Mattboxx Edition
ESP32 Tailnet Gateway
One ESP32. Multiple Tailnet roles. Enable only what you need.
Let an ordinary LAN device use one specific service on your Tailscale or Headscale tailnet — without installing a client on it, moving it to another network or changing your router.
Runs on ESP32-S3 N8R8 and N16R8 (8 MB octal PSRAM, at least 8 MB flash): ESP32-S3-DevKitC-1, ESP32-S3-WROOM-1/1U, Freenove ESP32-S3-WROOM, Seeed XIAO ESP32S3. Supported boards
Is it for you?
If one of these sounds like your network, the gateway can do it today — every feature is a switch, off until you need it.
A device can't run Tailscale
A printer, a PLC, an old PC or a home-automation box must reach one service at another site. Publish one rule; nothing changes on the device or the router.
Service Gateway“What happened while I was away?” 3.0
The gateway keeps an event history across restarts: power losses, crashes, Wi-Fi and tailnet drops, updates, failed logins.
See itYou want trends, not a snapshot 3.0
A chart of memory, traffic, Wi-Fi signal, CPU and online peers: 6 hours in detail, about 45 days in summary, stored on the gateway.
See the chartAn update must not cost your setup 3.0
Up to three settings copies on the gateway, taken by hand or automatically before every update, restored in one step.
UpdatingLocal devices should find nas by name 3.0
Tailnet names for devices on the gateway's Wi-Fi or your home LAN: they reach peers as nas or nas.your-tailnet.ts.net, no client needed.
Alerts on your phone or inbox 3.0
Telegram and email (TLS or STARTTLS, verified certificates) next to ntfy, MQTT/Home Assistant and SNMP for your monitoring.
AutomationIs the link fast enough? 3.0
A throughput test on request: the gateway downloads from your NAS or the internet, or your browser downloads from the gateway.
All new featuresA NAS or PC must wake up remotely
A separately powered tailnet node sends Wake-on-LAN and checks that the service really answers.
Remote recoveryAlready running 2.x?
Move to 3.0 keeping every setting: over the network with the 2.1.0 bridge, or once over USB.
How to moveTailscale on ESP32-S3, without an additional always-on Linux gateway. This open-source ESP32 Tailscale gateway connects compatible IoT and homelab devices to selected remote services. Use it as a Headscale-compatible gateway, a subnet router, or a separately powered Wake-on-LAN node for a NAS or PC.
Firmware v3.0.2 is available for ESP32-S3 N8R8 and N16R8 boards, with the guided first start, the LAN address and the per-board .local name shown after setup. What's new · Install the current firmware.
New in Firmware 3.0.2
Reliable settings saves: every settings page now saves all or nothing — a failed write or a power cut in the middle keeps none of that change, and live changes apply only after the whole save succeeded. Existing 3.x settings are kept.
Firmware 3.0.1 added optional Dynamic DNS with DuckDNS, Cloudflare or a custom HTTPS URL; six languages including French and German; translated Wi-Fi / Ethernet / cellular setup; faster cached pages and clearer Telegram/email controls.
See what's changed · Explore all features. Ethernet and cellular remain experimental and require additional hardware.
The problem it solves
A home-automation controller, a printer dashboard or an old PC needs to reach one service at another site — an MQTT broker, a NAS web UI, an SSH host. It cannot run Tailscale, and you do not want to advertise whole subnets or replace the router. Put an ESP32-S3 on the same LAN and publish one rule: this device may use this Tailnet service on this port.
One firmware, multiple roles
Service Gateway primary
LAN → one TCP or UDP service on a Tailnet peer, with source restriction, expiry, destination test and Service watch.
Service GatewaySubnet router
Reach your LAN and the ESP32's own AP subnet from tailnet clients, with optional source NAT and 4via6.
Network modesIoT AP gateway
Give low-bandwidth devices their own WiFi with DHCP, DNS, NAT and firewall chains, optionally through an exit node.
Network modesRemote recovery
A separately powered tailnet node that can wake your NAS and report bounded, honest evidence.
Remote recoveryAutomation
MQTT with Home Assistant Discovery, ntfy and read-only SNMP. All optional, none required for routing.
AutomationDiagnostics
Evidence per layer — control, path, rule, handshake, traffic — never a green light it cannot justify.
All featuresSee the actual firmware interface
No companion app is required. Use the built-in Web UI to choose a role, create service rules or start a recovery workflow. See screenshots of the Firmware 3.0 interface, rendered with example data.
Start with what you want to do
Connect a device without Tailscale, reach your home network, or wake a sleeping server. Enable only the roles you need.
Connect two homes without a VPN client on every device
A supported low-bandwidth TCP/UDP service can be reached through the ESP32's LAN address. For example, point a remote-site MQTT device at the gateway to reach your home broker.
Honest limits
This is a microcontroller running userspace WireGuard on one shared 2.4 GHz radio. It suits control traffic, telemetry, dashboards and SSH, not video or bulk transfers. It is community firmware, not an official Tailscale client. Read the FAQ and the security model before deploying it.