pre-authorized configuration

[giorez]

Is there any chance to improve your app using the "tskey-auth-abcd" key field into WebGUI?
I tried to add "sudo tailscale up --authkey tskey-auth-...", but the app need to login anyway.

thanks

[Tokisaki-Galaxy]

first, this app only a webGUI, use CLI communication with tailscale.

add this function need refer official cli doc? I'm not sure about this function.

plz try this

tailscale logout
tailscale up --auth-key=tskey-auth-xxxxx-xxxxx

if login success, in the next major version, I will add this.

[Tokisaki-Galaxy]

because received github mail Action needed: Secrets detected in recent commits to Tokisaki-Galaxy/luci-app-tailscale-community
I remove xxxxx from u message

[giorez]

I sent via CLI

tailscale logout
tailscale up --auth-key=tskey-....

tailscale started succesfully in logged-in status. Unfortunatelly the accept-ruotes became false after the "tailscale up" command:
Tailscale Health Check: Some peers are advertising routes but --accept-routes is false

So it --accept-router needs to be re-submitted

there is also a API access tokens function on the tailscale service, in case it help for your software.

[Tokisaki-Galaxy]

donot worry, only need input tailscale set --accept-routes. or also use WebGUI enable acc...

this function seem work normal, I plan add next major version. thx

[giorez]

ciao Tokisaki, I m actually integrating the uci command needed to auto-configure your app into uci-defaults. There are some commands I missed. May I ask you to double-check my script and tell me what I missed? Probably there is something missing compared to your "Auto Configure Firewall" button behavior in your app.

# Create file 99-4-tailscale
cat << "EOF" > ~/openwrt-org/files/etc/uci-defaults/99-4-tailscale
TS_AUTH='<YOUR_KEY_HERE>'
# /etc/config/network
uci set network.tailscale=interface
uci set network.tailscale.proto='none'
uci set network.tailscale.device='tailscale0'
uci commit network
/etc/init.d/network reload
# /etc/config/firewall-forwarding
uci add firewall zone
uci set firewall.@zone[-1].name='tailscale'
uci set firewall.@zone[-1].input='ACCEPT'
uci set firewall.@zone[-1].output='ACCEPT'
uci set firewall.@zone[-1].forward='ACCEPT'
uci set firewall.@zone[-1].masq='1'
uci set firewall.@zone[-1].mtu_fix='1'
uci add_list firewall.@zone[2].network='tailscale'
# uci set firewall.@zone[2].network='tailscale'
uci add firewall forwarding
uci set firewall.@forwarding[-1].src='lan'
uci set firewall.@forwarding[-1].dest='tailscale'
uci add firewall forwarding
uci set firewall.@forwarding[-1].src='tailscale'
uci set firewall.@forwarding[-1].dest='lan'
uci commit firewall
# /etc/init.d/firewall reload
/etc/init.d/firewall restart
# setta tailscale
uci set tailscale.settings.accept_routes='1'
uci set tailscale.settings.runwebclient='1'
uci set tailscale.settings.ssh='1'
uci add_list tailscale.settings.advertise_routes='192.168.xx.0/24'
uci add_list tailscale.settings.advertise_routes='192.168.xx.0/22'
uci commit tailscale
/etc/init.d/tailscale restart
# esegui logout e login tailscale
tailscale logout
sleep 3
tailscale up --reset --accept-routes --ssh --hostname=z8102 --advertise-routes=192.168.xx.0/24,192.168.xx.0/22 --auth-key="$TS_AUTH"
EOF

[Tokisaki-Galaxy]

I do not understand why u do it...
Auto Config Firewall do NOT adapt everyone. some user maybe do NOT use this function. ex. only use tailscale manage openwrt...
and if u enable Auto Config Firewall, when package uninstall, the settings do not purge.

you script the "uci add firewall zone" command cannot be used to add a new zone unconditionally. It will create a new zone each time it is run (although it is usually only run once).
Additionally, when setting up the network, the hardcoded index @zone[2] was used, which is incorrect: it assumes that the original number of zones in the system is 2 (typically LAN and WAN occupy the first two positions), but the actual number may vary depending on the configuration. If the system has only 1 zone, @zone[2] does not exist, causing an error in uci; if there are more than 2 zones, it may modify the wrong zone. The correct approach should be to use @zone[-1] to reference the newly added zone.

