jazzymc/infrastructure
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: Unraid exit node approved

Browse Source 
Approved in the Tailscale admin console, so xtrm-unraid now shows as
"offers exit node" and appears in tailscale exit-node list. The tailnet has
two exit nodes: mikrotik-tailscale (primary) and xtrm-unraid (fallback).

Neither has been exercised from the Mac. Noted that without
--exit-node-allow-lan-access an exit node cuts the client's own LAN access,
which would break an SSH session routed over Tailscale.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Kaloyan DanchevandClaude Opus 5 committed 2026-11-03 21:51:49 +02:00
1 parent 666b9baa5c
commit da981a7b40
2 files changed
+15 -6
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/09-TAILSCALE-VPN.md
+14 -5
View File
@@ -191,7 +191,7 @@ Tailscale VPN running as a container on MikroTik hAP ax³, providing remote acce
| Tailscale IP | Device | Status |
|--------------|--------|--------|
| 100.74.219.35 | MikroTik hAP ax³ (container) | Online |
| 100.100.208.69 | xtrm-unraid (Unraid plugin) | Online |
| 100.100.208.69 | xtrm-unraid (Unraid plugin, offers exit node) | Online |
| 100.100.208.70 | xtrm-unraid (old node, deleted 2026-11-03) | Removed |
| 100.112.103.7 | hapax3 (old native install) | Offline |
| 100.75.93.123 | mikrotik-tailscale (previous container) | Offline |
@@ -230,7 +230,7 @@ logged out since roughly May 2026 and was re-enrolled on 2026-11-03.
|------|-------|--------|
| `--advertise-routes` | none | The old `192.168.31.0/24` advertisement was dropped. That subnet is only the macvlan shim (`br0-shim` holds `192.168.31.250/32` with one host route to `192.168.31.4`) — nothing reachable lives there. |
| LAN subnet routing | not advertised | The MikroTik container is primary for `192.168.10.0/24`, `.20`, `.25`, `.30`. A second advertiser for a subnet Unraid itself sits on would create a routing conflict. |
| `--advertise-exit-node` | on | Redundant with the hAP today, kept as a fallback on the 24/7 box. **Needs approval in the admin console** before it appears in `tailscale exit-node list`. |
| `--advertise-exit-node` | on | Redundant with the hAP today, kept as a fallback on the 24/7 box. **Approved in the admin console 2026-11-03** — shows as `offers exit node` and appears in `tailscale exit-node list`. |
| `--accept-routes` | **false** | Critical. Unraid is *on* `192.168.10.0/24`; accepting the hAP's route for its own subnet would loop. This is why `tailscale status` reports the health warning "Some peers are advertising routes but --accept-routes is false" — expected here, not a fault. |
| `--accept-dns` | false | Keeps local AdGuard resolution intact (Unraid AdGuard is config master). |
| `--ssh` | on | Tailscale SSH. Needed — see the sshd caveat below. |
@@ -287,7 +287,16 @@ AllowTcpForwarding yes # limetech - permit only root SSH tunneling
Any non-root account added later will not be able to open tunnels.
### Open item
### Exit node
- Approve the advertised exit node for `xtrm-unraid` in the Tailscale admin
console (Machines -> xtrm-unraid -> Edit route settings).
Approved 2026-11-03. The tailnet now has two exit nodes:
| IP | Node |
|----|------|
| `100.74.219.35` | `mikrotik-tailscale` (primary) |
| `100.100.208.69` | `xtrm-unraid` (fallback, 24/7 box) |
Select one with `tailscale set --exit-node=xtrm-unraid`. Not exercised in anger
yet — note that without `--exit-node-allow-lan-access` an exit node cuts the
client's own LAN access, which will break an SSH session that is itself routed
over Tailscale.