Tailscale VPN¶

Tailscale ACL policy, peer relay, and connection troubleshooting.

ACL Policy¶

{
  "tagOwners": {
    "tag:relay": ["autogroup:admin"],
    "tag:clients": ["autogroup:admin"]
  },
  "acls": [
    { "action": "accept", "src": ["*"], "dst": ["*:*"] }
  ],
  "grants": [
    {
      "src": ["tag:clients"],
      "dst": ["tag:relay"],
      "app": { "tailscale.com/cap/relay": [] }
    },
    {
      "src": ["tag:clients"],
      "dst": ["tag:relay"],
      "ip": ["*"]
    }
  ]
}

The grants section must be set via the Tailscale API directly -- the MCP ACL tool (manage_acl) silently drops it:

curl -X POST -H "Authorization: Bearer $TAILSCALE_API_KEY" \
  -H "Content-Type: application/json" \
  "https://api.tailscale.com/api/v2/tailnet/mordasiewicz.com/acl" \
  -d '{ ... full ACL with grants ... }'

Peer Relay¶

When direct connections fail (school NAT, mobile hotspot symmetric NAT), devices route through tsrelay instead of Tailscale's DERP servers. No bandwidth throttling unlike DERP.

Do not set --relay-server-static-endpoints -- Bell PPPoE IP is dynamic. STUN + UPnP discovers the public IP automatically.

Connection priority (automatic)¶

flowchart TD
    A["Client connects"] --> B{"Direct UDP<br/>hole-punch?"}
    B -- "Yes" --> C["Direct connection<br/>~15ms"]
    B -- "No" --> D{"Peer relay<br/>available?"}
    D -- "Yes" --> E["Peer relay<br/>~15-45ms"]
    D -- "No" --> F["DERP relay<br/>~14ms, throttled"]

Grant mechanics¶

• src = who can use the relay (tag:clients)
• dst = the relay device (tag:relay)
• Only the initiating device needs the tag, not both sides
• Tags can't be removed without tailscale up --force-reauth
• To test without relay, remove grants from ACL instead of changing device tags

Connection Results by Location¶

Tailscale Ports¶