Skip to content

Instantly share code, notes, and snippets.

@juniorz
Last active December 5, 2025 12:54
Show Gist options
  • Select an option

  • Save juniorz/888ec95c5ab810801eb318a5017f173b to your computer and use it in GitHub Desktop.

Select an option

Save juniorz/888ec95c5ab810801eb318a5017f173b to your computer and use it in GitHub Desktop.
How to configure a Tailscale router

How to setup a tailscale router

On Unifi Cloud Gateway Ultra

Product: https://eu.store.ui.com/eu/en/products/ucg-ultra
Quad-core ARM® Cortex®-A53 at 1.5 GHz
3 GB RAM

Tailscale can be installed as per instructions for linux (both stable and unstable builds).

# /etc/default/tailscaled
PORT="41641"
FLAGS="--state=/data/tailscale/tailscaled.state"

# https://www.reddit.com/r/Tailscale/comments/1fjysnc/comment/lny2zh0/
TS_TUN_DISABLE_TCP_GRO=true

systemcdl edit tailscaled.service

# https://tailscale.com/kb/1023/troubleshooting#tcp-connection-issues-between-two-devices
# https://tailscale.com/kb/1214/site-to-site#clamp-the-mss-to-the-mtu
ExecStartPost=/bin/bash -c 'iptables -t mangle -I UBIOS_FORWARD_TCPMSS 1 -o tailscale0 -p tcp -m tcp \
  --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu'
ExecStopPost=/bin/bash -c 'iptables -t mangle -D UBIOS_FORWARD_TCPMSS -o tailscale0 -p tcp -m tcp \
  --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu'

ExecStartPost=/bin/bash -c 'iptables -w -t nat -I UBIOS_POSTROUTING_USER_HOOK 1 -o tailscale0 -m comment --comment "ts-nat" -j MASQUERADE '
ExecStopPost=/bin/bash -c 'iptables -w -t nat -D UBIOS_POSTROUTING_USER_HOOK -o tailscale0 -m comment --comment "ts-nat" -j MASQUERADE '

Outcome: it works fast for low sustained bandwidth scenarios, doesn't work for media streamimg. The UCG device has a Linux kernel version too old to benefit from TCP GRO, and there's just not enough CPU power.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment