Tailscale on a UniFi gateway
Installing Tailscale on a Ubiquiti UniFi gateway as a subnet router and exit node — done on a UCG Fiber, works on any UniFi OS 2.x console. My whole home network in my pocket, wherever I am.
I’m on vacation abroad, on hotel WiFi, and my homelab — NAS, Home Assistant, the whole VLAN stack — is reachable as if I were at my desk. All my traffic tunnels home through my own gateway: Swiss TV works, and I’m not exposed to whatever’s running on the hotel network. That’s Tailscale running on my UniFi gateway — a UCG Fiber, though nothing below is specific to that box.
Why the gateway
The gateway already does inter-VLAN routing, so it’s the natural subnet router: one node, one hop, no Tailscale agent on individual servers. If I ran it on a container instead, that container becoming unreachable would take the whole tailnet with it. The gateway doesn’t go down.
The install
Standard tailscale.com/install.sh works on UniFi OS, but firmware updates wipe it. The right package is SierraSoftworks/tailscale-unifi — it installs to /data/tailscale/, which survives both reboots and firmware updates.
Before tailscale up, check that /data/tailscale/tailscale-env has TAILSCALED_FLAGS="" and not --tun userspace-networking. Subnet routing needs TUN mode — userspace silently breaks it with no useful error.
tailscale up \
--advertise-routes=<homelab-subnet>,<mgmt-subnet> \
--advertise-exit-node \
--snat-subnet-routes=false \
--accept-routes=false \
--hostname=ucg-fiber--snat-subnet-routes=false preserves real client IPs — without it everything looks like it comes from the gateway. Then approve the routes in the admin console and disable key expiry.
DNS
Set the global tailnet nameserver to your internal resolver and enable Override local DNS. Mine is a Technitium cluster with split-horizon zones — so internal hostnames resolve correctly from anywhere, with ad-blocking included. No extra DNS config needed when roaming.
On mobile devices
One automation rule on each device: disconnect on the home SSID, connect everywhere else. The VPN is invisible at home and automatic when away.
The takeaway
The tailscale-unifi package is the only non-obvious part — without it, the next firmware update removes everything. Everything else is Tailscale being Tailscale: your home network and your home internet, wherever you are. The same instinct as hosting this site in Switzerland — own the infrastructure, keep control 🌍.