Prerequisites

Before proceeding, ensure you have a Tailscale account. You will need to generate a reusable Auth Key from the Tailscale admin console to facilitate the automated node setup.

LXC Container Preparation

Deploy a Debian LXC template in Proxmox. Before starting the container, you must grant it access to the TUN device to allow Tailscale to establish network tunnels.

Edit the container configuration file (located at /etc/pve/lxc/<container-id>.conf on the Proxmox host) and add these lines:

lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file

Enabling IP Forwarding

Inside the container, you must enable packet forwarding to allow the node to act as a subnet router. Modify /etc/sysctl.conf:

net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1

Apply these changes using sysctl -p.

Installing Tailscale and Optimizing Network

Install the Tailscale daemon via the official install script and include necessary network utilities:

curl -fsSL https://tailscale.com/install.sh | sh
apt install ethtool iproute2 -y

To improve performance, enable UDP GRO forwarding. Create a systemd service file /etc/systemd/system/ts-net-opt.service to ensure this persists across reboots:

[Unit]
Description=Enable UDP GRO forwarding
After=network.target

[Service]
Type=oneshot
ExecStart=/usr/sbin/ethtool -K eth0 rx-udp-gro-forwarding on

[Install]
WantedBy=multi-user.target

Configuring the Site-to-Site Tunnel

Create a dedicated systemd service to initialize the Tailscale subnet router. This avoids common issues with non-interactive initialization.

[Unit]
Description=Tailscale Site-to-Site Bridge
After=network-online.target

[Service]
Type=oneshot
ExecStart=/usr/bin/tailscale up --authkey=<YOUR_AUTH_KEY> --advertise-routes=192.168.x.0/24 --accept-routes --snat-subnet-routes=false --hostname=site-name
ExecStop=/usr/bin/tailscale down
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

Traffic Management

To prevent MSS (Maximum Segment Size) issues across the VPN tunnel, implement an iptables rule to clamp MSS values:

iptables -t mangle -A FORWARD -i tailscale0 -o eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

Ensure your internal network traffic is correctly routed by setting static routes toward your local gateway via the container's primary interface.

Finalizing the Connection

Once both sites are active, log in to the Tailscale admin web interface:

1. Navigate to the Machines tab.
2. Locate your nodes and click the three-dot menu.
3. Select Edit route settings.
4. Enable the subnets advertised by both sites to permit cross-site communication.