PVE中使用Tailscale

# 容器内执行查看主机设备信息
ls -al /dev/net/tun
*** root root 10, 200 *** /dev/net/tun
 
# 修改CT配置，PVE 主机内执行
vim /etc/pve/lxc/<ID>.conf
# 修改下面两个，10:200 和上面的要对应起来
# lxc.cgroup2.devices.allow: c 10:200 rwm
# lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file

vim /etc/sysctl.conf
# 添加以下配置
# net.ipv4.ip_forward = 1
# net.ipv6.conf.all.forwarding = 1
# 或者执行
# echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.conf
# echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.conf

# 使其生效
sysctl -p /etc/sysctl.conf

apt install ethtool
apt install networkd-dispatcher

# 临时生效，重启后失效
NETDEV=$(ip -o route get 8.8.8.8 | cut -f 5 -d " ")
ethtool -K $NETDEV rx-udp-gro-forwarding on rx-gro-list off

# 配置开机自动执行，依赖 networkd-dispatcher
# 检查：systemctl is-enabled networkd-dispatcher
printf '#!/bin/sh\n\nethtool -K %s rx-udp-gro-forwarding on rx-gro-list off \n' "$(ip -o route get 8.8.8.8 | cut -f 5 -d " ")" | tee /etc/networkd-dispatcher/routable.d/50-tailscale
chmod 755 /etc/networkd-dispatcher/routable.d/50-tailscale

# 测试效果
/etc/networkd-dispatcher/routable.d/50-tailscale
test $? -eq 0 || echo 'An error occurred.'

# 查看 UDP 转发及开启 UDP GRO转发
ethtool -k eth0 | grep -e rx-gro-list -e rx-udp-gro-forwarding
ethtool -K eth0 rx-udp-gro-forwarding on
 
# 配置开机自动开启 UDP GRO 转发
# vim /etc/systemd/system/ethtool-config.service
[Unit]
Description=Apply ethtool settings
 
[Service]
Type=oneshot
ExecStart=/usr/sbin/ethtool -K eth0 rx-udp-gro-forwarding on
RemainAfterExit=yes
 
[Install]
WantedBy=multi-user.target
 
# 启动服务
systemctl enable --now ethtool-config

# 安装
curl -fsSL https://tailscale.com/install.sh | sh

# 安装基础软件包
apt install ethtool net-tools chrony -y

vim /etc/systemd/system/tailscale.service
# 可以使用 --hostname 指定 hostname
[Unit]
Description=AutoStart tailscale
After=tailscale.service
Requires=tailscale.service
[Service]
Type=oneshot
ExecStart=/usr/bin/tailscale up --authkey=xxxx --accept-routes --accept-dns=false --advertise-exit-node --advertise-routes=192.168.6.0/24
ExecStop=/usr/bin/tailscale down
RemainAfterExit=yes
Restart=on-failure
[Install]
WantedBy=multi-user.target
   
# 设置自动升级
tailscale set --auto-update

# 测试使用 exit node
sudo tailscale set --advertise-exit-node

# 手动运行，可以不使用 authkey 使用 url 进行登录
tailscale up --authkey=xxxx --accept-routes --accept-dns=false --advertise-exit-node --advertise-routes=192.168.6.0/24

tailscale netcheck

tailscale status

Tailscale ping xxx

# stop
tailscale down

# 安装 Go
# 如果你的服务器在境内，可以为Go配置代理加速  
# go env -w GOPROXY=https://goproxy.cn,direct
wget https://go.dev/dl/go1.25.0.linux-amd64.tar.gz
rm -rf /usr/local/go && tar -C /usr/local -xzf go1.25.0.linux-amd64.tar.gz
export PATH=$PATH:/usr/local/go/bin
go version

# 安装 derp
go install tailscale.com/cmd/derper@main

# derper 命令在~/go/bin 下，可以直接拷到任意目录
# sudo cp ~/go/bin/derper /usr/bin/

# 启动
sudo derper --hostname=example.com
# or 加入验证
sudo derper --hostname=derp.example.com --verify-clients

# 修改自己的 IP
DERP_IP="12.12.12.12"
openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes -keyout ${DERP_IP}.key -out ${DERP_IP}.crt -subj "/CN=${DERP_IP}" -addext "subjectAltName=IP:${DERP_IP}"

derper --hostname="12.12.12.12" -certmode manual -certdir ./

{
  // ... other parts of tailnet policy file
  "derpMap": {
    "OmitDefaultRegions": true,
    "Regions": {
      "900": {
        "RegionID": 900,
        "RegionCode": "myderp",
        "Nodes": [
          {
            "Name": "1",
            "RegionID": 900,
            "HostName": "example.com",
            // IPv4 and IPv6 are optional, but recommended, to reduce
            // potential DERP connectivity issues if DNS is unavailable
            // or having issues. Addresses must be publicly routable
            // and not in private IP ranges.
            "IPv4": "203.0.113.15",
            "IPv6": "2001:db8::1"
          }
        ]
      }
    }
  }
}

