Apple TV, now with more Tailscale

by mfiguiere • 3 years ago

478 149 3 years ago

FireBeyond• 3 years ago

I don't care either way, but I did note the ignorance of the elephant in the room as to why 99% of people would care about Tailscale and native VPN support on their Apple TV... and it's not "avoiding sketchy wifi networks".

fotta• 3 years ago

With a Tailscale exit node, you’re in control and you get the internet connection you’re used to. This new feature could come in handy if you’re traveling with your Apple TV and want to access the same geo-restricted channels you can see from home.

They do call this out towards the end.

cassianoleal2• 3 years ago

How's this supposed to work? If I'm travelling with my Apple TV and use it as an exit node, it's as geo-restricted as I am, wherever I am.

unstatusthequo2• 3 years ago

Because say I want to connect to my own private remote network. I have a server hosted in a datacenter because I self-host. I'd much rather have VPN capabilities than deal with a proxy server and publicly open ports with rules. This is a much tighter way to do things, IMHO.

LoganDark• 3 years ago

It's a way to access it remotely without having to forward a port to the whole world. There are other ways to do this, but a VPN is usually the most straightforward option.

It's also a way to proxy your connections through a device at home, of course. Whether the Apple TV is the client or the exit node.

meowtimemania• 3 years ago

The main use case I see is sharing streaming services like youtube TV with family.

radicaldreamer• 3 years ago

You can already do that officially... but maybe not region-locked sports

zikduruqe• 3 years ago

I run my own DNS server at home, and have Tailscale installed on it also. I use this so when I am away from home, I can continue to use it via Tailscale and/or an exit node for full on VPN-like solution.

I can now, move Tailscale off that server, and put it on my Apple TV to use as my network for my DNS server when I am away from the house.

copperx3• 3 years ago

For sharing Netflix accounts?

fragmede4• 3 years ago

Arrr, it not be for Netflix.

unstatusthequo2• 3 years ago

This is great news! Not only does this make a remote Plex / Jellyfin media server easier to deal with, the Apple TV can be an exit node. Solid work, TailScale!

maxmcd• 3 years ago

I'm a little unfamiliar with how Plex routing works. Would this make it so that your plex connected media servers don't need to be publicly routabel and the Plex app will know to connect through the tailscale network?

Would you need to reconfigure plex to use the tailscale ip addresses and then the Apple TX Plex app will stream over that address?

aaomidi3• 3 years ago

Depends on how you’ve setup Plex, but you can give it custom access URLs. So you can expose both a public and a private endpoint. Or just a private endpoint, up to you really.

ecliptik2• 3 years ago

I wrote up a guide [1] on using Plex + Tailscale + HTTPS last year to setup Plex so you don't have to expose it through the Plex relays or setup port forwards for other devices on a Tailnet.

I would assume with this announcement, you can keep Plex private to your Tailnet and an AppleTV also on the Tailnet could use it without any port fowarding.

1. https://forums.plex.tv/t/remote-access-using-tailscale-magic...

Operyl4• 3 years ago

Using it as an always-on exit node is actually a pretty nifty feature, I hadn’t thought about that as a viable feature before now.

cube2222• 3 years ago

This is by the way kind of how remote access with apple home works.

The Apple TV serves as a local gateway relaying all the commands to your local IoT devices.

On a side note, tailscale is lovely. I have nothing but good things to say about them.

Operyl4• 3 years ago

Yup, either a HomePod, Apple TV, or iPad left at home can act as a HomeKit hub.

ignoramous2• 3 years ago

This is by the way kind of how remote access with apple home works.

Apple killed Back to My Mac, which sounded a lot like Tailscale exit nodes: https://datatracker.ietf.org/doc/html/rfc6281

judge2020• 3 years ago

Finally, the new Tailscale client allows an Apple TV to be an exit node itself for other machines in your tailnet.

Pretty huge. Many non-techy users don't like the idea of keeping a computer on 24/7, but a smart TV is just fine.

Also, the Apple TV 4k only draws 0.5 watts at idle and less than 3 watts when streaming movies[0], so I imagine it pulls less than 1 just tunnelling traffic. Computers pull 15W+ at idle, and that's with low end components.

