Failure with Tailscale integration and DNS resolving

[kernelb00t]

With latest versions of HA, HAOS, HACS and this addon, in a Proxmox VE server, the Tailscale addon with user space networking disabled can't set itself as the DNS resolver for at least the tailnet's domain. It seems that Tailscale and network manager never talks between them from what I can see in /etc/resolv.conf within the Terminal & SSH addon. I can access HA through Tailscale but HA can't resolve any address of the tailnet. For example, I can't connect to the NUT server running on the Proxmox host via Tailscale, whereas on my computer I can contact and retrieve information from it.

Expected behaviour : When on HA Cli, after typing login, ping proxmox.my-tailnet.ts.net. The command has no errors. When in the Terminal addon, try to ping the same host. The command should work. When setting up an integration/addon, putting a Tailscale domain or IP address should cause no errors.

When I was in my logs, I saw that Tailscale couldn't rename the /etc/resolv.conf file to /etc/resolve.pre-tailscale.conf (or a name like that), due to the file system being RO. I was not able to make a screenshot/copy the logs.

[lmagyar]

See #310 TLDR: accessing with IPs work, DNS resolving needs some workaround :/

[bhovig]

Same problem. Workaround:

At the home assistant cli:

ha dns options --servers dns://100.100.100.100 ha dns restart

dns now resolves Tailscale ips when Tailscale addon is active.

[sinclairpaul]

Same problem. Workaround:

It's not a workaround, the container can't influence the base OS configuration. You can also set the DNS settings via the UI.

In my opinion this should be closed out, if you want to run Tailscale in a container this is a limitation of it.

[kernelb00t]

I don't think this should be closed. This project's goal is to integrate Tailscale in Home Assistant. If there is an obstacle, we should check every solutions we have. We're in a container, OK. But maybe we can call HA to change the DNS, via an API for example (I don't know anything, but maybe HA is exposing some "controls" for modifying system settings. If this API isn't there, an upstream issue can be opened.

MagicDNS is a key functionnality of Tailscale, so it cannot be abandoned. Better, no functionnality should ever be just "dropped" because it's not easily feasible.

Edit: We can update the DNS server by the supervisor API: https://developers.home-assistant.io/docs/api/supervisor/endpoints#dns

With just a configuration option to enable publishing the DNS server to HA configuration, periodic checks while running to ensure the DNS server isn't rewrited by another addon or user (we can trigger a warning in the logs to tell the user there's something wrong), and everything will be better AND the issue will be fixed!

[github-actions[bot]]

There hasn't been any activity on this issue recently, so we clean up some of the older and inactive issues. Please make sure to update to the latest version and check if that solves the issue. Let us know if that works for you by leaving a comment 👍 This issue has now been marked as stale and will be closed if no further activity occurs. Thanks!

[bjeanes]

I'm also experiencing this, bot

[bjeanes]

Same problem. Workaround:

At the home assistant cli:

ha dns options --servers dns://100.100.100.100 ha dns restart

dns now resolves Tailscale ips when Tailscale addon is active.

Apparently at the cost of resolving anything else, though.

[kernelb00t]

Same problem. Workaround:

At the home assistant cli:

ha dns options --servers dns://100.100.100.100 ha dns restart

dns now resolves Tailscale ips when Tailscale addon is active.

Apparently at the cost of resolving anything else, though.

It shouldn't, though. The tailscale DNS is the "first" DNS, so everything will try to be resolved using it. If you try to resolve a non-Tailscale domain, the MagicDNS will use the tailnet's default global DNS.

Tldr:

• HA's DNS will send all queries to Tailscale first
• If Tailscale domain, handle and return
• If non Tailscale domain, send to the configured global DNS
• If even the global DNS query fails, HA will try with its second DNS.

[lmagyar]

OK, somebody please explain to me what am I doing wrong, because ha dns options --servers dns://100.100.100.100 plus ha dns restart does absolutely nothing in my case.

I can ping the IPs, I can ping 100.100.100.100, but I can't use machine names in the SSH add-on's cli (I can use machine names within the TS continer, so TS DNS works). If I ping xxxx.tailxxxx.ts.net, I can ping only the funneled devices from/through the internet. So HA+TS DNS doesn't work. As I see HA doesn't even try to ask TS.

ha dns info:

fallback: true
host: 172.30.32.3
llmnr: true
locals:
- dns://1.1.1.1
mdns: true
servers:
- dns://100.100.100.100
update_available: false
version: 2024.04.0
version_latest: 2024.04.0

ha dns logs:

[INFO] 172.30.32.1:54205 - 26488 "A IN <tailnet device name here>.local.hass.io. udp 44 false 512" NXDOMAIN qr,aa,rd 44 0.001186974s

Even when I use the UI, still no TS names resolved:

IP Information
IPv4
IP Address: 192.168.1.8/24
Gateway: 192.168.1.1
Method: static
Name Servers: 100.100.100.100

UPDATE:

nslookup xxxxxxxx
;; Got recursion not available from 172.30.32.3
Server:         172.30.32.3
Address:        172.30.32.3#53

*** Can't find xxxxxxxx: No answer

[kernelb00t]

You have to put your connection in static (Settings>System>Network>Configure>IPv4>Static> Set DNS to 100.100.100.100). It's not very good, but since HA's CoreDNS is uncustomizable at all we can't really do anything better. Then, it should work good.

If not, reset your DNS config (ha dns reset), then redo this ↑ Check with nslookup that it tries to contact the right server.

[lmagyar]

Thanks for the reply, I've already tried those steps several times, it has never worked. I try to config TS DNS as default DNS for HA few times a year, maybe it will work once, currently it doesn't work on any of my configs. I clearly miss a step somewhere, but can't figure out what. I gave up again.

[shaver]

I'm stuck with this problem too. I've set 100.100.100.100, 8.8.8.8 as the static DNS server in Settings > System > etc., and I've run the ha dns commands listed above.

Now I can't resolve anything! After I ha dns restart, I get a timeout or connection refused when attempting to resolve anything (TS or otherwise), and ha dns status reports that Container hassio_dns is not running. I can sneak in one or two ha dns status commands before the container gets shut down, though. This persisted across a ha dns reset, sadly...

Edit: once I recovered my setup by rebooting, I tried again and while nslookup works to find tailnet names when pointed at the 100.100.100.100 server, default name resolution still doesn't.