Route Tailscale Through VPN Connection

[jonnyb]

Hi,

I have Tailscale on my Flint3 router so I can connect my phone to my home network when I’m out. This works well for using Jellyfin, Symphonium, Immich and for accessing my files and routing my internet traffic through my home connection when I’m out.

However, I have a privacy VPN set up on my router to mask all the traffic that comes from my home network.

I want the Tailscale exit node traffic to be routed through the privacy VPN too, because I don’t want to expose the traffic that’s coming from my phone and going through my home internet connection.

So the route would basically be like this: Phone ==> Tailscale ==> Privacy VPN ===> Internet

Any help with this would be appreciated.

[will.qiu]

Hi

I assume you already know how to configure GL.iNet as an exit node.
If you need assistance on this side, please refer to the following thread for configuration.

Tailscale settings lost on reboot

Yeah I see that now after you posted that dir list. The more I look at this the more it seems all so familar: This is untested code to enable exit nodes I never got feedback on from someone else but here: sed '/param="$param --exit-node-allow-lan-access --exit-node=$exit_node_ip"/a\ param=“$param --advertise-exit-node --allow-exit-node --allow-routes”' /usr/bin/gl_tailscale >> \ /usr/bin/gl_tailscale.new && mv /usr/bin/gl_tailscale /usr/bin/gl_tailscale.stock \ && mv /u…

Here are the steps to further adjust the configuration to make with Tailscale exit node work with WireGuard VPN:

1. In Luci - Network - Firewall - Zones, configure tailscale0 to allow forwarding to wgclient1.
   

   

2. In Luci - Network - Routing - IPv4 rules, add the following two rules:
   2.1 Forward outbound traffic from the Tailscale network into the VPN tunnel.
   

   
   
   2.2 Prevent form Tailscale to local LAN traffic that matches
   
   
   
   
   

[jonnyb]

Thanks for the help, but I attempted the previous step and it just cut off LAN and Internet access to my phone.

This is what I’m trying to achieve. It’s the internet (WAN) routing I’m finding difficult. As I’m pretty inexperienced with this, I’d need step by step explanations with no ambiguity or assumption of prior knowledge. For information, I’m using Surfshark as the VPN, and used the Gl.inet UI to configure that as the wireguard VPN. Thanks in advance.

[jonnyb]

Also in relation to the reply. I wasn’t sure where to find the subnet CIDR value. But I managed to find it in the status page of LuCI. That was the main issue. I was trying all kinds of addresses in there to see if that was the problem. So if anyone else comes across this. You can find the subnet CIDR notation on the menu under status and then routing.

Thanks @will.qiu for your help

[jonnyb]

So, this solution briefly worked. It was really slow, but then stopped working entirely for both the LAN and internet. Any ideas anyone?