0: https://www.apple.com/environment/pdf/products/appletv/Apple...

aaomidi3• 3 years ago

I had not convinced the use case of using this as an exit node. Fuck this simplified so much.

copperx3• 3 years ago

Tailscale also runs on Android TV. If you don't have an Apple TV and want a cheap device just to have an exit node, you can buy a $20 Android TV thingy.

jondwillis• 3 years ago

Neat, maybe I can sell my M1 mini server

8fingerlouie4• 3 years ago

Nah, you'll still need that to synchronize iCloud content locally so that you can make backups of it, as Apple stubbornly refuses to allow TimeMachine (or anything else) to actually backup stuff that is only stored in iCloud, and provies no easy, scriptable way, of doing so otherwise.

It may just be a problem for me, but as i have ~3TB of photos in iCloud (2 x 2TB), and unless i want to buy laptops with 2TB storage, there is no practical way of backing up the contents of iCloud, so i use a Mac Mini M1 with an external drive, syncrhonize data locally, and then back it up from there.

lnxg33k1• 3 years ago

So far I’ve used it to get vpn on apple tv and i dont think i am going to change, also considering how apple leaks vpns like there’s no tomorrow https://www.amazon.nl/GL-iNet-GL-MT300N-V2-Reiserouter-Repea...

close042• 3 years ago

Can second the recommendation for the Mango travel router. I always prefer to take the VPN out of the “hands” of the client device to avoid any leaks. With 2 such devices connected via Wireguard VPN any other device I connect to that client router’s WiFi is safely communicating through that VPN. A sort of site to site VPN that works for devices that could never otherwise use a VPN client.

But of course this is a different use case and not always an option. Not if you want to use Tailscale. Probably unless that Apple TV is already connected to one of this “VPN WiFi” with Tailscale on top (no idea what the functionality or performance impact is).

telotortium• 3 years ago

US Amazon link: https://www.amazon.com/GL-iNET-GL-MT300N-V2-Repeater-300Mbps...

MuffinFlavored• 3 years ago

Many non-techy users

Why would a non-techy user want to volunteer to be an exit node?

fragmede4• 3 years ago

This isn't Tor, being an exit node just means the non-techy user can access Netflix while travelling internationally.

Operyl4• 3 years ago

It’s not a public Tor exit node. It’s a personal node you can use to route your own traffic.

giobox2• 3 years ago

I have setup Pis in family member homes to allow me to get residential IP VPN exit node in their respective countries - cheap and easy way to get access to foreign TV streaming services without a monthly fee. I used to run my own exit nodes in AWS/DigitalOcean in those regions, but virtually all streaming services block VPS/cloud service IPs at this point. Having an exit node in an actual "real" residential internet service is vastly more flexible.

This potentially would be even easier for me, given they all have Apple TVs already. This isn't a public exit node - it's only available to other users (i.e. people you know and have granted access to) of your own TailScale setup.

Same for non-techy folks who have second homes in foreign countries, or even just travel a lot - an Apple TV running this new app back in their main property will allow them for free to browse the web as if they are actually at their main property, including any TV services they enjoy.

KoftaBob2• 3 years ago

So that when they're overseas, they can route their internet traffic through their Apple TV at home in the US, and any streaming service they use will think they're in the US and not give them trouble about "Hulu isn't available in your location".

tiffanyh• 3 years ago

How will this work?

My Apple TV constantly goes to sleep.

Is Tailscale doing some type of “busy wait” to prevent tvOS from going to sleep?

crazygringo• 3 years ago

You can change your Apple TV settings to not to go to sleep.

lathiat• 3 years ago

It’s not truly asleep. The display parts are but it’s always connected to wifi to act as a home hub, receive airplay requests, etc.

nickvanw• 3 years ago

This is useful - using an exit node with an Apple TV is useful as well for navigating around certain tools that are geo-blocked. Before, you'd have to handle it outside of the device which is much more difficult.

