Frequently asked questions
Can I run Tailscale on an ESP32?
This project runs a community Tailscale-compatible client on an ESP32-S3 with 8 MB octal PSRAM and at least 8 MB of flash (N8R8 or N16R8). It supports selected gateway and recovery jobs without a Linux server. It is not the official Tailscale client, does not support every ESP32 board, and does not promise all official-client features. See supported hardware and the security model.
Can I connect IoT devices that cannot install a VPN client?
Yes, for supported TCP/UDP services. A LAN device can connect to a specific ESP32 listen port, or a WiFi device can use the ESP32's IoT access point. These are different paths: choose the selective LAN-to-Tailnet gateway or AP gateway for your use case. Neither automatically relays multicast discovery between homes.
Is this an official Tailscale client?
No. It is community firmware built on the microlink stack, compatible with Tailscale and Headscale coordination servers. It is not affiliated with Tailscale Inc.
Does it work with Headscale?
Headscale is supported through a custom login server and pre-auth key. Compatibility depends on server version and policy features; follow the Headscale guide. HTTPS servers need a certificate from a public CA; self-signed certificates are not supported.
What is the difference between the Service Gateway and a subnet router?
The Service Gateway lets LAN devices reach one specific Tailnet service through the ESP32 (LAN → Tailnet). A subnet router lets tailnet clients reach LAN devices (Tailnet → LAN). You can use both.
How fast is it?
It is a microcontroller doing userspace WireGuard on a shared 2.4 GHz radio. Throughput depends on the radio, uplink, direct or DERP path and enabled services. Use it for control, telemetry, dashboards and SSH, not video or bulk transfers.
Does the LAN client need any software?
No. It connects to the ESP32's LAN address and listen port like any other server.
Is the source filter enough security?
It limits which addresses can use a rule, but an address is not an identity. Restrict rules to single devices, keep the peer's ACL tight and set an admin password.
Can it turn on my NAS?
It can send Wake-on-LAN if the NAS supports it and has standby power, then check a port. It cannot hard-reset a frozen machine or provide KVM/BIOS access.
Which boards are supported?
ESP32-S3 with 8 MB octal PSRAM and at least 8 MB of quad flash: N8R8 and N16R8 modules (N16R8 tested). Boards with 4 MB of flash, 2 MB PSRAM, octal flash or other ESP32 chips are not supported; see Hardware. W5500 Ethernet is experimental, in the same image and off until configured.
Does it send telemetry?
No. There are no usage reports or crash uploads. GitHub update checks happen only when you enable them or press a button.
Do I need MQTT or Home Assistant?
No. Every integration is optional; the Service Gateway, Web UI and manual Wake-on-LAN work without them.
Is tailnet lock supported?
Tailnet Lock is not supported. Do not assume that pre-authorizing a node adds the missing protocol support. See the documented compatibility boundaries.