24` advertisement. That subnet is only the macvlan shim — `br0-shim` holds `192.168.31.250/32` with a single host route to `192.168.31.4`, and no container or service lives there. No LAN subnet routes are advertised from Unraid: the MikroTik container stays primary for `192.168.10.0/24`, `.20`, `.25`, `.30`. - **[NETWORK]** `--accept-routes=false` and `--accept-dns=false` kept deliberately. Unraid sits *on* `192.168.10.0/24`, so accepting the hAP's route for its own subnet would loop; the resulting "peers are advertising routes but --accept-routes is false" health warning is expected, not a fault. - **[SERVICE]** Tailscale SSH enabled on the node. Necessary because `/etc/ssh/sshd_config` binds only `192.168.10.20` and `192.168.31.250` with no wildcard, so sshd never listens on the Tailscale IP. Port forwarding over Tailscale SSH verified (`-L 18089:127.0.0.1:80` returned HTTP 302 from the Unraid web UI). -- **[SERVICE]** Exit node advertised from Unraid as a fallback to the hAP. **Pending manual approval** in the Tailscale admin console. +- **[SERVICE]** Exit node advertised from Unraid as a fallback to the hAP, and approved in the Tailscale admin console the same day. The tailnet now has two exit nodes: `mikrotik-tailscale` (100.74.219.35, primary) and `xtrm-unraid` (100.100.208.69, fallback). Neither has been exercised in anger from the Mac — without `--exit-node-allow-lan-access` an exit node cuts the client's own LAN access. - Detail, including the root-only `AllowTcpForwarding` behaviour in Unraid's stock sshd config, in `docs/09-TAILSCALE-VPN.md`. ---