Remote access through Tailscale

Third party integrations
1

Hi,

I recently ran into a strange issue after updating the Tailscale add-on in Home Assistant.

Previously, I could access Home Assistant remotely through Tailscale without any problems. After the update, Tailscale did not advertise the subnet and exitpoint. I had to manually reset those. After this i can accesse my homenetwork remotely. I can even see the login pages in HA but upon trying to log on all devices connected via Tailscale are now treated as remote clients and refused access.

Symptoms:

  • I can reach the Home Assistant login page via Tailscale.
  • Home Assistant rejects the login attempt.
  • Home Assistant generates a notification showing login attempts from a 100.x.x.x address (the Tailscale IP range).
  • The same device can log in successfully when Tailscale is disabled and it accesses Home Assistant directly on the local network.
  • The problem occurs both from outside my home network and from inside the network if the client is connected through Tailscale.
  • Home Assistant is running on 192.168.1.XX:8123.
  • Disabling exit node advertisement did not change the behavior.

It seems that Home Assistant no longer considers Tailscale traffic as trusted/local traffic and is using the Tailscale IP (100.x.x.x) instead of the LAN IP.

Has anyone seen this after a recent Tailscale update, and what would be the best way to restore the previous behavior?

Thanks!

2

Is there missing documentation or set-up in the App?
Perhaps you need to add a setting in this integration?

3

By default, you cannot use the 100.x.x.x address directly as it will always say “Invalid Client ID”

You say “I can reach the Home Assistant login page via Tailscale.” but do you mean via a subnet-routed 192.168.1.xx address, or directly via the Tailscale IP? Using a subnet routed 192.168.1.xx address should still work.

If you do ever want to use the direct 100.x.x.x address, you can do what I did and use NGINX proxy manager to create an HTTP proxy that fools HA by using the 100.x.x.x as the trusted Host.

4

BREAKING CHANGE

Prior to 0.29, tailscale would interpret this line in its configuration YAML

advertise_routes: [ ]

to mean “route your local LAN subnet to your remote clients” by default

As of 0.29 you need to explicitly define your local LAN subnet like this (for example) :

advertise_routes: [192.168.1.0/24]

ETA : see Update from 0.28.1 to 0.29.0 can change default settings of subnet routing, exit node, taildrop and userspace networking · Issue #747 · hassio-addons/app-tailscale · GitHub

That will allow you to use a local LAN address for your HA app or access other non-HA nodes on that subnet remotely.