Tailscale Site to Site Help Needed

Options
Gibsonmb
Gibsonmb Posts: 13
First Comment Friend Collector Second Anniversary
image  Freshman Member
in Security

I have set up the Tailscale VPN on my Flex 100H. It accepts routes and advertises routes. At the other end I have to go through a telco provided router (which has no bridge or passthrough settings). Behind that I have Raspberry Pi set up as a sub-net router which can be seen on the tailnet. At the flex 100h end the ip address range is 192.168.0.0/24. At the Pi end the address range is 192.168.1.0/24. The devices at the Pi end can see all devices at the Flex 100h end whether they have Tailscale installed or not. The devices at the Flex 100h end can only see devices at the Pi end that have Tailscale installed and are thus visible on the Tailnet. Devices on the Flex 100h end cannot see any devices at the Pi end that do not have Tailscale installed.

Are there any additional entries I need to make on the Flex 100h, to allow devices at that end, to see the devices without Tailscale installed at the Pi end?

The Pi has forwarding enabled as per Tailscale instructions and is running tailscale with the command tailscale up —accept-routes —advertise-routes=192.168.1.0/24 --snat-subnet-routes=true. I have also tried the snat command as false, it makes no difference.

The advertised sub-nets are approved on the tailscale admin console

Any help would be appreciated

All Replies

  • Zyxel_Melen
    Zyxel_Melen Posts: 5,169
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate
    image  Zyxel Employee
    Options

    Hi @Gibsonmb

    If you check the machine/device in the VPN status > Tailscale page, then you will only see the Tailscale installed devices. The devices under Tailscale router/firewall will not listed in here.

    image.png
    Zyxel Melen


  • Gibsonmb
    Gibsonmb Posts: 13
    First Comment Friend Collector Second Anniversary
    image  Freshman Member
    Options

    This does not answer the question at all. I know that only the devices that have Tailscale loaded show in the control panel. The point is that I cannot CONNECT to devices that do not have Tailscale installed at the Pi remote end even though I have a Raspberry Pi running as a sub-router. Is it because of some rule or policy I maybe need to set up in the Zyxel 100h at the main site?

    Devices at the Pi end that do not have Tailscale installed CAN connect to devices at the Flex 100h end that also do not have Tailscale installed. Why is the VPN working only one way?

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）