Tailscale: Site-to-site VPN

Give PCs on a remote network (e.g. family or a second site) access to one subnet on your home network — for example a services VLAN running a reverse proxy — using the Tailscale add-on on a Home Assistant instance at each end as a subnet router. This works through double NAT and CGNAT, where UniFi's built-in site-to-site VPN often fails. No Tailscale is needed on the remote PCs.

0. Topology & values

Remote PC (REMOTE_LAN)
   → Remote gateway (static route)
   → Remote HA (Tailscale add-on)  ═══ tailnet ═══  Home HA (Tailscale add-on, on HOME_HA_VLAN)
   → Home gateway
   → SERVICE_HOST on HOME_SERVICES_LAN (reverse proxy :443 → app)

Fill these in before starting:

The two LAN subnets must not overlap.

What gets advertised:

Access is locked down in three layers: advertised routes (Tailscale), ACL policy (Tailscale), and the firewall on the home gateway.

1. Home HA — Tailscale add-on

1. Settings → Add-ons → Add-on Store → Tailscale → Install
2. Configuration tab → Edit in YAML (replace the placeholder with your subnet):

   advertise_routes:
     - HOME_SERVICES_LAN
   accept_routes: true
   snat_subnet_routes: false
   userspace_networking: false

3. Start, then open the add-on Web UI and log in to your Tailscale account.
4. Enable Start on boot and Watchdog.

userspace_networking: false is required — without it the add-on cannot route traffic for other devices.

snat_subnet_routes: false keeps real source IPs (true site-to-site); this is why the gateway static routes in step 4 are mandatory.

HA can advertise a subnet it isn't directly on (e.g. HA on HOME_HA_VLAN advertising HOME_SERVICES_LAN), as long as your gateway routes between them.

2. Remote HA — Tailscale add-on

Same install, with:

advertise_routes:
  - REMOTE_LAN
accept_routes: true
snat_subnet_routes: false
userspace_networking: false

Start, log in to the same tailnet, and enable Start on boot and Watchdog.

3. Tailscale admin console (login.tailscale.com)

3.1 Approve routes & disable expiry

For each HA machine on the Machines page:

• … → Edit route settings → tick the advertised subnet → Save
• … → Disable key expiry

3.2 ACL policy (Access controls)

Restrict the remote subnet to HTTPS on the service host only, while keeping your own devices unrestricted:

{
  "acls": [
    // Your own logged-in devices: unrestricted (prevents locking yourself out)
    { "action": "accept", "src": ["autogroup:member"], "dst": ["*:*"] },

    // Remote LAN → service host HTTPS only (reverse proxy)
    { "action": "accept", "src": ["REMOTE_LAN"], "dst": ["SERVICE_HOST:443"] }

    // Optional later — home services LAN → remote LAN (e.g. to manage remote HA):
    // { "action": "accept", "src": ["HOME_SERVICES_LAN"], "dst": ["REMOTE_LAN:*"] }
  ]
}

Tailscale ACLs are stateful, so replies are allowed automatically. Add more dst entries (other hosts or ports) only when needed.

If you already have a custom policy file, merge these rules into it rather than replacing it.

4. Static routes on each gateway

On UniFi: Settings → Routing → Static Routes → Create Entry (Type: Next Hop). Other routers have an equivalent static-route page.

Do not add HOME_HA_VLAN or any other home subnet on the remote side — only what's advertised.

5. Firewall on home gateway

Traffic from the remote site arrives with a REMOTE_LAN source address, entering via the HA VLAN. Create two policies (UniFi: Settings → Security → Firewall / Policy Engine), ordered allow-then-block:

Also confirm no existing rule blocks the HA VLAN → services VLAN path for this traffic.

On the remote gateway, the default routed LAN behaviour is usually fine; only add rules if its firewall blocks routed traffic to HOME_SERVICES_LAN.

6. DNS on the remote gateway

If your internal hostnames have no public DNS, add a local record on the remote gateway (UniFi: Settings → Policy Engine → DNS, or Settings → Routing → DNS depending on version):

If the reverse proxy uses a publicly trusted certificate (e.g. Let's Encrypt via DNS challenge), remote browsers won't show warnings.

7. Test

From either HA add-on (or the admin console):

tailscale status
tailscale ping <other-HA-tailscale-name>

Both nodes should show as online with a direct or DERP connection.

From a remote Windows PC (PowerShell):

nslookup SERVICE_FQDN
Test-NetConnection SERVICE_HOST -Port 443
tracert -d SERVICE_HOST

Expect: DNS returns SERVICE_HOST, TcpTestSucceeded : True, and the trace hops via REMOTE_HA_IP.

Confirm the lockdown (these should fail):

Test-NetConnection SERVICE_HOST -Port 22
Test-NetConnection <any host on HOME_HA_VLAN> -Port 443

Finally: browse to https://SERVICE_FQDN.

8. Troubleshooting

9. Rollback

1. Delete the two static routes (step 4).
2. Remove the firewall policies (step 5) and the DNS record (step 6).
3. In the admin console, disable the subnet routes or remove the machines.
4. Stop or uninstall the Tailscale add-on on each HA.