Feedback on Tailscale implementation, v4.2 firmware

ss4pcRFradio · 2023-05-07T08:17:50.704Z

My case:

Router: GL-AXT1800
OpenWRT version: OpenWrt 21.02-SNAPSHOT r16399+159-c67509efd7
Kernel Version: 4.4.60

Tailscale installed, added tailscale0 interface, firewall and NAT rules in LUCI
I have the same issue that has @lextar but I solved using this CLI command

tailscale set --advertise-routes=xx.xx.xx.xx/24
tailscale set --accept-routes
tailscale up

Then I can reach any other tailscale device.
But, If I reboot the router I loss the config and I need to make again the sames changes.

HarvsG · 2023-08-21T15:31:21.515Z

On my non-standard install of tailscale on the MT1300 beryl How to get Tailscale working on the Beryl MT-1300! I cant get much more than about 1-2 MB/s aka 8-16Mbs. CPU usage on the beryl jumps around at about 40-60% during those speeds. On wireguard I got much faster speeds

4.3.6 RC 1
iperf3 -s Test 1 is direct tailscale connections, test 2 is direct wireguard

image971×953 25.3 KB

Currently glinet is running version tailscale version 1.32.3-1 (OpenWrt)
However in version 1.40 tailscale claim to be faster than native wireguard.

Tailscale

Surpassing 10Gb/s over Tailscale

Hi, it’s us again. You might remember us from when we made significant performance-related changes to wireguard-go, the userspace WireGuard® implementation that Tailscale uses. We’re releasing a set of changes that further improves client throughput...

Edit: I manually upgraded to tailscale 1.44 and unfortunately throughput was only slightly faster. 20Mbs or so.

danielg · 2024-03-16T09:44:19.432Z

Is this still the status quo, that it is better to use the plain OpenWRT firmware with LuCi than GL’s, to get Tailscale working on the AR300M?

danielg · 2024-03-16T11:05:14.252Z

Has anybody managed to get all GL router client traffic routed to a Tailscale exit node on any model router / firmware combination?

It seems that would be the key Tailscale functionality on travel routers in particular.

card · 2024-03-16T12:30:07.062Z

the AR300M doesn’t have enough RAM to effectively run a Tailscale exit node. You can do it, but to avoid having tailscale die from wireguard-go going OOM you need to make some non-trivial changes to the source code and rebuild it yourself.
on the AR300M you really should stick with standard wireguard. wireguard-go is just not being tuned for low memory use.

card · 2024-03-16T12:31:22.433Z

Many, many people run tailscale exit nodes on many models and firmwares.

danielg · 2024-03-16T13:30:53.307Z

I meant GL routers actually. How do you get custom exit nodes to show up in the dropdown menu under Gl firmware > Applications > Tailscale > Custom exit node?

cafebug · 2024-03-16T15:37:00.546Z

Once you have a device acts as an exit node listed in Tailscale admin console, your router should list it in that pull down list by clicking the refresh link beside.

danielg · 2024-03-16T16:11:05.693Z

Perfect. I got it to work. Thanks!

When choosing a GL router as an exit node which is itself running WG in client mode, is there any way to have the domain/IP exceptions configured in the GL firmware be respected for tailscale-connected clients?

cafebug · 2024-03-16T17:04:29.970Z

Read this first: Tailscale - GL.iNet Router Docs 4 (the Note part)

danielg · 2024-03-16T19:44:28.320Z

card:

the AR300M doesn’t have enough RAM to effectively run a Tailscale exit node

Does it have enough RAM to make other, less traffic intense Tailscale functionality useful, such as accessing printers or the admin interfaces of other tailscale clients or is it really not worth it to use tailscale on any of the less powerful GL routers?

danielg · 2024-03-16T19:46:54.318Z

Ok, I was already using an external DNS (Cloudflare). Other notes just point to tailscale support being in beta, but people started toying with it well over a year ago on this forum so someone might have had the same issue and found a solution.

card · 2024-03-16T20:14:06.748Z

It will run and may serve for light use, especially if you have nothing else running at the same time.

Sustained high throughput will be the end of it.

Doing a git clone of a large repo while sending the traffic through it will oomkill the tailscale process in about a minute. Again this is a wireguard-go issue.

github.com/WireGuard/wireguard-go

device: Allow buffer memory growth to be limited at run time

WireGuard:master ← gitlankford:master

opened 03:19PM - 26 Feb 23 UTC

gitlankford

+4 -1

The infinite memory growth allowed by the default PreallocatedBuffersPerPool set…ting causes processes to be oom-killed on low memory devices. This occurs even when a soft limit is set with GOMEMLIMIT. Specifically running tailscale on a linux device (openwrt, mips, 128MB RAM) will exhaust all memory and be oom-killed when put under heavy load. Allowing this value to be overwritten as is done in the iOS build will allow tuning to cap memory expansion and prevent oom-kill. see tailscale issue thread for further info: https://github.com/tailscale/tailscale/issues/7272

danielg · 2024-03-18T11:18:37.748Z

Ok, I’ll just avoid tailscale on the low ram devices. Is there a way to install Tailscale on an SD card in the original Beryl? That model would have enough RAM, just not enough internal storage.

Also, do clients connected via Tailscale to a GL router show up in GL’s client list?

card · 2024-03-18T13:28:51.936Z

Tailscale

Smaller binaries for embedded devices

Learn how to build an extra-small Tailscale binary for deployment in disk space constrained environments.

the combined binary probably saves you the most space.
it would be hard but not impossible to go much beyond what you can get out of the instructions on that page.

I think the connected clients is only ones that are getting an IP address from the DHCP server, but if there’s a VPN specific connected clients list… well, I don’t use it.

danielg · 2024-03-18T16:48:16.028Z

Wow, those results are impressive. 4,5 MB would likely fit on the 32 MB NOR flash of Beryl. I don’t have a go environment set up, unfortunately. Is there no service that distributes different kinds of packed versions of such programs like there is for javascript with jsdelivr a.o.?

danielg · 2024-03-18T20:28:04.260Z

card:

Sustained high throughput will be the end of it.

Actually, would that be the case if the low RAM GL router is not itself used as an exit node but merely for routing its clients’ traffic through another exit node which has plenty of RAM?

card · 2024-03-18T20:53:22.438Z

Using as an exit node vs client using exit node, the wireguard-go load would be about the same assuming you’re just talking about 2 devices.
I believe the tests leading to oomkill in the tailscale bug report were while using an exit node rather than running an exit node.

danielg · 2024-03-21T20:55:59.912Z

I have some time coming up where I could look into how to do this. Once I have the combined and compressed binary, how would I get it installed on an original Beryl where the current firmware doesn’t even have the Tailscale menu items in the GL firmware?

card · 2024-03-23T21:59:52.441Z

You would need to do some setup outside of the GL scripts / ui.
You might consider running on a standard OpenWrt build if there are incompatibilities with the GL scripts.
Pretty standard stuff with some guides for doing it in luci after installing tailscale and telling it to run from an SSH session.
https://openwrt.org/docs/guide-user/services/vpn/tailscale/start