you can try this script to setup Auto Config Firewall

#!/bin/sh
changed_network=0
changed_firewall=0

if ! uci -q get network.tailscale > /dev/null; then
    uci set network.tailscale=interface
    uci set network.tailscale.proto='none'
    uci set network.tailscale.device='tailscale0'
    changed_network=1
else
    current_dev=$(uci -q get network.tailscale.device)
    if [ "$current_dev" != "tailscale0" ]; then
        uci set network.tailscale.device='tailscale0'
        changed_network=1
    fi
fi

zone_idx=""
zone_indices=$(uci show firewall | grep '^firewall\.@zone\[' | cut -d'[' -f2 | cut -d']' -f1 | sort -nu)
for idx in $zone_indices; do
    name=$(uci -q get firewall.@zone[$idx].name)
    if [ "$name" = "tailscale" ]; then
        zone_idx=$idx
        break
    fi
done

if [ -z "$zone_idx" ]; then
    zone_idx=$(uci add firewall zone)
    uci set firewall.$zone_idx.name='tailscale'
    uci set firewall.$zone_idx.input='ACCEPT'
    uci set firewall.$zone_idx.output='ACCEPT'
    uci set firewall.$zone_idx.forward='ACCEPT'
    uci set firewall.$zone_idx.masq='1'
    uci set firewall.$zone_idx.mtu_fix='1'
    uci set firewall.$zone_idx.network='tailscale'
    changed_firewall=1
else
    if ! uci -q get firewall.$zone_idx.network | grep -qx 'tailscale'; then
        uci add_list firewall.$zone_idx.network='tailscale'
        changed_firewall=1
    fi
fi

fwd_indices=$(uci show firewall | grep '^firewall\.@forwarding\[' | cut -d'[' -f2 | cut -d']' -f1 | sort -nu)
found_lan_to_ts=0
found_ts_to_lan=0
for idx in $fwd_indices; do
    src=$(uci -q get firewall.@forwarding[$idx].src)
    dest=$(uci -q get firewall.@forwarding[$idx].dest)
    if [ "$src" = "lan" ] && [ "$dest" = "tailscale" ]; then
        found_lan_to_ts=1
    fi
    if [ "$src" = "tailscale" ] && [ "$dest" = "lan" ]; then
        found_ts_to_lan=1
    fi
done

if [ $found_lan_to_ts -eq 0 ]; then
    fwd_idx=$(uci add firewall forwarding)
    uci set firewall.$fwd_idx.src='lan'
    uci set firewall.$fwd_idx.dest='tailscale'
    changed_firewall=1
fi

if [ $found_ts_to_lan -eq 0 ]; then
    fwd_idx=$(uci add firewall forwarding)
    uci set firewall.$fwd_idx.src='tailscale'
    uci set firewall.$fwd_idx.dest='lan'
    changed_firewall=1
fi
if [ $changed_network -eq 1 ]; then
    uci commit network
    /etc/init.d/network reload
fi

if [ $changed_firewall -eq 1 ]; then
    uci commit firewall
    /etc/init.d/firewall reload
fi
if [ $changed_network -eq 1 ] || [ $changed_firewall -eq 1 ]; then
    echo "Tailscale firewall/interface configuration applied."
else
    echo "Tailscale firewall/interface already configured."
fi

exit 0

[Tokisaki-Galaxy]

do NOT use uci add_list firewall.@zone[2].network='tailscale', you should set @zone[-1] point just added recently

[giorez]

I will try asap! Thanks for teaching me! I really appreciated your sharings...

[giorez]

I applied your script (plus few more custom lines) into my uci-default auto-configuration. The system boots and auto-configures properly. Importunately at https://login.tailscale.com/admin/machines page there is an error regarding subnet:

Any idea how to solve?

Unable to relay traffic
This machine has IP forwarding disabled and cannot relay traffic. Please enable IP forwarding on this machine to use relay features like subnets or exit nodes.

