Tailscale: Support connecting to multiple networks

[kylrth]

We use Tailscale at work, and I'd like to use Tailscale at home. As such I want to be able to connect to the two networks simultaneously. When I was using relay-node, I created two separate systemd services with separate --tuns and --ports. When I switched to tailscaled, I had to work through all of that again, updating my service files to look like the default one.

It seems like my solution is probably not the best one. Is there a way that a single tailscaled process could manage the two networks?

┆Issue is synchronized with this Asana task by Unito

[danderson]

This is something we plan to support (I've been calling it "personas" to distinguish it from the OAuth accounts and the local user accounts, both of which are also involved in some ways with tailscaled), and we also feel this pain right now (we use Tailscale at Tailscale Inc., but that makes it hard to set up a test network to try out something that'd break prod).

No timeline for when it'd happen yet, but - yes, we feel your pain, and we want to fix it :)

[danderson]

I should add: for now, your "run two tailscaled's" hack should work, albeit not perfectly - they'll be fighting over netfilter rules a little bit, but not in a harmful way right now. There's some upcoming network stack changes that I'd have to think through that might break stuff (basically, any time one tailscaled restarts the other will experience a short outage). We'll try to keep this working, even though it's not a configuration we want to support long-term.

[kylrth]

Yeah I've had some issues with it for sure. Keep me updated.

[tylerstillwater]

Adding my +1 here as well. I've just started using Tailscale, and I can see a need for at least 3 separate simultaneous logins.

[JayDoubleu]

@danderson Would this also fall under category of "enable multi account support" ? was meaning to create an issue for that.

[kylrth]

Does anyone have a semi-functioning hack for this? I had to remove my home network service entirely, because the very fact that I had two made both unstable, even if only one was running.

[JayDoubleu]

@kylrth multipass or running in docker might be a good workaround meanwhile. https://github.com/canonical/multipass

[kylrth]

My hack with systemd broke with a recent update, so I'm just using a single "persona" for now (using SOCKS proxy to a device with the other persona to access devices on that network). Thought I'd bump this issue.

[coffenbacher]

I'm sure you all know how important this one is, but to share a quick anecdote:

My company is working on a team project with two S&P 500 companies and Tailscale would be a perfect fit for parts. But we already use Tailscale, so we can't juggle our internal network with another one. I had to stop my evangelizing mid-sentence when I realized that blocker.