Tailscale Client

Tailscale Client

Connect services securely with Tailscale on Moltern featuring WireGuard VPN, mesh networking, zero-config setup, and encrypted peer-to-peer connections.

Service catalog docs
Deploy Now →

Tailscale Client

What is Tailscale Client?

Tailscale securely connects your devices over the internet using WireGuard. It creates a secure mesh network between your devices, servers, and services with zero-configuration required. This client service allows your Moltern deployment to join your Tailscale network.

Features

  • Zero-config WireGuard VPN
  • Secure mesh networking
  • Encrypted peer-to-peer connections
  • Cross-platform support
  • Easy device management
  • Access control lists
  • MagicDNS for easy service discovery

Links

Firewall Considerations

When using Tailscale together with Moltern, special attention must be paid to firewall rules — especially if you restrict SSH (port 22).

Moltern relies on SSH (port 22) to manage deployments, even when communicating with the same host. Blocking port 22 without proper exceptions will break internal functionality.

Local Firewall (Host Machine)

If you deny incoming traffic on port 22 (deny all), you must explicitly allow internal traffic from your local Docker or system networks.

Example:

  • Allow port 22 from local subnets (Docker / internal interfaces)

  • Typical ranges include:

    • 172.16.0.0/12
    • 192.168.0.0/16
    • 10.0.0.0/8

Example rule (conceptual):

ALLOW TCP 22 FROM 172.16.0.0/12
ALLOW TCP 22 FROM 192.168.0.0/16
ALLOW TCP 22 FROM 10.0.0.0/8
DENY  TCP 22 FROM ANY

Reason:

  • Moltern connects to itself via internal networking (Docker bridge or host interfaces)
  • Without these rules, self-SSH connections fail

Remote Server Firewall (Managed Servers)

If Moltern deploys to external servers, similar logic applies:

  • You must allow SSH only from the Moltern host

  • Example:

ALLOW TCP 22 FROM <GITHOST_SERVER_IP>
DENY  TCP 22 FROM ANY

Notes:

  • Replace <GITHOST_SERVER_IP> with the public or Tailscale IP of your Moltern instance

  • This ensures:

    • Secure restricted SSH access
    • Moltern can still deploy and manage services

Tailscale Integration Notes

When using Tailscale:

  • You can allow SSH via Tailscale IPs instead of public IPs
  • Example:
ALLOW TCP 22 FROM 100.x.x.x/10

Advantages:

  • No public exposure of SSH
  • Encrypted peer-to-peer communication
  • Simplified access control via Tailscale ACLs
← Back to Documentation