# Create 99-4-tailscale file
cat << "EOF" > ~/openwrt-org/files/etc/uci-defaults/99-4-tailscale
# ? scade 2026_05_26 ?
TS_AUTH='<YOUR_AUTHKEY_HERE>'

changed_network=0
changed_firewall=0

if ! uci -q get network.tailscale > /dev/null; then
    uci set network.tailscale=interface
    uci set network.tailscale.proto='none'
    uci set network.tailscale.device='tailscale0'
    changed_network=1
else
    current_dev=$(uci -q get network.tailscale.device)
    if [ "$current_dev" != "tailscale0" ]; then
        uci set network.tailscale.device='tailscale0'
        changed_network=1
    fi
fi

zone_idx=""
zone_indices=$(uci show firewall | grep '^firewall\.@zone\[' | cut -d'[' -f2 | cut -d']' -f1 | sort -nu)
for idx in $zone_indices; do
    name=$(uci -q get firewall.@zone[$idx].name)
    if [ "$name" = "tailscale" ]; then
        zone_idx=$idx
        break
    fi
done

if [ -z "$zone_idx" ]; then
    zone_idx=$(uci add firewall zone)
    uci set firewall.$zone_idx.name='tailscale'
    uci set firewall.$zone_idx.input='ACCEPT'
    uci set firewall.$zone_idx.output='ACCEPT'
    uci set firewall.$zone_idx.forward='ACCEPT'
    uci set firewall.$zone_idx.masq='1'
    uci set firewall.$zone_idx.mtu_fix='1'
    uci set firewall.$zone_idx.network='tailscale'
    changed_firewall=1
else
    if ! uci -q get firewall.$zone_idx.network | grep -qx 'tailscale'; then
        uci add_list firewall.$zone_idx.network='tailscale'
        changed_firewall=1
    fi
fi

fwd_indices=$(uci show firewall | grep '^firewall\.@forwarding\[' | cut -d'[' -f2 | cut -d']' -f1 | sort -nu)
found_lan_to_ts=0
found_ts_to_lan=0
for idx in $fwd_indices; do
    src=$(uci -q get firewall.@forwarding[$idx].src)
    dest=$(uci -q get firewall.@forwarding[$idx].dest)
    if [ "$src" = "lan" ] && [ "$dest" = "tailscale" ]; then
        found_lan_to_ts=1
    fi
    if [ "$src" = "tailscale" ] && [ "$dest" = "lan" ]; then
        found_ts_to_lan=1
    fi
done

if [ $found_lan_to_ts -eq 0 ]; then
    fwd_idx=$(uci add firewall forwarding)
    uci set firewall.$fwd_idx.src='lan'
    uci set firewall.$fwd_idx.dest='tailscale'
    changed_firewall=1
fi

if [ $found_ts_to_lan -eq 0 ]; then
    fwd_idx=$(uci add firewall forwarding)
    uci set firewall.$fwd_idx.src='tailscale'
    uci set firewall.$fwd_idx.dest='lan'
    changed_firewall=1
fi
if [ $changed_network -eq 1 ]; then
    uci commit network
    /etc/init.d/network reload
fi

if [ $changed_firewall -eq 1 ]; then
    uci commit firewall
    /etc/init.d/firewall reload
fi
if [ $changed_network -eq 1 ] || [ $changed_firewall -eq 1 ]; then
    echo "Tailscale firewall/interface configuration applied."
else
    echo "Tailscale firewall/interface already configured."
fi

# exit 0 # COMMENTATO x evitare uscita
uci set tailscale.settings.accept_routes='1'
uci set tailscale.settings.runwebclient='1'
uci set tailscale.settings.ssh='1'
uci add_list tailscale.settings.advertise_routes='192.168.xx.0/24'
uci add_list tailscale.settings.advertise_routes='192.168.xx.0/22'
uci commit tailscale
/etc/init.d/tailscale restart
# esegui logout e login tailscale
# tailscale logout
sleep 10
tailscale up --accept-routes --ssh --hostname=z8102 --advertise-routes=192.168.xx.0/24,192.168.xx.0/22 --auth-key="$TS_AUTH"
EOF

PS I just did a second reboot, and it seems the issue has gone... No idea if the problem will be back again.

[giorez]

Do you have a paypal account email?

[Tokisaki-Galaxy]

if show

Unable to relay traffic
This machine has IP forwarding disabled and cannot relay traffic. Please enable IP forwarding on this machine to use relay features like subnets or exit nodes.

you should set system ip forward

echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
echo "net.ipv6.conf.all.forwarding=1" >> /etc/sysctl.conf
sysctl -p /etc/sysctl.conf

if you want to sponsor, you can use xbinary200@gmail.com as paypal account. I will be very happy.

[giorez]

Codice transazione
8W729947KJ6974303