# Tailscale in a MintFlow profile MintFlow 2.0.0 includes experimental Tailscale support for connecting to your own tailnet and selecting an exit node. It requires an active MintFlow Pro entitlement: a qualifying Pro purchase, an active subscription, or an eligible active subscription trial. Your Tailscale account and its network permissions are separate from MintFlow Pro. ## Start with browser login Use this minimal profile to keep ordinary Internet traffic on Direct while routing tailnet IPv4 addresses through Tailscale: ```ini [misc] exclude-lan-networks=false [dns] app-routing-enabled=true direct-dns=1.1.1.1,8.8.8.8 [l3vpns] tailnet=type:tailscale,login-server:https://controlplane.tailscale.com,enabled:true [routing] CIDR,100.64.0.0/10,L3VPN,tailnet DEFAULT,DIRECT DNS-FALLBACK,DIRECT ``` 1. Create or edit a profile, then add a Tailscale VPN from Home's VPN controls, or use the profile text above. Keep **Rules Mode** enabled for this example. 2. Save the profile and start MintFlow VPN. An enabled route must reference Tailscale for this setup to start its provider; merely adding an unused VPN entry is not enough. 3. Open the Tailscale VPN's management screen and choose **Log In in Browser**. If the login URL is already ready, the button reads **Open Login Page**. 4. Complete login in the browser, including device approval if your tailnet requires it. Return to MintFlow and check its state. Waiting for machine approval requires action by your tailnet administrator. 5. Open **Tools → Tailscale** to inspect peers, routing preferences, exit nodes, and diagnostics. Test a service using its tailnet IPv4 address first. Keep the default route on Direct during initial browser login. Sending the browser through a Tailscale exit node before Tailscale is authenticated can prevent the login page from loading. You can change the route after login. ## Auth keys and profile secrets The management screen also offers **Use Auth Key** for one-time authentication. Browser login avoids placing a bootstrap secret in your saved profile. For automated initial enrollment, the Tailscale entry accepts `auth-key:tskey-auth-…`. Treat it as a secret: a key saved in profile text can be included in exports or iCloud profile sync. Use a suitable short-lived key and remove the bootstrap key after successful enrollment with **Clear Bootstrap Auth Key** in the identity controls. Removing a bootstrap key does not log out an already enrolled device. ## Choose what enters your tailnet MintFlow routes choose the traffic; Tailscale's accepted routes and exit-node preferences determine whether it can carry that traffic. For a subnet advertised by a tailnet router, enable **Accept Routes** in the Tailscale tools and add only the intended subnet to the profile, for example: ```ini [routing] CIDR,100.64.0.0/10,L3VPN,tailnet CIDR,192.168.40.0/24,L3VPN,tailnet DEFAULT,DIRECT ``` The subnet must also be advertised, approved, and allowed by your tailnet policy. Avoid excluding LAN networks when you intend overlapping private ranges to enter the tunnel. To send ordinary Internet traffic through an exit node, select an available **Exit Node** in **Tools → Tailscale**, then change the profile's default route to `DEFAULT,L3VPN,tailnet` and restart VPN. More-specific rules can still use Direct or another output. In Simple Mode, choose the Tailscale VPN as the output only after login and exit-node selection. Exit-node selection and Accept Routes can change live without restarting MintFlow. They are stored with the device's Tailscale state, not as exit-node fields in profile text. Changing profile routes still requires compilation and a VPN restart. ## Experimental limits For peer-name resolution, enable **Derive DNS records from tailnet** (`drive-dns:true`) on the Tailscale interface and use MintFlow DNS with App Routing enabled. MintFlow derives peer IPv4 records from the tailnet; this does not turn on Tailscale's OS MagicDNS resolver or import its full DNS configuration. DNS resolution and traffic routing are still separate: retain the routes for the IP addresses you want to reach. - One active Tailscale interface per profile; the current integration routes IPv4 traffic. - Do not assume complete parity with the official Tailscale client. Its OS-level MagicDNS resolver is not included; use the optional MintFlow-derived records above or tailnet IP addresses when checking connectivity. - Tailscale access controls, device approval, key expiry, and exit-node availability still apply. - Combining Tailscale with HTTP Engine or Flow Capture may produce experimental compilation warnings. Check diagnostics if a combined setup is unstable. - A simulator can demonstrate the configuration screens but cannot run the real packet tunnel or Tailscale connection. Test connectivity on an actual device. ## Try it during a Pro trial If the app offers you an eligible subscription trial, activate it and try a concrete task: reach a service on your tailnet, use an approved subnet route, or browse through your own exit node. Review the trial end date and renewal terms shown by the App Store. Tailscale is a Pro feature. When the trial or subscription ends without another active Pro entitlement, access becomes locked. On compilation, Tailscale is excluded and routes that targeted it become **REJECT**, so they do not silently fall back to Direct. Other routes and free features can remain usable. Check the compilation report and switch the affected output deliberately if you want a free configuration. Restoring an active Pro entitlement lets you use the feature again. Entitlement expiry is not a Tailscale logout and does not, by itself, erase the saved identity. Reauthentication may still be required by your tailnet. ## Why reinstalling may keep you logged in MintFlow stores Tailscale machine state in the **Apple Keychain**, outside its normal app sandbox files. State is associated with the stable profile UUID and login server. Deleting the app is therefore not a reliable way to log out of Tailscale. On the **same device**, reinstalling MintFlow and restoring the **same profile**, for example through enabled iCloud profile sync, may reconnect using the retained Keychain identity once Pro access is available. This is expected when that identity is still valid. Recreating similar profile text as a new profile may give it a different UUID and will not necessarily reuse the identity. Profile sync and identity storage are separate: the Keychain state is **device-only** and is not copied through iCloud profile sync. A second device needs its own login. Reinstall survival is not a backup guarantee; device erasure, missing Keychain state, explicit logout, or server-side revocation can require a new login. To disconnect the identity, use **Tools → Tailscale → Identity → Log Out**. **Forget Local Identity** is a recovery operation; it does not remove the old node from the Tailscale admin console. Remove or revoke that node there when appropriate. [Profile reference](../profile.md) · [Frequently asked questions](../faq.md)