Docs Config Tailscale

Tailscale

The core has a built-in tsnet instance, letting you use a node (or exit node) from your Tailscale/Headscale network directly as an outbound proxy — no separate Tailscale client needed.

Example Config

config.yaml YAML

proxies:
  - name: "tailscale"
    type: tailscale
    hostname: mihomo
    auth-key: tskey-auth-xxxx
    udp: true
    accept-routes: true
    exit-node: 100.64.0.1
    exit-node-allow-lan-access: true
    ip-version: ipv4-prefer

Field Reference

hostnameOptional

The Tailscale device name; leave blank to let tsnet handle it automatically.

auth-keyOptional

Your Tailscale or Headscale login key; if left blank, an interactive login link will be printed in the logs on first startup.

control-url / state-dirOptional

control-url sets a custom control server or Headscale address; state-dir is the tsnet state directory, defaulting to tailscale.

accept-routesOptional

Whether to accept subnet routes advertised within the Tailnet.

exit-node / exit-node-allow-lan-accessOptional

exit-node specifies which exit node to use (an IP, or auto:any to select automatically); exit-node-allow-lan-access determines whether local LAN access is still allowed while using an exit node.

dialer-proxy / interface-name / routing-markOptional

Same meaning as in other protocols: dialer-proxy sets the outbound proxy used for Tailscale's control plane and DERP/STUN connections; interface-name/routing-mark are for multi-interface/policy routing setups.

If the destination is outside Tailscale's routed range, the connection will fail outright rather than falling back to a direct connection. To reach the public internet, make sure you have a working exit-node configured, or accept a subnet route that covers the destination range. Also note that every proxy only establishes its actual connection on first use, so the first connection to a Tailscale node occasionally timing out is normal — just try again.