Tailscale

With the Zero Trust VPN from Tailscale, direct access to the Antcas server and its networks can be enabled. Tailscale uses the IP range 100.64.0.0/10. This is fixed and cannot be changed.

Notes: Tailscale is only available from Core 2 or higher.

Configuration

First, an account must be set up with Tailscale. Then a device can be added using a token. The token is automatically extracted from the command line when it is inserted under Authentication in the gateway:

curl -fsSL https://tailscale.com/install.sh | sh && sudo tailscale up --auth-key=tskey-auth-korkiSFnhi11CNTRL-p5QjEQ2bwLXpNtoWHwdsLX9T22an1TCX

After the server has been added, the expiration date of the token must be removed. This can be done in the menu under Disable key expiry. Under the server, the tag Expiry disabled should now appear.

Note: Do not forget to assign the ports of the visualization to the network interface of the VPN after it has been configured.

Note: The service checks every night for a new update. This is then automatically installed and leads to an interruption if a connection is active.

Routing and NAT

To access other networks, all networks where routing (NAT forwarding) should take place can be selected in the network interface tailscale0 under the Advanced tab. After the settings have been applied, all routes must be accepted and configured in the web administration.

The option Exit node is not supported by Antcas Control.

Multiple Clients

Several Tailscale clients can be used. However, it is recommended to always assign them to the same account. Since multiple networks share the same subnet, the last started client will create the NAT rules accordingly.

Certificates

If the option under DNS ▸ HTTPS Certificates ▸ Enable HTTPS... is activated in the Tailscale web administration, the hostname is automatically configured in the network interface e.g. tailscale0 under the Advanced tab. You can find the FQDN under the server's IP address. The domain always ends with .ts.net. No port forwarding is necessary for these certificates. If the option is activated later or the name is changed, it may take several minutes for the setting to be applied.

Tailscale Funnel

With Funnel, individual services can be made publicly accessible. First, the visualization must be assigned to the network interface. Then the port of the visualization can be selected from the list. Antcas Control currently only supports one funnel on the public port 443. To release multiple visualizations, multiple Tailscale clients can be created.

When the funnel is activated for the first time, a message is displayed in Antcas Control to activate it in the account. If an error message occurs, make sure you are logged into the same account in the browser as well.

Note: This method is currently in the beta program. You can find more details here: https://tailscale.com/docs/features/tailscale-funnel

DNS Server

The DNS server from Tailscale is not set automatically. This is 100.100.100.100 and can be added manually.

Delete Access

To remove access, the VPN Tailscale must be removed. Deactivating alone does not completely remove the account.

Proxy

It is possible to use an HTTP proxy, SOCKS5 or SOCKS5 with hostname.