# create /opt/derper/runderper

# open SSL ver
#!/bin/sh
cd /usr/local/gopath/bin
nohup ./derper -hostname <DOMAIN> -c=derper.conf -a :<PORT> -http-port -1 -certdir /usr/local/cert -certmode manual -verify-clients -stun > console.log 2>&1 &
echo $! > app.pid

# disabled SSL ver
#!/bin/sh
cd /usr/local/gopath/bin
nohup ./derper -hostname <DOMAIN> -c=derper.conf -a :<PORT> manual -verify-clients -stun > console.log 2>&1 &
echo $! > app.pid

# 停止脚本 /opt/derper/stopderper
#!/bin/sh
kill `cat app.pid`
rm -rf app.pid

# /etc/systemd/system/derper.service
[Unit]
Description=Derper服务
After=network.target
 
[Service]
Type=forking
ExecStart=/opt/derper/runderper
ExecStop=/opt/derper/stopderper
 
[Install]
WantedBy=multi-user.target

# 下载二进制版本
VER=0.24.1
wget https://github.com/juanfont/headscale/releases/download/v${VER}/headscale_${VER}_linux_amd64

# 下载同版本的示例配置文件  
mkdir /etc/headscale/
wget -O /etc/headscale/config.yaml https://raw.githubusercontent.com/juanfont/headscale/v${VER}/config-example.yaml
  
chmod a+x /usr/local/bin/headscale
# 创建配置目录
mkdir -p /etc/headscale
# 创建证书和数据目录
mkdir -p /var/lib/headscale
# 创建空数据库
touch /var/lib/headscale/db.sqlite


# 创建 sock，创建文件夹
mkdir /var/run/headscale
# 创建文件
touch /var/run/headscale/headscale.sock

# adduser --no-create-home --disabled-login --shell /sbin/nologin --disabled-password headscale
# 修改 Owner
# chown -R headscale:headscale /var/lib/headscale

# 测试运行
headscale serve

# 启动服务
systemctl start headscale
# 关闭服务
systemctl stop headscale
# 开机自启
systemctl enable headscale
# 查看状态
systemctl status headscale

services:
  headscale:
    image: headscale/headscale:0.23.0-alpha8
    container_name: headscale
    restart: always
    command: serve
    volumes:
      - ./config:/etc/headscale
    ports:
      - 8080:8080
      - 9090:9090

# 浏览器打开 apple/windows
http://你的域名或ip:8080/apple
# 执行页面中的命令行
tailscale login --login-server http://你的域名或ip:8080
# 获取返回的命令
headscale -n 命名空间 nodes register --key nodekey:上面这行命令返回结果的key
# 到Headscale服务器上执行返回的命令

### linux
tailscale up --login-server=http://你的域名或ip:8080 --accept-routes=true --accept-dns=false
# 获取返回的命令
headscale -n 命名空间 nodes register --key nodekey:上面这行命令返回结果的key
# 到Headscale服务器上执行返回的命令

# /etc/headscale/config.yaml

# 这里填写你的实际外网地址,域名或ip都可以
server_url: http://XXX.XXX.XXX.XXX:8080  
# Headscale 要绑定/监听的 Port
listen_addr: 0.0.0.0:8080
metrics_listen_addr: 0.0.0.0:9090
# 为客户端分配的 IP 段
ip_prefixes:
  - fd7a:115c:a1e0::/48
  - 10.1.0.0/16
randomize_client_port: true
# 修改对自己来说方便的DNS，可以保持默认
dns_config:
  # 使用本地 DNS
  override_local_dns: true
  nameservers:
    - 223.5.5.5

# 如果启用，必须配置其他部分，如 https、TLS
derp:
  server:
    enabled: false
# 建议关闭Magic DNS，否则有可能造成客户端无法正常上网
magic_dns: false
# 修改Socket存储位置
unix_socket: /var/run/headscale/headscale.sock

# /etc/systemd/system/headscale.service
[Unit]
Description=headscale controller
After=syslog.target
After=network.target

[Service]
Type=simple
User=headscale
Group=headscale
ExecStart=/usr/local/bin/headscale serve
Restart=always
RestartSec=5

# 可选的权限和安全配置
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/lib/headscale /var/run/headscale
AmbientCapabilities=CAP_NET_BIND_SERVICE
RuntimeDirectory=headscale

[Install]
WantedBy=multi-user.target

# 启动服务
systemctl start headscale
# 关闭服务
systemctl stop headscale
# 开机自启
systemctl enable headscale
# 查看状态
systemctl status headscale

# 显示节点列表
headscale nodes ls
# 删除节点
headscale nodes delete -i  <id>
# 启动服务
systemctl start headscale
# 开机自启
systemctl enable headscale
# 查看状态
systemctl status headscle
# 创建命名空间
headscale namespaces create <namespace>
# 查看命名空间列表
headscale namespaces list
# mac ping
/Applications/Tailscale.app/Contents/MacOS/Tailscale ping 100.64.0.2

# 参考配置
tun:
  enable: true
  exclude-interface:
    - Tailscale  # macOS 名字可能是 utun 固定前缀的
  auto-route: true
  auto-redirect: true

route-exclude-address:
  - 100.64.0.0/10