MV-1000 Brume override DNS for Tailscale exit node client

doujinflip · 2024-12-28T14:03:14.958Z

I have a Brume 1 with the v4.3.8 beta installed, and the Tailscale updates and features I use seem to work fine except for when using it as a client to another exit node -- which I know works for newer and non-GLinet devices -- where if I try to activate it the Brume loses all connection to the internet. I'd like to use this old Brume as I already have it, and it provides a second LAN port that I want to use as a direct connection to a VoIP phone.

I'm quite sure this is a DNS issue since there's one difference I noticed in newer GLi firmware that allows for a DNS override of VPNs, which I have had to set in order for a couple devices (GLi and not) to connect to Tailscale without losing access to the rest of the internet.

Is there a way to set the VPN DNS override in older firmwares, say in LuCI? I tried to manually set DNS forwardings but this has no effect.

bruce · 2024-12-30T06:35:58.634Z

Hi,

When you enable and select the exit node on the Brume, and approved the subnet on the Tailscale dashboard:

ping <domain name> is abnormal, but ping <IP> is normal, right?

doujinflip · 2024-12-30T22:57:42.811Z

No I'm unable to ping anything when trying to connect to the Exit Node. I'm still thinking it's something about the routing or DNS (specifically it's always trying to use the Tailscale DNS), because its firewall rules are configured that same way as the newer GLi devices which work but which have the Custom DNS Override VPN switch in the main GUI.

bruce · 2025-01-02T09:29:32.946Z

SSH to the router, execute to check:
ifconfig
tailscale status
ip r

Looks like it does not create the routing rule to the tailscale interface.
If there is no routing about the tailscale interface, please add these in the Luci > Network > Firewall > Custom Rule:

iptables -A FORWARD -i br-lan -o tailscale0 -j ACCEPT
iptables -A FORWARD -i tailscale0 -o br-lan -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -o tailscale0 -j MASQUERADE

doujinflip · 2025-01-03T17:36:42.860Z

There's no "Custom Rule" tab on there, instead it's a different "IP Sets" one

Inputting the provided commands directly into the SSH shell does not seem to change anything either

bruce · 2025-01-09T04:25:41.077Z

doujinflip:

unable to ping anything when trying to connect to the Exit Node.

Can IP and domain name ping succeed or not?

SSH to the router, execute and check if approve the subnet on the tailscale center:

ifconfig
tailscale status
ip r

Is this exit node available on the tailscale APP to test on the phone/laptop/pad?

doujinflip · 2025-02-01T15:28:48.157Z

Using the newest Tailscale v1.80.0 package, when the Exit Node is activated I am only able to ping the IP of the immediate upstream router. No website or other IP address (including the modem beyond or other Tailscale nodes) can be reached.

When the Exit Node function is off, everything can be reached normally. This only happens on these Brume 1 devices which do not have a way to override the Tailscale DNS using the old 4.3.8 beta.

bruce · 2025-02-06T01:42:07.129Z

After enabling the exit node of the Brume 1, you need to find Brume 1 in the Tailscale center and approve all subnets.

doujinflip · 2025-02-08T21:53:43.107Z

Ah to clarify, it's when my Brume 1 tries to be a client connecting to another Exit Node that it's having trouble making connections. Being an Exit Node itself it works fine.