I'm going to play around with this later in the week.

aaomidi3• 3 years ago

I’ve been working on bringing tailscale into container networking through a driver, it’s still a work in progress but people might already be interested in trying it out:

https://github.com/aaomidi/ContainerScale

nirav724• 3 years ago

Thanks for sharing this. I'm thinking this might be useful to run on a VPS and tie to a reverse proxy container. So I could expose services externally without opening up port on my wan side.

drexlspivey• 3 years ago

The bigger news is that you can add VPNs on Apple TV with tvOS 17, I had to run it on my router before

fmajid2• 3 years ago

Still better to run it on your router. Apple’s had VPN leaks, and also exempted its own services from VPN or Little Snitch firewalling. Separation of roles means not having to trust Apple.

ignoramous2• 3 years ago

Wait until Apple bundles in 5G eSIMs for connectivity for just Apple apps to bypass the physical firewalls.

Mandatum• 3 years ago

I live reading copy that’s obviously written by nerds. This is the least corporate announcement I’ve seen from a corporation in a long time.

No mention of how much they live trust and privacy or how they’re going to make your experience more delightful.

ant6n3• 3 years ago

Yeah, sounds like a bunch of tech gobbledigook. I guess it’s written for the users of these services, and they know what all this jargon means.

cstrahan2• 3 years ago

Tailscale is a company that provides a VPN (“Virtual Private Network”) service. If you don’t find yourself thinking “man, I really wish this one computer over here could share the same network with that computer over there, despite not being on the same WiFi access point or physical Ethernet network”, then their service (and the news regarding it) aren’t for you.

Why would someone want a VPN? There are a bunch, but here are some examples:

1) You want to connect to one of your machines at home while you’re at a coffee shop, or on vacation. Maybe so you can check security cameras, I dunno.

2) You’re on vacation outside of your home country, and you would like to watch a video stream that is blocked in the country you’re vacationing in. I experienced this in the Bahamas — If I recall, I was wanting to watch a UFC fight, but the UFC app refused to stream to the Bahamas (it was this and/or other Disney/Hulu whatever services refusing to play in the Bahamas). By routing traffic through your ISP back home: problem solved. (This what “exit node” is referring to — a computer through which internet traffic flows on your behalf)

3) You want to play a game with a friend that only supports multiplayer play on the same network, but your friend isn’t physically there with you in the same house. So just put the two of you on the same virtual network and now you can play together.

mlfreeman• 3 years ago

Will this work with Headscale too?

angott3• 3 years ago

Tailscale dev here: yes, you can set up a custom coordination server in the settings, just like on the iOS app. Open the tvOS Settings app, then scroll down to Tailscale.

hzia• 3 years ago

Thank you so much for that!! I wondered about this as well. Love how above and beyond you guys are going to support other OSS implementations <3

vineyardmike2• 3 years ago

Genuine question: Does tail scale want people using headscale?

I'm a free-tier personal user, and a little too cheap to give a for-profit corp money when I don't need to just because "I REALLY like the product". If I use headscale does that just cause a headache for the team, or is it good because it reduces traffic to prod?

I'm to cheap to pay when I don't need to, but its such a great product (esp for free) that I'd gladly change how I use the product to be less expensive or problematic.

xeonmc• 3 years ago

Is it possible to transparently embed Tailscale into a game to only talk to your self-hosted Headscale server?

Also, is it in theory possible to use WebRTC to negotiate Wireguard connections and not use any control plane?

dimgl• 3 years ago

Tailscale continues to be one of the more impressive services I've ever used. Going to install this on my Apple TV immediately. I often travel and use public Wi-Fi, so this is massively useful as my PC and my laptop are not always on (so I can't use them as an exit node). Pretty genius honestly.

b555• 3 years ago

can anyone share documentation/paper/video with eli5 of tailscale?

i recently read this with mulvad too and feel stupid that I don't intuitively understand how it works, and what it does and why it's needed.

duped• 3 years ago

You're on a team of 10 people with 20 different machines between you and want to securely send/receive files, spin up servers and talk to them, etc.

Tailscale makes this really easy, and fast.

angott3• 3 years ago

This blog post is a very good technical read (and the diagrams are really cool too): https://tailscale.com/blog/how-tailscale-works/

SparkyMcUnicorn• 3 years ago

Tailscale is basically wireguard in a seamless UX wrapper, and a bunch of nice (optional) things added on top like ACLs/2FA/MagicDNS/ssh.

https://tailscale.com/blog/how-tailscale-works/

simonw• 3 years ago

It's WireGuard with a really nice UI.

