Expose IBM Cloud Private DNS zones to Tailscale connected devices

Overview

Use the Tailscale Subnet Router feature along with IBM Cloud Custom Resolver to expose IBM Cloud Private DNS zones to Tailscale connected devices.

Diagram

Here is a hgh level overview of the solution:

Here is a closer look at the docker host that will run our sample services and expose them via Traefik:

Pre-reqs

• IBM Cloud API Key
• Tailscale API Key
• Tailscale Organization. This is the name of your Tailnet Organization not your Tailnet DNS name.
• Terraform installed locally

Getting started

Clone repository and configure terraform variables

The first step is to clone the repository and configure the terraform variables.

git clone https://github.com/cloud-design-dev/ibmcloud-ts-router-pdns.git
cd ibmcloud-vpc-ts-router

Copy the example terraform variables file and update the values with your own.

cp tfvars-template terraform.tfvars

Variables

Name	Description	Type	Default	Required
allowed_ssh_ip	The IP address or CIDR block to allow SSH access from in to our Tailscale router instance.	string	"0.0.0.0/0"	no
existing_resource_group	The IBM Cloud resource group to assign to the provisioned resources.	string	n/a	yes
existing_ssh_key	The name of an existing SSH key to use for provisioning resources. If one is not provided, a new key will be generated.	string	""	no
ibmcloud_api_key	The IBM Cloud API key to use for provisioning resources	string	n/a	yes
ibmcloud_region	The IBM Cloud region to use for provisioning VPCs and other resources.	string	n/a	yes
private_dns_zone	Name of the private DNS zone to create for the VPCs	string	"internal.lab"	no
project_prefix	The prefix to use for naming resources. If none is provided, a random string will be generated.	string	""	no
tailscale_api_key	The Tailscale API key	string	n/a	yes
tailscale_organization	The Tailscale Organization name for your Tailnet	string	n/a	yes

Initialize, Plan and Apply the Terraform configuration

Once you have the required variables set, you can initialize the terraform configuration and create a plan for the deployment.

terraform init
terraform plan -out=plan.out

If no errors are returned, you can apply the plan to create the VPCs, subnets, and compute instances.

terraform apply plan.out

When the provosion is complete, you should see the output of the plan, including the private IP addresses of the compute hosts, the advertised subnets, and our custom resolvers.

Apply complete! Resources: 38 added, 0 changed, 0 destroyed.

Outputs:

custom_resolver_ips = tolist([
  "10.250.0.5",
  "10.250.64.4",
])
lab_fqdns = [
  "whoami.ythd-internal.lab",
  "tools.ythd-internal.lab",
  "requests.ythd-internal.lab",
  "dashboard.ythd-internal.lab",
]
ts_router_subnet_cidr = "10.250.0.64/27"
workload_instance_ip = "10.250.0.4"
zone1_subnet_cidr = "10.250.0.0/26"
zone2_subnet_cidr = "10.250.64.0/26"

Approve the advertised subnets in the Tailscale admin console

By default the subnet router will not advertise any of the subnets until they are approved in the Tailscale admin console. From the admin console, navigate to the Machines tab and click the subnet router instance name. On the machine details page you should see the subnets that are available to be advertised.

Under Approved click Edit and select the subnets you want to advertise and click Save.

Connect to Tailscale and check connectivity

Once the subnets are approved, you can start the Tailscale app on your local machine and set the local DNS resolvers to the custom resolvers that were created in the VPC. You can find the IP addresses of the custom resolvers in the terraform output. If you happen to be using a Mac, you can set the custom resolvers in the Network settings or via the command line with the networksetup command:

networksetup -setdnsservers Ethernet 10.250.0.5 10.250.64.4

With the resolvers set, we can now start testing connectivity to our deployed services. Take one of the FQDNs from the terraform output and try to connect to it.

curl "http://$(terraform output --json | jq -r '.lab_fqdns.value[0]')"
Hostname: 307a35892c5c
IP: 127.0.0.1
IP: ::1
IP: 172.18.0.5
RemoteAddr: 172.18.0.2:49386
GET / HTTP/1.1
Host: whoami.ygdg-internal.lab
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
X-Forwarded-For: 10.250.0.4
X-Forwarded-Host: whoami.ygdg-internal.lab
X-Forwarded-Port: 80
X-Forwarded-Proto: http
X-Forwarded-Server: 71cfe6245938
X-Real-Ip: 10.250.0.4

Clean up

To remove the resources created by the terraform configuration, you can run the destroy command.

terraform destroy

Conclusion

In this example we have deployed a Tailscale subnet router in an IBM Cloud VPC to expose private DNS services to our Tailscale network. We also created custom resolvers in the private DNS zone that allow us to connect to our private services using the FQDNs we have defined in the private DNS zone from our local machine.