Just a quick notice for anyone using this software in their homelab. Tailscale has released v1.104.4 to address a series of prominent vulnerabilities disclosed last week. These vulns affect the Tailscale Serve and Tailscale SSH functionalities of the software, and allow already-authorized attackers to gain further privileges erroneously. Kindly update to that version or higher, especially if you are using one of the SSH/Serve features.
For headscale selfhosters that also use Tailscale SSH, consider setting TS_SSH_DISABLE_FORWARDING=1 on all clients, as headscale does not have a way to force turning off SSH forwarding (one of the attack vectors). Headscale also has a relevant disclosed vulnerability affecting node registration, and an in-progress patch for that which is trackable here.
Finally, do give your SSH grants/access control list a review again. You may also disable these ssh/serve features if you don’t need them (and even compile the binary without them if you know how), and consider traditional alternatives such as OpenSSH + normal reverse proxy.
Further links:
- Tailscale’s blogpost on findings and fixes, with security recommendations
- Tailscale’s security bulletin for more info on the vulnerabilities (see TS-2026-014 to TS-2026-017)
- Their prior investigation notes here
That’s one of my TODOs on NixOS but I keep procrastinating on that. Today I finally set up adguard home locally on my PC and I want to make it available as a VPN(?) on my phone so I may finally get around to doing that soon-ish. I have zero clue how any of that works or how to set it up, however. Lol
This seems like a decent guide on how to set it up:
https://www.cyberciti.biz/faq/how-to-set-up-wireguard-firewall-rules-in-linux/
It’s very similar to the config I’ve got. The nat iptables stuff in step 1 is what enables wireguard to be used as a VPN exit node. (+ net.ipv4.ip_forward=1)