WireGuard is an outstanding mechanism for building secure virtual private networks.

You can run WireGuard on a bunch of different machines (or virtual machines) spread all over the world and give them the ability to talk to each other as if they were on the same LAN, with every packet fully encrypted.

TailScale has productized this. They wrote software for a bunch of platforms that makes it trivial to connect those machines to your "tailnet" - effectively a WireGuard network which their software manages for you.

They tie this to SSO - so you can install their software on your phone and your home server, sign them both in using Google SSO or similar, and now they're able to talk to each other on a secure virtual network.

I suggest trying the TailScale setup process to really understand how good it is.

hot_gril3• 3 years ago

So it's a VPN, right?

Larrikin2• 3 years ago

You have a home server, could be home assistant, a Raspberry Pi, your desktop computer. Access that server and all services on your phone or laptop from anywhere without figuring out ports and worrying about your server being pwned. It all looks like local traffic.

Set the DNS server on your phone to a Pi running AdGuard Home and block all ads and trackers when on 5G, not just in the browser.

Travel abroad with your laptop and designate your computer at home as an exit node and now all the traffic on your laptop looks like it is coming from that country.

Those are just the use cases I am using personally.

ecliptik2• 3 years ago

It's a 90s LAN, but with encryption and accessible from anywhere.

rhinoceraptor• 3 years ago

It connects all of your computers and devices in a way that feels magical. For example, if I have a Plex server named myplex on port 80 at home, and if I want to access it from my laptop, I just go to http://myplex.

It doesn't matter if I'm at home or anywhere else, if I have internet then that just works. I don't have to open a port on my router, configure DNS, or anything like that, I just install and run Tailscale.

sohrob• 3 years ago

Awesome news and boosts the utility of the Apple TV tremendously.

syntaxing2• 3 years ago

Is it possible to run a plex or jellyfin server on an Apple TV like a Nvidia Shield? If so, I might seriously consider getting an Apple TV just to run as a media server.

billyhoffman• 3 years ago

Sadly an Apple TV can't also be the media server (at least for something like Plex). But just about anything else can run media server, and you can go really low end especially if you don't need it to transcode your media. Some software like Infuse will stream the original media file to the Apple TV, and the transcoding happens on device.

syntaxing2• 3 years ago

I more or less have running every through a N100 and it has been great. Would have been awesome to replace it with an Apple TV though

tshaddox2• 3 years ago

True, but of course if you already have a media server, it can almost certainly already act as a Tailscale exit node.

zakki• 3 years ago

I wish there is Tailscale for LG TV.

ilteris• 3 years ago

Never heard of tailscale before. Is it similar to Plex?

nerdbert• 3 years ago

Nope, it's a tool for building a private network among machines which can be geographically and internetically distributed. So, more or less a VPN, but not particularly in the sense that people use it today (which is effectively a glorified proxy server).

tacticalturtle• 3 years ago

Switching from WebOS on my LG TV to the Apple TV as the primary interface was honestly one of the best consumer decisions I’ve made this year.

LG TVs get slower and more ad- laden with each update.

miki123211• 3 years ago

With up to three users available on our Free plan, you’ve got tools to make a media drive available to other trusted people in your life. You can share a collection of family photos and home videos into a faraway relative’s tailnet, without worrying about locking down the server for public internet access.

It's important to point out here that, in addition to this, the free plan also lets you send invite links to specific devices, which other people can add on their own accounts. That way, nobody has to go for the (quite expensive and obviously company-focused) free plan, you can share your device with as many friends as you like, and you're not sharing anything else beyond that single device.

jedberg• 3 years ago

But even if you don’t have a media server to connect to, you can use Tailscale’s Apple TV app to select another device in your tailnet ... to use as an exit node. This will route all your Apple TV’s traffic through that connection ... making your traffic appear to originate from the machine of your choice.

