Travel router (Raspberry Pi) using hostapd and tailscale

mazzo · 01-29-2024, 12:46 PM

I have set up a tailnet with an exit node. The pi travel router is connected and is using the exit node locally (ie if I do a curl ifconfig.me it shows the exit node ip address).

It is providing dhcp connections through wifi and I can connect no problem. If I do not run tailscale, it serves the internet natively to any client that connects, however the moment I run tailscale up --exit-node=100.xx.xx.xx, it fails to server any internet. I can still connect to the wifi and get an local ip address and if I physically log into the pi, I am still able to ping google or do the ipconfig.me without issue.

So the problem is that the wifi is not passing anything to the eth0 connection (or possibly the tailscale0 connection). ipv4 forwarding is on.

I've fiddled with this for hours and end up getting into such a mess I need to rebuild the router again.

Setup: Pi running dietpi, with wifi hotspot app installed (basically hostapd) and tailscale client.

Any help would be very much appreciated. What little hair I have is being torn out!

Turbocapitalist · 01-31-2024, 10:47 AM

Which OS do you have on the Raspberry Pi? If it is the latest Raspberry Pi OS (bookworm) then you should probably use nmcli or similar to set up sharing.

Here's my guess:

Code:

sudo nmcli connection add con-name 'wlan0-static' \
    ifname wlan0 \
    ip4 10.51.100.1/24 \
    ipv4.method shared \
    autoconnect yes \
    type wifi \
    ssid ... \
    802-11-wireless.mode ap \
    802-11-wireless.band bg \
    802-11-wireless.channel 1 \
    wifi-sec.key-mgmt wpa-psk \
    wifi-sec.psk "...." 

sudo nmcli connection up wlan0-static

Where ... is the name of your WLAN and .... is the passphrase for it. That assumes eth0 for egress and wlan0 for the access point. For 2.4GHz choose only channels 1, 6, or 11 -- no others, as there will be overlap otherwise and that will slow you down worse than having to share the channel with another station. If you would prefer 5GHz then choose 'a' instead of 'bg' and pick an appropriate 5GHz channel.

Tailscale is a proprietary VPN, right?