tailscale-edgeos | Running Tailscale on Ubiquiti EdgeOS

Enter a root shell. Create the required directories. Fetch the firstboot script. Download the latest MIPS release from https://pkgs.tailscale.com/stable/#static. Different EdgeRouter models use either MIPS or MIPS-LE, so make sure you download the right tarball for your platform. ER-4 is MIPS, ER-X is MIPSLE. Copy the extracted files to /config/tailscale. Run the firstboot script and log in to Tailscale. The example below enables subnet routing for one subnet, enables use as an exit node (Tailscale 1.6+), and uses a one-off pre-auth key, which can be generated at https://login.tailscale.com/admin/authkeys.
Enter a root shell sudo bash
Create the required directories mkdir -p /config/firstboot.d /config/tailscale /config/tailscale/tailscaled.service.d
Fetch the firstboot script curl -o /config/firstboot.d/tailscale.sh https://raw.githubusercontent.com/jamesog/tailscale-edgeos/main/firstboot.d/tailscale.sh chmod 755 /config/firstboot.d/tailscale.sh
Download the latest MIPS release from https://pkgs.tailscale.com/stable/#static Different EdgeRouter models use either MIPS or MIPS-LE, so make sure you download the right tarball for your platform. ER-4 is MIPS, ER-X is MIPSLE. curl https://pkgs.tailscale.com/stable/tailscale_X.Y.Z_mips.tgz | tar -zxvf - -C /tmp
Copy the extracted files to /config/tailscale cp -rv /tmp/tailscale_*/* /config/tailscale
Run the firstboot script and log in to Tailscale The example below enables subnet routing for one subnet, enables use as an exit node (Tailscale 1.6+), and uses a one-off pre-auth key, which can be generated at https://login.tailscale.com/admin/authkeys /config/firstboot.d/tailscale.sh tailscale up --advertise-routes 192.0.2.0/24 --advertise-exit-node --authkey tskey-XXX
(Optional) If you want sshd to explicitly listen on the Tailscale address instead of all addresses: Fetch the override unit curl -o /config/tailscale/tailscaled.service.d/before-ssh.conf https://raw.githubusercontent.com/jamesog/tailscale-edgeos/main/tailscaled.service.d/before-ssh.conf systemctl daemon-reload Exit the shell, enter configure mode and set the listen-address If you don't currently have any listen-address directives, make sure you add any other addresses you want to access the router by, such as a private network IP. N.B. the Tailscale IP can be found in the admin console, or using tailscale status -peers=false | awk '{print $1}' exit configure set service ssh listen-address <Tailscale IP> commit comment "sshd listen on Tailscale IP"