Is it possible to disable user-mode networking when the host OS already has Tailscale?

[bjeanes]

I have tailscale installed and operating on the Host OS, as it has got me out of a pickle in a few instances when HA didn't come up properly.

However, I have the tailscale add-on enabled too and in particular wish to use it to have outbound connectivity to other devices in my tailnet, which requires disabling user-mode networking to do.

Unfortunately, I get the following error when doing so:

2024/07/20 16:17:43 Program starting: v1.70.0-t0e0a21241-g26f80df92, Go 1.22.5: []string{"/opt/tailscaled", "--state=/data/tailscaled.state", "--statedir=/data/state", "--no-logs-no-support"}
2024/07/20 16:17:43 LogID: d3d538f783c88e0f41a2357f9a028a9f31cc2e5f9a000f19e0e02b6d029d7c45
2024/07/20 16:17:43 logpolicy: using system state directory "/var/lib/tailscale"
2024/07/20 16:17:43 dns: [resolved-ping=yes rc=unknown ret=direct]
2024/07/20 16:17:43 dns: using "direct" mode
2024/07/20 16:17:43 dns: using *dns.directManager
2024/07/20 16:17:43 wgengine.NewUserspaceEngine(tun "tailscale0") ...
2024/07/20 16:17:43 TUN device tailscale0 is busy; another process probably still has it open (from old version of Tailscale that had a bug)
2024/07/20 16:17:43 To fix, kill the process that has it open. Find with:

$ sudo lsof -n /dev/net/tun

2024/07/20 16:17:43 ... and then kill those PID(s)
2024/07/20 16:17:43 wgengine.NewUserspaceEngine(tun "tailscale0") error: tstun.New("tailscale0"): device or resource busy
2024/07/20 16:17:43 flushing log.
2024/07/20 16:17:43 logger closing down
2024/07/20 16:17:43 getLocalBackend error: createEngine: tstun.New("tailscale0"): device or resource busy
[16:17:43] INFO: Service tailscaled exited with code 1 (by signal 0)

Would it be possible to create a new tailscale tun device, tailscale1 in some way in these instances?

[lmagyar]

As a quick workaround, can't you configure the host OS's tailscaled to sg. like tailscaled --tun=tailscale1, and in that case the add-on's default tailscale0 wont collide with it? Currently the add-on has no config option to change TS's default tailscale0 to sg. else, only to disable it and use userspace networking. Your case is quite an edge case, I don't think a PR addressing this issue would be merged, but I'm just another user/contributor.

[bjeanes]

Yeah that is worth investigating. I haven't looked into it thoroughly but I wasn't sure how to make that change persistent. Probably need to modify the tailscaled.service definition on the host.

However, I've realised that I already can access tailnet devices, probably because the OS has its own connection. What's actually happening is that MagicDNS is not working, despite accept_dns: true being the default when unspecified. This might be some interaction with the CoreDNS Override add-on, which I've had installed for years but maybe is no longer needed /shrug

EDIT: Seems like that add-on is no longer necessary since 2022.05.0 because you can do ha dns options --fallback=false. I'm changing that around and removing add-on to see if MagicDNS starts working, but after poking around how DNS works, I'm not really sure that's what is at play here...

[bjeanes]

root@a0d7b954-tailscale:/$ nslookup some-host.foo-bar.ts.net
Server:         172.30.32.3
Address:        172.30.32.3:53

** server can't find some-host.foo-bar.ts.net: NXDOMAIN

** server can't find some-host.foo-bar.ts.net: NXDOMAIN

root@a0d7b954-tailscale:/$ nslookup some-host.foo-bar.ts.net 100.100.100.100
Server:         100.100.100.100
Address:        100.100.100.100:53

Name:   some-host.foo-bar.ts.net
Address: 100.121.111.101

[bjeanes]

I can add 100.100.100.100 and a local resolver as DNS servers, which then does resolve .ts.net hosts (with only FQDN), but then it breaks normal resolution:

bjeanes@homeassistant:~$ ha dns options -r dns://100.100.100.100 -r dns://10.10.10.254
Command completed successfully.
bjeanes@homeassistant:~$ docker exec -it `docker ps -q -f name=tailscale` /bin/bash
root@a0d7b954-tailscale:/$ nslookup some-host.foo-bar.ts.net
Server:		172.30.32.3
Address:	172.30.32.3:53

Name:	some-host.foo-bar.ts.net
Address: 100.120.117.108

root@a0d7b954-tailscale:/$ nslookup some-host
Server:		172.30.32.3
Address:	172.30.32.3:53

** server can't find some-host.local.hass.io: NXDOMAIN

root@a0d7b954-tailscale:/$ nslookup google.com
Server:		172.30.32.3
Address:	172.30.32.3:53

** server can't find google.com: SERVFAIL

** server can't find google.com: SERVFAIL

Presumably this is because it is trying to use 100.100.100.100 first, for all requests (and assuming that a single-component host must be .local :).

[bjeanes]

I guess this is just a duplicate of #376 really

[lmagyar]

On DNS, see also #310.

Note: A solution for the DNS issue is also on my wishlist. If somebody comes up with a working solution, I'm happy to create a PR, but the workarounds I've seen doesn't worked for me (even ha dns ...) or were too hacky for a PR.