Loop during connections to tailscale

[MinerPL]

When setting up Tailscale in Docker on Mikrotik, I encountered loops when trying to access the device on the Tailscale network.

10.21.37.0/24 is my local network
172.17.0.1 is container network interface

My environment variable configuration:

[admin@P202] /container/envs> print
Columns: LIST, KEY, VALUE
#  LIST       KEY                VALUE                                                         
0  tailscale  ADVERTISE_ROUTES   10.21.37.0/24                                                 
1  tailscale  AUTH_KEY           tskey-auth-AUTH-KEY
2  tailscale  CONTAINER_GATEWAY  172.17.0.1                                                    
3  tailscale  PASSWORD           PASSWORD
4  tailscale  TAILSCALE_ARGS     --accept-routes --advertise-exit-node                         
5  tailscale  UPDATE_TAILSCALE   1                                        

The exact problem:

mikrotik:/# traceroute 100.122.223.122
traceroute to 100.122.223.122 (100.122.223.122), 30 hops max, 46 byte packets
 1  172.17.0.1 (172.17.0.1)  0.036 ms  0.027 ms  0.021 ms
 2  mikrotik (172.17.0.2)  0.023 ms  0.029 ms  0.025 ms
 3  172.17.0.1 (172.17.0.1)  0.024 ms  0.028 ms  0.023 ms
 4  mikrotik (172.17.0.2)  0.023 ms  0.029 ms  0.024 ms
 5  *

Unfortunately, I am unable to find a solution to this problem on my own.

[frankedwards]

Could you check your Mikrotik has a default route set and is NAT-ing your container out via your wan interface, e.g.

/ip/route> print
Flags: D - DYNAMIC; A - ACTIVE; c - CONNECT, s - STATIC, d - DHCP
Columns: DST-ADDRESS, GATEWAY, ROUTING-TABLE, DISTANCE
#     DST-ADDRESS      GATEWAY      ROUTING-TABLE  DISTANCE
  DAd 0.0.0.0/0        192.168.1.1  main                  1
0  As 100.64.0.0/10    172.17.0.2   main                  1
  DAc 172.17.0.0/16    dockers      main                  0
  DAc 192.168.1.0/24   ether1       main                  0
  DAc 192.168.88.0/24  bridge       main                  0

/ip/firewall/nat> print
Flags: X - disabled, I - invalid; D - dynamic 
 0    ;;; defconf: masquerade
      chain=srcnat action=masquerade out-interface-list=WAN 
      ipsec-policy=out,none 

[MinerPL]

Of course

[admin@P202] > ip route print
Flags: D - DYNAMIC; A - ACTIVE; c - CONNECT, s - STATIC; + - ECMP
Columns: DST-ADDRESS, GATEWAY, ROUTING-TABLE, DISTANCE
#      DST-ADDRESS       GATEWAY               ROUTING-TABLE  DISTANCE
0  As+ 0.0.0.0/0         192.168.128.1%ether4  main                  1
1  As+ 0.0.0.0/0         192.168.128.1%ether5  main                  1
  DAc  10.21.37.0/24     bridge                main                  0
2  As  100.64.0.0/10     172.17.0.2            main                  1
  DAc  172.17.0.0/16     dockers               main                  0
  DAc+ 192.168.128.0/21  ether5                main                  0
  DAc+ 192.168.128.0/21  ether4                main                  0
3  As  0.0.0.0/0         192.168.128.1%ether4  ether4                1
4  As  0.0.0.0/0         192.168.128.1%ether5  ether5                1

[admin@P202] > ip firewall nat print
Flags: X - disabled, I - invalid; D - dynamic 
 0 X  ;;; defconf: masquerade
      chain=srcnat action=masquerade out-interface-list=WAN log=no log-prefix="" ipsec-policy=out,none 

 1    chain=srcnat action=masquerade out-interface=ether4 log=no log-prefix="" 

 2    chain=srcnat action=masquerade out-interface=ether5 log=no log-prefix="" ```

[frankedwards]

Is the following test successful

[admin@P202] > /ping controlplane.tailscale.com src-address=172.17.0.1

[MinerPL]

  SEQ HOST                                     SIZE TTL TIME       STATUS                                               
    0 192.200.0.116                              56  53 24ms782us 
    1 192.200.0.116                              56  53 33ms408us 
    2 192.200.0.116                              56  53 24ms866us 
    3 192.200.0.116                              56  53 24ms732us 
    4 192.200.0.116                              56  53 24ms889us 
    5 192.200.0.116                              56  53 24ms862us 
    6 192.200.0.116                              56  53 25ms147us 
    sent=7 received=7 packet-loss=0% min-rtt=24ms732us avg-rtt=26ms98us max-rtt=33ms408us 

Yep

[frankedwards]

Thanks. Could you please verify 100.122.223.122 is connected to the tailnet and online.

mikrotik:/# tailscale status | grep 100.122.223.122

[MinerPL]

I just replaced API Key and it started to work
DO I should select key to be reusable or not?

[frankedwards]

We suggest using a non-reusable key or Oauth secret.