Build a Zero‑Trust Mesh VPN with Tailscale: Exit Nodes, Subnet Routers, and ACLs

on

Overview

If you manage a home lab, remote workers, or small office networks, a traditional hub‑and‑spoke VPN can feel clunky and fragile. Tailscale solves this by creating a zero‑trust mesh VPN on top of WireGuard, giving every device a stable, private IP while punching through NAT without port forwarding. In this step‑by‑step guide, you will install Tailscale, configure an exit node, expose LANs via a subnet router, and apply fine‑grained access control with ACLs. You will also learn how to publish a local service securely with Tailscale Serve and Funnel.

Prerequisites

You will need: (1) a Tailscale account (GitHub, Google, Microsoft, or SSO), (2) administrator privileges on the devices you will connect, and (3) at least one Linux machine (Ubuntu/Debian or RHEL/CentOS/Alma/Rocky). Optional: a Windows or macOS device for testing.

Step 1 — Install Tailscale

On Ubuntu/Debian, the one‑liner below adds the repository and installs Tailscale safely. Run it on each machine you want to join to the mesh:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

On RHEL/CentOS/Alma/Rocky:

curl -fsSL https://tailscale.com/install.sh | sh
sudo systemctl enable --now tailscaled
sudo tailscale up

On Windows, download the installer from tailscale.com/download and sign in. On macOS, install via the App Store or Homebrew (brew install --cask tailscale), then sign in.

Step 2 — Verify connectivity and name your devices

After running sudo tailscale up and logging in, each device receives a 100.x.y.z Tailscale IP and a MagicDNS name (e.g., host.example.ts.net). Verify from any node:

tailscale status
tailscale ping <other-hostname>
tailscale ip -4

Give devices clear names in the Tailscale admin console to keep your network understandable (e.g., "lab-gw", "media-nuc", "dev-laptop").

Step 3 — Enable an exit node (optional, for secure internet via one device)

An exit node lets clients send all internet traffic through a trusted node (e.g., your home server) when on public Wi‑Fi.

# On the exit node:
sudo tailscale up --advertise-exit-node

Approve the exit node in the admin console (Machines → select the node → check “Exit node”). To use it from a client:

# On the client:
sudo tailscale up --exit-node=<exit-node-name-or-ip> --accept-dns=true

Step 4 — Advertise a LAN via a subnet router

If you want devices on Tailscale to reach non‑Tailscale hosts on your LAN (like printers, NAS, or hypervisors), set up a subnet router. Choose a Linux box on that LAN:

# Enable IP forwarding
sudo sysctl -w net.ipv4.ip_forward=1
sudo sysctl -w net.ipv6.conf.all.forwarding=1
# Make it persistent
echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding=1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl --system

# Advertise your LAN subnet(s), e.g., 192.168.1.0/24
sudo tailscale up --advertise-routes=192.168.1.0/24

Approve the routes in the admin console. Now any Tailscale node can reach 192.168.1.x hosts through the router. If your router has a firewall, allow forwarding from the Tailscale interface (usually tailscale0) to the LAN.

Step 5 — Apply zero‑trust ACLs and tags

Tailscale’s policy file lets you define who can reach what. In the admin console (Access controls), start with an explicit allowlist. This example grants SSH and HTTPS from admins to servers and Plex access to everyone, while scoping write access with

Comments

Post a Comment

Subscribe to: Post Comments (Atom)

Popular Posts

Install Ollama and Open WebUI on Ubuntu 24.04 with NVIDIA GPU Acceleration (Step-by-Step)

Overview Running a local large language model (LLM) is easier than ever thanks to Ollama and Open WebUI. Ollama handles model downloads and inference, while Open WebUI gives you a clean, chat-style interface in your browser. In this tutorial, you'll install both on Ubuntu 24.04 (works on 22.04 too), enable NVIDIA GPU acceleration, and deploy them with Docker Compose. The result is a fast, private AI stack you control. What You'll Need - Ubuntu 24.04 or 22.04 (fresh or existing server/desktop). - An NVIDIA GPU with recent drivers (Turing/RTX or newer recommended). - Root or sudo access. - Open ports 3000 (Open WebUI) and 11434 (Ollama) on your firewall if you access remotely. Step 1: Install NVIDIA Drivers and Verify CUDA First, update your system and install the recommended NVIDIA driver. On Ubuntu Desktop you can use Additional Drivers, but the CLI route is reliable: sudo apt update && sudo apt -y upgrade sudo ubuntu-drivers autoinstall sudo reboot After reboo...

Install a Local AI Chatbot on Ubuntu 24.04 with Ollama and Open WebUI (Step-by-Step)

Running a fast, private AI chatbot on your own computer or server is easier than ever. In this guide, you will install Ollama (a lightweight local LLM runtime) and Open WebUI (a modern web interface) on Ubuntu 24.04 . You will be able to chat with models like Llama 3 or Mistral without sending data to the cloud, and with optional GPU acceleration if you have an NVIDIA card. What you will need : an Ubuntu 22.04/24.04 machine (VM, bare metal, or WSL), at least 8 GB RAM (16 GB recommended for larger models), 15–30 GB free disk space for models, Internet access, and optional NVIDIA GPU drivers for acceleration. Why Ollama + Open WebUI? Ollama manages local large language models (LLMs) with simple commands and sensible defaults. Open WebUI gives you a clean, chat-style interface with features like prompt history, file uploads (for some models), and model switching. Together, they are a simple, reliable stack for a self-hosted AI experience. 1) Update Ubuntu and install basics First, ...

Install Ollama + Open WebUI on Ubuntu 24.04 with NVIDIA GPU Acceleration (Step-by-Step)

Overview This guide shows you how to install Ollama and Open WebUI on Ubuntu 24.04 with NVIDIA GPU acceleration. You will get a fast local AI stack that can run modern large language models (LLMs) like Llama 3 on your own hardware, secured and accessible in a web browser. We will cover GPU driver setup, Docker with the NVIDIA Container Toolkit, Ollama installation, Open WebUI deployment, basic security, and troubleshooting. Prerequisites - A machine running Ubuntu 24.04 (fresh or updated). - An NVIDIA GPU with at least 8 GB VRAM recommended for 8B models (more is better). - Internet access and sudo privileges. Step 1: Install the NVIDIA GPU Driver Install the recommended proprietary driver so CUDA becomes available to both Ollama and containers. sudo apt update && sudo apt install -y ubuntu-drivers-common sudo ubuntu-drivers autoinstall sudo reboot After reboot, verify the GPU is recognized: nvidia-smi You should see a driver version and your GPU model. If not, check...

Trending Now

Homogeneous Nucleation on Mars: A Textbook Process Finally Observed in Nature

on
By the end of this piece, you will understand what the Arsia Mons Elongated Cloud is, why it resisted explanation for several years after its first observation, and what the newly published model reveals about a physical process that has never been directly confirmed on any planet's atmosphere. The cloud that broke the model Every morning during Martian spring and summer, a thin, extremely long cloud forms near the Arsia Mons volcano and gradually elongates until it stretches to more than 1,000 miles before dissipating. The cycle then repeats for several months. The formation was first recorded by a probe in 2018, and from that point onward it became a persistent puzzle for atmospheric scientists working with Mars data. The cloud's geometry, its timing, and its seasonal recurrence all pointed to a real and reproducible physical process, yet no existing model could reproduce it. For a technical audience familiar with simulation work, the situation is analogous to a product...