Note: If you seek to enhance your privacy, you may also wish to consider a VPN proxy Qube.

Tailscale is a mesh private network that lets you easily manage access to private resources, quickly SSH into devices on your network, and work securely from anywhere in the world. If you have devices in your private home network or at work at which you cannot use a VPN, Tailscale is a simple alternative with minimal setup.

Template VM

In a t-tailscale template VM, install tailscale with the simple sh script, then stop the service:

curl -fsSL https://tailscale.com/install.sh | sh
systemctl stop tailscaled


In your tailscale AppVM, use your favorite editor to sudo edit ‘/rw/config/rc.local’, adding the following lines at the bottom of the file:

sudo systemctl start tailscaled
sudo tailscale up

Now make sure folder /rw/config/qubes-bind-dirs.d exists.

sudo mkdir -p /rw/config/qubes-bind-dirs.d

Create a file /rw/config/qubes-bind-dirs.d/50_user.conf with root rights. Edit the file 50_user.conf to append a folder or file name to the binds variable.

binds+=( '/var/lib/tailscale' )


Reboot the app qube.


From now on any files within the /var/lib/tailscale folder will persist across reboots. Shutdown and reboot the VM. Enter a console and run sudo tailscale up again to get the Tailscale tunnel link to your VM.

This document was migrated from the qubes-community project
  • Page archive
  • First commit: 18 Feb 2023. Last commit: 18 Feb 2023.
  • Applicable Qubes OS releases based on commit dates and supported releases: 4.1
  • Original author(s) (GitHub usernames): kennethrrosen
  • Original author(s) (forum usernames): @kenosen
  • Document license: CC BY 4.0

Followed community guide to install tail scale in template, and bind relevant directory/modify config of an app vm.

I assume that the chmod 777 needs to be applied to 50_user.conf and
“binds+=( ‘/var/lib/tailscale’ )” needs to be entered into the file body.

I have completed the steps. Rebooted and see that my app qube is listed in my tailscale devices. I also enabled a pfsense to advertise one network.

The pfsense tailscale IP however is not reachable from my appvm, I am unable to ping it or connect to services on that network from qubes.

Is the guide incomplete, what must be changed to successfully connect tailscale devices ?

1 Like

Moved your post to the corresponding topiic, so the discussion is easy to find for users

1 Like