Note that in some circumstances, certain Operating Systems (Windows and Android) might not resolve these CNAMEs correctly. See this ongoing GitHub issue for more information if you run into issues. github.com/tailscale/tailscale/issues/7650

@Batwam0

3 ай бұрын

Another reason to use Linux then 🎉

@MrLurker101

3 ай бұрын

@@Batwam0 Android is based on what os?

@Batwam0

3 ай бұрын

@@MrLurker101 please read “GNU/Linux distributions” then, or as I've recently taken to calling it, GNU plus Linux. Android isn’t based on another OS, it’s its own OS. it just happens to use the same kernel as GNU/Linux which isn’t relevant here as this a userspace issue as far as I can tell.

@uidx-bob

3 ай бұрын

​@@Batwam0 I noticed this issue on my Debian 12 systems and FreeBSD 14 as well.

@uidx-bob

3 ай бұрын

I noticed this on windows 11, debian 12, and FreeBSD 14.

Setting a CNAME record in Cloudflare to an FQDN on the tailnet felt like a switch in my brain just clicked and everything made sense.

@Tailscale

3 ай бұрын

What would you have done if the whole video was 17 seconds long just saying that? :)

@julianhamann4925

3 ай бұрын

@@TailscaleHonestly, little tid bits like that would make for some good technical content. Just like "10 things that make sense when using Tailscale". I just got started playing around with TS around Christmas and my current "solution" was that I registered my coredns server as a node on the tailnet and I serve a different view if the DNS query comes from within the tailnet. Then the hostnames get resolved to the actual tailnet IPs of the node, otherwise the local network address. I mean it works, but just using CNAMEs is so much easier lol

@devendermahto

3 ай бұрын

​@@Tailscalehe is an idiot you have made a good video and I was using unraid with cloudflared tunnel now I know the importance of getting tailscale

@tonyk2005

3 ай бұрын

​@@Tailscalesounds like a good idea for a KZread short

@4pmvim

3 ай бұрын

Ditto

I really appreciate the way you explain things. You do such a great job of explaining these things in a way that gives detail in a way that makes sense to people with a range of technical detail. I have a pretty strong technical background but it still bothers me when companies do the whole “step 1, draw some circles. Step 2, draw the rest of the owl” kind of tutorials. There aren’t enough people on the internet with positive feedback so I wanted to make sure to take a moment for it on this. Please keep these coming and keep up the good work, I for one really appreciate it.

@Tailscale

2 ай бұрын

Thanks for teaching me how to draw an owl. O.O

This is perfect! I was just about to do this with immich, tailscale, and a reverse proxy, but I had no idea how to set it up. It's like this video was explicitly made for me!

Another BANGER from Alex. It is always a great time to learn more about Tailscale.

Hey! Idk what’s more awesome at this point, your content or your product. Mad kudos! Thank you so much!!

This concept just suddenly became clear. Thank you for the instructions on how to do this. Was unhappy exposing certain services to the entire internet, but this video has clarified how this can be avoided. Nicely done.

I use to have cloudflare as my DNS server. Now I host my own technitium DNS server, and I configured tailscale to enforce that as the DNS server. In technitium I am using the split dns app, which allows me resolving to both tailscale and my lan IPs, depending where the client is connecting from. Works great.

@freshnews8538

3 ай бұрын

Oh wow! Is it possible to share with a tutorial how you did it?

@ultravioletiris6241

3 ай бұрын

Nice is the split DNS function natively built into technitium? Did you follow a guide or just figure it out?

There are good vides and there are great ones! And then, there is this! Great work Alex, keep raising that👙bar!

I always learn something new with Sir Alex. Thanks!

Video's like this were very much needed, nice one 👍 Really pleased to see Immich getting more attention - I haven't had a successful install using TrueNAS Scale, but I'm definitely keen to try it again very soon. Just about domains, but here in the UK I found OVH, super cheap. I've only used it for a casual use, but the ovh domain itself is very cheap. ...and after years of listening to Alex's podcasts, funny to actually see what he looks like!

Can't tell you how much I love tailscale!

Nice tutorial as usual 😎👍🏻

Brilliant. I've used tailscale for a family jellyfin server for our movies and shows, image syncing with photosync so it syncs my photos and videos from my phone to my hard drive from anywhere. Then I have a mini pc with a big 12TB hard drive connected with tailscale for personal cloud storage, accessible from any device. I use CX file explorer from my android phone and tablet to access my files on it. It has an upfront outlay but much much cheaper than any cloud storage (and larger). Plus I've got some other apps I'm experimenting with. Really brilliant piece of software. I've never come across something so practical and intuitive for networking devices.