Oh look all of those family Netflix devices are in one home again!

klinquist• 3 years ago

This makes it much easier to use the Xfinity Stream app on your "travel appletv" :)

Spooky23• 3 years ago

Can you use this to appear to be in another place for blackout avoidance purposes?

ShakataGaNai• 3 years ago

This is very cool, and very useful.

For the average, non-technical user, Apple TV as an exit node for other device while traveling is super cool.

But for someone who is out of the country for a duration, it's also super handy. Netflix knows all the popular VPN providers and ban hammers them on a regular basis. But being able to use my Apple TV to watch my normal Netflix (or whomever) from any other country... because they think I'm at home? Super win.

fragmede4• 3 years ago

Network engineers watching rtt/packet latency very closely can still tell that something fishy is up, but Netflix doesn't really want to block VPNs, they just have to pretend to care enough so that the labels don't pull their content.

lstamour• 3 years ago

If one forwards traffic through iCloud+ proxy to mask IP address, I wonder if it’s still possible to tell a VPN, from, say, a perfectly legitimate SpaceX satellite signal received on a boat… ;-)

Timber-6539• 3 years ago

I wish they would work on their Android client.

Its got a long standing request to add split tunnelling [0] (a standard feature on pretty much every VPN client you'll come across). But it seems in the spirit of re-inventing existing networking technologies, Tailscale also decided to re-invent what a VPN client does.

This alone makes me give this otherwise wonderful project a pass despite all the deservingly good press it gets.

[0] https://github.com/tailscale/tailscale/issues/6912

lxgr3• 3 years ago

That's amazing!

I've already been using it in a very similar way on a Chromecast (the one running Android TV), which made me use my Apple TV less and less, to the point where I actually unplugged it. This might just be its ticket back to an HDMI port :)

nirav724• 3 years ago

whoa. I'm going to try installing tailscale on the googletv chromecast dongle. Because one of the biggest issues with Chromecast was that it and the device casting from had to be on the same wireless LAN. So when traveling I had to either use a travel router or turn my phone/tablet into an AP. Tailscale might solve that. I already use tailscale for everything else. Just never thought about installing it on Googletv chromecast. Thanks for the suggestion.

lxgr3• 3 years ago

You still won't be able to actually cast to a Chromecast device unfortunately, since that requires mDNS to work, which only works in the same broadcast domain (i.e. you'd need an L2 VPN, but Tailscale is L3).

nose-wuzzy-pad2• 3 years ago

I’ve installed this on a freshly updated AppleTV 4K with Ethernet and for the life of me I can’t get it to work using the Apple TV as an exit node. I’ve enabled it and approved it in the console.

Unfortunately I can’t ping any hosts through it or make any connections. This is in contrast to my other exit node, which is a docker container running tailscaled with user networking. It continues to work just fine.

Any ideas?

Thanks.

pomatic• 3 years ago

Are your clients set to use the AppleTV as a gateway? That's a fundamental requirement to ensure the packets your devices send in reply get passed back to the tailscale network.

nose-wuzzy-pad2• 3 years ago

Yes, the clients I've attempted this with so far (iPhone running tailscale) I have configured to use the Apple TV as an exit node. When I do so, there is no internet connectivity. When I switch it to another exit node I have in my tailnet it works flawlessly.

dangoodmanUT• 3 years ago

LOVE THIS

garyclarke27• 3 years ago

That's great tvOS now allows VPN - hopefully NordVPN will now release on Apple TV App Store. NordVPN runs great on Amazon Firestick - works for BBC Iplayer and ITVX when you're outside UK.

Stem0037• 3 years ago

Cool! it sounds like a pivotal upgrade, offering both convenience and enhanced security features. I love using Apple TV as the router in my home, when paired with Headscale, it's simply perfect.

idoescompooters• 3 years ago

This is pretty awesome, but only makes sense if you've already got an AppleTV. The price difference between the Apple TV and a Raspberry Pi is definitely non-negligible. Also, you probably want the Apple TV with ethernet which is extra $$.

Personally, I don't care about TV so I won't be using one anyway.

https://kimbroughski.medium.com/how-to-use-a-tailscale-vpn-t...

Apple TV, now with more Tailscale

Related Stories