De script seems to do an assumption that is should always run on port 41641, which is not the case on setups which use a random port. The script in its current form starts up properly, but because tailscale starts up with the default port, tailgate sees this, configures iptables and exits. In the case of random ports, this results in iptables config that does nothing.
The fix in my case is removing the exit on line 21:
|
if [ "$REAL_PORT" -eq 41641 ]; then exit 0; fi; \ |
. That way tailgate keeps running, and restarts the unit when the port changes, which causes the iptables rules to be reloaded using the new port
De script seems to do an assumption that is should always run on port 41641, which is not the case on setups which use a random port. The script in its current form starts up properly, but because tailscale starts up with the default port, tailgate sees this, configures iptables and exits. In the case of random ports, this results in iptables config that does nothing.
The fix in my case is removing the exit on line 21:
tailgate/systemd/tailgate-allow@.service
Line 21 in 90078e8