Skip to content

MANUAL-SETUP.md

Latest commit

 

History

History
197 lines (163 loc) · 4.32 KB

MANUAL-SETUP.md

File metadata and controls

197 lines (163 loc) · 4.32 KB

Manual setup (easy, step-by-step)

This is the noob-friendly manual path if you do not want to use the wizard.

A) Install 9proxy

  • Download the Linux package from 9proxy.
  • Install it for your distro.
  • Confirm the CLI works:
9proxy -h

B) Install + log in to Tailscale

Debian/Ubuntu:

curl -fsSL https://tailscale.com/install.sh | sh
sudo systemctl enable --now tailscaled
sudo tailscale up

Arch/Manjaro:

sudo pacman -S tailscale
sudo systemctl enable --now tailscaled
sudo tailscale up

Get your tailnet IP:

tailscale ip -4

C) Log in to 9proxy

Open the login UI:

9proxy auth -s

Check login:

9proxy setting --display
# Look for: User Logged: true

D) Bind 9proxy to Tailscale IP (recommended)

9proxy setting --ip <tailscale-ip>

Bind a port and country (example US on 60000):

9proxy proxy -c US -p 60000
9proxy port --status

E) Share with friends (tailnet only)

  1. In Tailscale admin console, share your device to your friend.
  2. Friend logs in to Tailscale and accepts.
  3. Friend uses:
  • Host:
  • Port: 60000
  • Type: SOCKS5 (or HTTP)

F) Exit node + transparent proxy (optional, TCP only)

This makes your phone work without per-app proxy settings.

  1. Advertise exit node:
sudo tailscale up --advertise-exit-node

Then approve it in the admin console.

  1. Enable forwarding:
cat <<'EOF' | sudo tee /etc/sysctl.d/99-tailscale-exit-node.conf
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
EOF
sudo sysctl --system
  1. Install redsocks:
  • Debian/Ubuntu: sudo apt install redsocks
  • Arch/Manjaro: pamac build redsocks2
  1. Configure redsocks (example):
  • Debian/Ubuntu: /etc/redsocks.conf
  • Arch/Manjaro: /etc/redsocks2.conf
base {
  log_debug = off;
  log_info = on;
  log = "syslog:daemon";
  daemon = on;
  user = redsocks;
  group = redsocks;
  redirector = iptables;
}

redsocks {
  bind = "0.0.0.0:12345";
  relay = "<tailscale-ip>:60000";
  type = socks5;
  autoproxy = 0;
}

Start:

  • Debian/Ubuntu: sudo systemctl enable --now redsocks
  • Arch/Manjaro: sudo systemctl enable --now redsocks2
  1. Add iptables redirect: Create /usr/local/sbin/ts-9proxy-redirect.sh and systemd unit as shown in docs/SECURITY.md.

G) UDP/QUIC + DNS through proxy (recommended)

UDP TPROXY is required for DNS queries to go through the SOCKS5 proxy. Without this, dnsleaktest.com will show wrong DNS servers.

Add redudp to your redsocks config:

redudp {
  bind = "0.0.0.0:12346";
  relay = "<tailscale-ip>:60000";
  type = socks5;
  udp_timeout = 30;
  udp_timeout_stream = 180;
}

Then set up the TPROXY iptables rules. The wizard does this automatically:

tailscale-proxy enable-redirect  # includes UDP by default

Or to fix DNS leak on existing setup:

tailscale-proxy fix-dns-leak

H) No-leak strict mode (optional)

This is a "killswitch" that blocks any forwarding from tailscale0. It prevents leaks if the proxy goes offline, but it also blocks LAN access.

Use the script and systemd unit in docs/SECURITY.md, then enable it:

sudo systemctl enable --now ts-no-leak.service

I) Local SOCKS forwarder (desktop per-app)

Run a local SOCKS5 proxy that forwards to your tailnet proxy:

tailscale-proxy local-socks --listen 127.0.0.1:1080 --upstream <tailscale-ip>:60000

Run it in the background:

tailscale-proxy local-socks-on --listen 127.0.0.1:1080 --upstream <tailscale-ip>:60000

J) Port forwarding (TCP/UDP)

TCP forward example:

tailscale-proxy forward --tcp "0.0.0.0:8080=127.0.0.1:8080"

UDP forward example:

tailscale-proxy forward --udp "0.0.0.0:5353=<tailscale-ip>:5353"

K) HTTP proxy + PAC

tailscale-proxy http-proxy --listen 127.0.0.1:8080 --upstream <tailscale-ip>:60000
tailscale-proxy pac --listen 127.0.0.1:8080

L) Allowlist (tailnet IPs)

Restrict access to specific tailnet IPs:

tailscale-proxy allowlist-on --port 60000 --ip <tailnet-ip-1> --ip <tailnet-ip-2>

M) Share (QR + info)

tailscale-proxy share --port 60000

N) Profiles + Self-test

tailscale-proxy profile-list
tailscale-proxy profile-apply phone_stable
tailscale-proxy self-test

Undo

Disable the redirect services, remove the scripts, and stop redsocks. The wizard can do this for you.