@DavidBrown-gl1bm

3 ай бұрын

Do you have redundancy on that local 12TB? I'd hate for you to lose data if a hard drive crashes.

Great background!

Very interesting video I have tested it with My own domain and was working perfectly

@uidx-bob

3 ай бұрын

Did you use a CNAme or A record? I could only get it to with an A record entry with the Tailscale node ip in it for a value. When I tried CNAME with Tailscale dns name I couldn’t get it to work.

@Feerab

3 ай бұрын

CNAME was not working I use A record instead and works fine sorry that I didn't mention that before @@uidx-bob

@Zylont

Ай бұрын

@@uidx-bob Ah! thank you for this comment. Same thing, had to use an A record with the IP address to get it work. Using a CNAME with the Tailscale FQDN was not connecting for me.

The way I’ve setup this is, bind9 running on same device I’ve Tailscale and traefik. Using tailnet ip as custom dns on the shared tailnet. Works like charm

Thanks Alex, I've been wanting to do this for a while. Shame about Android devices though. 🤩

Great video, this is what i do as well but i use nginx proxy manager as a reverse proxy. Overall works great exposing my docker containers but there is something I would like to do, is there any way to grant permission to a user only for one port? So i dont have tp grant them access to every system i have on my side. This would be better for security as well in case their device is somehow compromised

Great video! It would be great if you could do a tutorial for Tailscale ACLs

@Tailscale

3 ай бұрын

Great suggestion!

@Tailscale this is all really good stuff! Is there a way to build a Cloudflare tunnel with our tailscale domain ? I want to expose both TCP and UDP ports but funnel only allows TCP exposure

What's the difference between using Caddy and a custom domain, vs just connecting to the service using the tailscale full domain and IP port? And how is that different from using a Funnel? Is there a way to share a service (like Plex) that is behind CGNAT without needing to share the caddy instance, if someone's device that may not have a native tailscale client (like Fire TV)?

Can someone help me understand why we would use Caddy once we're on Tailscale? Is it necessary to resolve the requested subdomain to the correct port on the origin server?

Really looking forward to finally be able to use my own domain as my Tailnet domain. Any ETA on that?

@Tailscale

3 ай бұрын

There's a GitHub issue where you can track the status of this long running feature request. It's a surprisingly intricate thing to do right, so for now you'll have to "make do" with the "workaround" shown in the video. github.com/tailscale/tailscale/issues/4221

Thanks for the information. Is there anything else that needs to be in the CaddyFile to make Caddy function correctly? Thx

@deghimon

5 күн бұрын

I'm wondering the same thing. Did you get this working?

When sharing a node such as caddy to a friend using this method, do they access content directly (as in peer-to-peer) or does it go via Tailscale relays? I just wondered if there would be any bandwidth or speed limitations using this method?

@Tailscale

3 ай бұрын

Tailscale does its best to establish direct connections whenever possible. “Tailscale ping node” will tell you what route traffic is taking.

Excellent tutorial! I was able to get this working running everything on my Raspberry PI - but I've run into one problem: my Windows machine can't resolve the DNS of my routes correctly but my Linux ones can. When I try to run NSLookup on windows the magicdns daemon tells me that my domain (reachable from Linux boxes in my tailnet) is a non-existent domain. Any ideas what that could be about?

Thank you so much for this walk through! I have everything working with one exception. If I add a new entry to caddy, it will not get a cert from letsencrypt for that service unless I issue "tailscale down" and restart caddy. Restarting caddy with tailscale still connected results in not getting a cert. With tailscale down, It then grabs the cert and I can "talescale up" and everything works. Any advice on how to fix that?

@Nate-D

3 ай бұрын

Update: I am not trying to reverse proxy to anything using magic DNS. None of my services are directly connected to tailscale. I was able to fix the issue by issuing "tailscale set --accept-dns=false". Caddy is now able to get certs with tailscale running. If someone can tell me what I may have boogered up in tailscale in terms of DNS to cause this failure, I am all ears!! LOL

@Tailscale

3 ай бұрын

@@Nate-D hmmm - perhaps you might investigate a wildcard for your domain? sorry i didn't find this condition in my testing! -alex

I use this same setup but will actually expose a few things directly to the internet instead. Me and wife have massive battery problems with tailscale on android which is just not worth it. Eats like 20 percent of battery per day. Will expose home assistant directly through caddy and mutual tls when coming from outside network.

