Tailscale on a UCG Fiber — Emmanuel Vuignier

I’m on vacation abroad, on hotel WiFi, and my homelab — NAS, Home Assistant, the whole VLAN stack — is reachable as if I were at my desk. All my traffic tunnels home through my own gateway: Swiss TV works, and I’m not exposed to whatever’s running on the hotel network. That’s Tailscale on my UCG Fiber.

Why the gateway

The UCG Fiber already does inter-VLAN routing, so it’s the natural subnet router: one node, one hop, no Tailscale agent on individual servers. If I ran it on a container instead, that container becoming unreachable would take the whole tailnet with it. The gateway doesn’t go down.

The install

Standard tailscale.com/install.sh works on UniFi OS, but firmware updates wipe it. The right package is SierraSoftworks/tailscale-unifi — it installs to /data/tailscale/, which survives both reboots and firmware updates.

Before tailscale up, check that /data/tailscale/tailscale-env has TAILSCALED_FLAGS="" and not --tun userspace-networking. Subnet routing needs TUN mode — userspace silently breaks it with no useful error.

tailscale up \
  --advertise-routes=<homelab-subnet>,<mgmt-subnet> \
  --advertise-exit-node \
  --snat-subnet-routes=false \
  --accept-routes=false \
  --hostname=ucg-fiber

--snat-subnet-routes=false preserves real client IPs — without it everything looks like it comes from the gateway. Then approve the routes in the admin console and disable key expiry.

DNS

Set the global tailnet nameserver to your internal resolver and enable Override local DNS. My resolver is AdGuard Home with split-horizon rewrites — so internal hostnames resolve correctly from anywhere, with ad-blocking included. No extra DNS config needed when roaming.

On mobile devices

One automation rule on each device: disconnect on the home SSID, connect everywhere else. The VPN is invisible at home and automatic when away.

The takeaway

The tailscale-unifi package is the only non-obvious part — without it, the next firmware update removes everything. Everything else is Tailscale being Tailscale: your home network and your home internet, wherever you are. The same instinct as hosting this site in Switzerland — own the infrastructure, keep control 🌍.