Tailscale in a MintFlow profile

MintFlow 2.0.0 introduced experimental Tailscale support for connecting to your own tailnet and selecting an exit node. MintFlow 2.1.0 adds the exit-node-ip profile field for saving a preferred exit node.

Tailscale support requires an active MintFlow Pro entitlement: a qualifying Pro purchase, an active subscription, or an eligible active subscription trial. Your Tailscale account and its network permissions are separate from MintFlow Pro.

Start with browser login

Use this minimal profile to keep ordinary Internet traffic on Direct while routing tailnet IPv4 addresses through Tailscale:

[misc]
exclude-lan-networks=false

[dns]
app-routing-enabled=true
direct-dns=1.1.1.1,8.8.8.8

[l3vpns]
tailnet=type:tailscale,login-server:https://controlplane.tailscale.com,enabled:true

[routing]
CIDR,100.64.0.0/10,L3VPN,tailnet
DEFAULT,DIRECT
DNS-FALLBACK,DIRECT
  1. Create or edit a profile, then add a Tailscale VPN from Home's VPN controls, or use the profile text above. Keep Rules Mode enabled for this example.
  2. Save the profile and start MintFlow VPN. An enabled route must reference Tailscale for this setup to start its provider; merely adding an unused VPN entry is not enough.
  3. Open the Tailscale VPN's management screen and choose Log In in Browser. If the login URL is already ready, the button reads Open Login Page.
  4. Complete login in the browser, including device approval if your tailnet requires it. Return to MintFlow and check its state. Waiting for machine approval requires action by your tailnet administrator.
  5. Open Tools → Tailscale to inspect peers, routing preferences, exit nodes, and diagnostics. Test a service using its tailnet IPv4 address first.

In 2.1.0, an unenrolled interface can temporarily use Direct during fresh enrollment, explicit login, or pending approval. Check Tailscale status: that traffic is not yet passing through the tailnet. Keeping this example's default Direct also avoids depending on private tailnet DNS during login. See the Tailscale FAQ for cancellation, expiry, and logout behavior.

Auth keys and profile secrets

The management screen also offers Use Auth Key for one-time authentication. Browser login avoids placing a bootstrap secret in your saved profile.

For automated initial enrollment, the Tailscale entry accepts auth-key:tskey-auth-…. Treat it as a secret: a key saved in profile text can be included in exports or iCloud profile sync. Use a suitable short-lived key and remove the bootstrap key after successful enrollment with Clear Bootstrap Auth Key in the identity controls. Removing a bootstrap key does not log out an already enrolled device.

Choose what enters your tailnet

MintFlow routes choose the traffic; Tailscale's accepted routes and exit-node preferences determine whether it can carry that traffic.

For a subnet advertised by a tailnet router, enable Accept Routes in the Tailscale tools and add only the intended subnet to the profile, for example:

[routing]
CIDR,100.64.0.0/10,L3VPN,tailnet
CIDR,192.168.40.0/24,L3VPN,tailnet
DEFAULT,DIRECT

The subnet must also be advertised, approved, and allowed by your tailnet policy. Avoid excluding LAN networks when you intend overlapping private ranges to enter the tunnel.

In 2.1.0, save a preferred exit node in the profile editor with exit-node-ip, or use the live Exit Node control for this device. To carry ordinary Internet traffic, use DEFAULT,L3VPN,tailnet, or select the Tailscale output in Simple Mode. The node must advertise exit capability and be available to your identity.

exit-node-ip syncs with profile text and is reapplied on VPN restart and explicit login. A live override does not edit the profile; Use Profile Default restores it. Without a profile default, the live selection persists only on this device. Accept Routes remains a device-local live preference. Route edits require compilation and a VPN restart.

[l3vpns]
tailnet=type:tailscale,login-server:https://controlplane.tailscale.com,exit-node-ip:100.64.0.2,enabled:true

Experimental limits

For peer-name resolution, enable Derive DNS records from tailnet (drive-dns:true) on the Tailscale interface and use MintFlow DNS with App Routing enabled. MintFlow derives peer IPv4 records from the tailnet; this does not turn on Tailscale's OS MagicDNS resolver or import its full DNS configuration. DNS resolution and traffic routing are still separate: retain the routes for the IP addresses you want to reach.

  • One active Tailscale interface per profile; the current integration routes IPv4 traffic.
  • Do not assume complete parity with the official Tailscale client. Its OS-level MagicDNS resolver is not included; use the optional MintFlow-derived records above or tailnet IP addresses when checking connectivity.
  • Tailscale access controls, device approval, key expiry, and exit-node availability still apply.
  • Combining Tailscale with HTTP Engine or Flow Capture may produce experimental compilation warnings. Check diagnostics if a combined setup is unstable.
  • A simulator can demonstrate the configuration screens but cannot run the real packet tunnel or Tailscale connection. Test connectivity on an actual device.

Try it during a Pro trial

If the app offers you an eligible subscription trial, activate it and try a concrete task: reach a service on your tailnet, use an approved subnet route, or browse through your own exit node. Review the trial end date and renewal terms shown by the App Store.

Tailscale is a Pro feature. When the trial or subscription ends without another active Pro entitlement, access becomes locked. On compilation, Tailscale is excluded and routes that targeted it become REJECT, so they do not silently fall back to Direct. Other routes and free features can remain usable. Check the compilation report and switch the affected output deliberately if you want a free configuration.

Restoring an active Pro entitlement lets you use the feature again. Entitlement expiry is not a Tailscale logout and does not, by itself, erase the saved identity. Reauthentication may still be required by your tailnet.

Why reinstalling may keep you logged in

MintFlow stores Tailscale machine state in the Apple Keychain, outside its normal app sandbox files. State is associated with the stable profile UUID and login server. Deleting the app is therefore not a reliable way to log out of Tailscale.

On the same device, reinstalling MintFlow and restoring the same profile, for example through enabled iCloud profile sync, may reconnect using the retained Keychain identity once Pro access is available. This is expected when that identity is still valid. Recreating similar profile text as a new profile may give it a different UUID and will not necessarily reuse the identity.

Profile sync and identity storage are separate: the Keychain state is device-only and is not copied through iCloud profile sync. A second device needs its own login. Reinstall survival is not a backup guarantee; device erasure, missing Keychain state, explicit logout, or server-side revocation can require a new login.

To disconnect the identity, use Tools → Tailscale → Identity → Log Out. Forget Local Identity is a recovery operation; it does not remove the old node from the Tailscale admin console. Remove or revoke that node there when appropriate.

Profile reference · Frequently asked questions

Read this page as Markdown