@ultravioletiris6241

3 ай бұрын

You also might consider a manual wireguard connection for the two phones rather than tailscale.

@rhyme2192

3 ай бұрын

@@ultravioletiris6241 does the manual wireguard app for Android use kernel mode ? Is it less battery intensive?

A very severe problem is the latency Tailscale turning from idle state to direct connecting. Based on the fundamental behavior of Tailscale, client will firstly try to create a connection over DERP. After a faster, direct connection is created, the Tailscale tunnel turns into direct. This process needs several seconds and I believe the latency would influence the quality of service or user experience. If there is an option which enable keeping alive, this problem could be mitigated.

Can you comment on what I’d use in place of my Tailnet name if I was trying to configure this via Headscale? Would the IP of my Tailscale LXC do the trick?

Is Caddy required if your remote friend/family member just joins your Tailnet directly? and doesn't setup their own?

@Tailscale

3 ай бұрын

Technically it isn't _required_ for node sharing, but doing it this way means only sharing one node with relatives or friends. Caddy at this time is require for custom domain support as Tailscale itself only supports the `ts.net` names we generate for you.

Would you create a tutorial for Traefik as well?

Great video! I was trying to follow the instruction but currently stuck on finding the cloudflair tls dns key. Could you tell me where I would find that cloudflair dashboard ? thank you

@cali0028

2 ай бұрын

Never mind I found the inst. on how to get the API key.

I have a question and I don't know where to ask it....hahahaha, so the only thing I don't get from tailscale... Say I have 2 nodes, each of them behind NAT. How does my traffic flows when I choose one as exit node? All my traffic goes to tailscale servers and back and forth to the nodes? Or is there a way to bond the 2 connections together once the conversion is written in each table on the home routers, and therefore tail scale is just used for the "handshake"?

@Tailscale

3 ай бұрын

A bit old, but still at the core of how Tailscale works - this blog post should clear this up for you. tailscale.com/blog/how-nat-traversal-works

@hkfuertes

3 ай бұрын

Ok, so if I’m not wrong… Tailscale server is only used during the handshake ( exchange of WireGuard profile) right? From that point on, via NAT-T the communication is done directly NAT to NAT, right? For what I have read, there is an special udp/4500 always open that manages this NAT routing problem, right?

Great video, i was looking to replace my cloudflare vpn with tailscale, and this video opened my eyes. Just to confirm, the cname record you created in Cloudflare is only accessible over the tailscale network, correct? If so, can anyone using the tailscale network DNS resolve that cname?

@Tailscale

3 ай бұрын

The CNAME itself is public but only routable via Tailscale (and more specifically, your Tailnet).

Really interesting. I have been doing this with cloudflare tunnels. Whats the advantage to do this with tailscale instead?

@Tailscale

3 ай бұрын

Each device in your tailnet makes a best attempt at NAT traversal for establishing direct connections. So I would imagine that because there’s no middle man in that situation, performance would be better as you arent proxying all traffic via someone else.

@thedanielfrg

3 ай бұрын

Very interesting. More reading to do! Loving the content!

@ckwcfm

3 ай бұрын

I think one difference is with tunnel, you still open your service to the public, but with Tailscale, only people who joined your telnet can access the service.

@absentfromtheworld

3 ай бұрын

Same here but this actually makes me thing of alternatives. This is why I've been loving Tailscale, makes me re-think my solutions

@uidx-bob

3 ай бұрын

I believe one advantage this solution has over cloudflare tunnels is when you use cloudflare tunnels your terminating at the cloudflare managed proxy. At that point you are exposing your traffic.

The only part I can't figure, is the caddy server listening at the address of the tailnet right? Or is it listening at all the interfaces, like 0.0.0.0:80? Although, if caddy is listening at 0.0.0.0, then tailscale wouldn't even be required 😵

@Tailscale

3 ай бұрын

Caddy in this example is running as an LXC container meaning it is a standalone node on the Tailnet. In this example, Caddy is listening on 0.0.0.0 in the LXC container. Tailscale is required for remote devices to be able to resolve the CNAME and route the traffic to Caddy.

@StephenMcDonnell-gm1sw

10 күн бұрын

@@Tailscale I have caddy running in docker on a debian vm. Do I need to adjust for this? I can't get it to work.

Does this also work if you’re using cloudflare tunnels?

@EdmontonFamilyOfficial

3 ай бұрын

There's a bandwidth limit on cloud flare tunnels you wouldn't be able to stream any media or watch videos etc

If the caddy/host is running behind cgnat, will it use DERP/relay? Also the client are behind cgnat. Everyone is behind cgnat :'(

Nice. But where is the nix module for this? ;)

@Tailscale

3 ай бұрын

PRs welcomed ;)

Where does that token come from and how do i get mine

@Tailscale

3 ай бұрын

It's a Cloudflare API token. developers.cloudflare.com/fundamentals/api/get-started/create-token/

@pandadev_

3 ай бұрын

@@Tailscale yeah i did know that but which permissions do i have to give it

Hi, noob here. So I own my domain at godaddy. Do I need to use cloudflare? Or is it possible to configure the DNS at godaddy?

@DavidBrown-gl1bm

3 ай бұрын

To my understanding, any nameserver would do it, so you could use GoDaddy. They aren't using CF proxying for those CNAME records in this video, so CF is just providing some fast nameservers (I think direct access disables most other CF features).

@Tailscale

3 ай бұрын

Any authoritative DNS server for your domain will do. Cloudflare as shown, is just an example. Godaddy should work but YMMV :angel:

Dang, saw this twice and still don't get it. Can't the host and the user just use tailscale and be done? What am I missing?

@Tailscale

2 ай бұрын

If you want to use the provided tailnet domain it’s as easy as that. You only need to add the extra complexity if you want to use an external custom domain.

Can i do it on someones TV?

cam i do the same with route53 as dns provider???

@Tailscale

3 ай бұрын

More than likely yep!

Great video, but i think you are omitting quite the rabbithole of getting the cloudflare module into Caddy....

@Tailscale

3 ай бұрын

It’s certainly an unusual system. But I wrote an ansible role years ago that handles it for me.

@KristianTurner1

3 ай бұрын

@@Tailscale which permissions does your CF API have? Zone.Zone.Read and Zone.DNS.Edit?

Thanks for the video. But I don't understand everything. 1- What is *rdu, do I have to use it? 2- where do I get the Cloudflare token. I can't find it on my account.

@littlenewton6

3 ай бұрын

Firstly, you should have a good understand of DNS and its application. CNAME type is the core concept.

@patrickskillin1798

3 ай бұрын

*rdu is just a wildcard and a name it could be anything *.self, *.nounderstanding, *.moreexplinationplease *.seriouslyyourgithubdocsarntcomplete. you get the idea and good question about the Cloudflare token, it feels important yet we have no info on it....

@PierreFiliatreault

3 ай бұрын

@@littlenewton6 That's helpfull.

@AlexKretzschmar

3 ай бұрын

@@patrickskillin1798at least you have a sense of humor! I’ll get the docs a bit more polished back in the office tomorrow for you, and I’ll add a little more info on the api token. 😅

@PierreFiliatreault

3 ай бұрын

Thank you, it is truly appreciated.@@AlexKretzschmar

props you don't pronounce ubuntu as ubantu. thumbs up.

not available for webos

While this is very nice, I can't imagine any relative bothering... It's hard enough to get people to click on a Google photos link. Creating an account, installing tailscale, then clicking on the link, then installing the app but not clicking on the link anymore... I understand the logic, but real talk most people over 40 barely know how to send an email.

@acedanger49

3 ай бұрын

40? doubtful. 60 maybe but 40 is way too young.

@walkerleigh

3 ай бұрын

Whoa! That's a bit ageist! 😂 But you're right, they'd definitely have to be keen and a quite savvy at the other end.

Why do you use a public domain that redirects to the private Tailnet domain? Wouldn't it work just the same without a public domain by using the private Tailnet domain directly? Also, it's one piece less of metadata leaked to the public internet, and saves domain costs, management and configuration. EDIT: The answer is yes, as written in another comment "If you want to use the provided tailnet domain it’s as easy as that. You only need to add the extra complexity if you want to use an external custom domain". kzread.info/dash/bejne/iKhosqaOiKXFlso.html&lc=UgyF1gVItm8tYaCAzXF4AaABAg.A2dSWwSEgRmA2eAoSMFLFW

#unraidmasterrace

KZread short version please? 😊

Why the actual eff can you not make an account with Tailscale without using a big tech account? That's so stupid it's basically offensive.

@DavidBrown-gl1bm

3 ай бұрын

What about Okta or OpenID Connect (OIDC) for your identity provider? Or consider self-hosting with Headscale? Tailscale argues "By design, Tailscale is not an identity provider-there are no Tailscale passwords. Using an identity provider is not only more secure than email and password, but it allows us to automatically rotate connection encryption keys, follow security policies set by your team (for example, MFA), and more."

Hi, I would like to invite you to do a video issue for our products, how can I contact you?