R
Railwayβ€’14mo ago
Dayblox

tailscale into private network

Hey, I'm trying to get a VPN connection into a railway private network and it seems to work because I can ping the tailscale exit node (inside the private network) but can't seem to ping any other service on the network via their railway private domain name. Has anyone fiddled with this? Could it be a dns issue?
103 Replies
Percy
Percyβ€’14mo ago
Project ID: be9e230a-dc4d-4a06-803b-8fed247ffba6
Dayblox
DaybloxOPβ€’14mo ago
be9e230a-dc4d-4a06-803b-8fed247ffba6 Is there a way to know the private ip address of a service?
Fragly
Fraglyβ€’14mo ago
There is a way to get the IP of a service from what I've seen but railway does not like it when you do that
Dayblox
DaybloxOPβ€’14mo ago
What would that be?
Fragly
Fraglyβ€’14mo ago
something to do with A records or something, the actual explanation of the method was deleted and like I said, railway does not like it when you do that so best not do that there's likely an alternative way to do whatever you want to do
Dayblox
DaybloxOPβ€’14mo ago
Hopefully there is
Brody
Brodyβ€’14mo ago
they are asking about how to get the IP address of an internal service, but still shouldn't do that because those are also dynamic and internal domains use AAAA records since they are ipv6 only but purely for testing purposes, you can find the ipv6 address of a service in one of the api responses in the browsers network requests
Dayblox
DaybloxOPβ€’14mo ago
My service is purely UDP so no luck doing that :/
Brody
Brodyβ€’14mo ago
whats that have to do with it lol?
Dayblox
DaybloxOPβ€’14mo ago
Browsers are http=TCP?
thomas
thomasβ€’14mo ago
The railway's internal network uses a private DNS server to resolve. I think what you are trying to do wouldn't work unless you proxied the request to a service inside the private network so that it can decide to an IPv6 IP provided by our internal server. You could try and grab that IP and use that with tailscale but that would break randomly when our platform load balances or any other reason we might change that. Why do you want to do this?
Dayblox
DaybloxOPβ€’14mo ago
In order to connect to a UDP server Since it's not possible directly as far as I know on railway
thomas
thomasβ€’14mo ago
Why not set up tail scale directly in the service that needs udp. That way you don't have to rely on our internal Network which I'm not entirely sure supports UDP anyways. The problem with UDP packets is the very limited header. As I understand it would be possible to reverse proxy a UDP server by running an external server that proxies via HTTP or creates a tunnel that would do the same. The latency added by that would be counter productive to the purpose of udp Can I ask what your use case is? I only have used udp for gaming server purposes. Web sockets won my heart for real time web applications awhile ago I don't think what you want is impossible and if we figure it out I can write a guide. I am just not sure even if we could get it to work if railway is the best solution for this.
Duchess
Duchessβ€’14mo ago
Thread has been flagged to Railway team by @thomas.
Dayblox
DaybloxOPβ€’14mo ago
I'm using a ready to use docker image for a game server that only handles UDP The docs say that private networks support UDP https://docs.railway.app/reference/private-networking#how-it-works Railway might not be the best solution for this I have to admit, I just wanted to find a way since I'm paying! And I'm sure others might try to figure it out at some point, and if we figure it out, a guide would help them! I'm looking into tailscale as a subnet router, which looks like it fits my use case https://tailscale.com/kb/1019/subnets/ Is there a way to have the railway private network subnet CIDR? Also, is udp public port gonna be a thing at some point? I see a feature request marked as planned 2 years ago https://feedback.railway.app/feature-requests/p/allow-non-http-port-forwarding
Brody
Brodyβ€’14mo ago
at some point? yes at some point Railway wants to allow you to expose whatever, however you would like, but right now we can only do 1 exposed http service or 1 exposed tcp service
Dayblox
DaybloxOPβ€’14mo ago
This would fix my issue, any idea when it is planned?
Brody
Brodyβ€’14mo ago
not anytime soon
thomas
thomasβ€’14mo ago
I might be wrong but under the hood it is. The issue is that is can't be static. So while you might be able to grab the internal IP from the way Brody descirbed, it might change at anytime. So the way I understand this, you would have a game server service. Which you would tunnel into with Tailscale. I have to repeat, why not just take our tailscale template and shove the code directly into the game server service? You could wrap it in a python script:
import os
import subprocess
import time

def main():
# Run game_server subprocess
subprocess.Popen(["game_server"], stdout=subprocess.PIPE, stderr=subprocess.PIPE)

# Run tailscaled subprocess
subprocess.Popen([
"./tailscaled", "--state=/var/lib/tailscale/tailscaled.state",
"--socket=/var/run/tailscale/tailscaled.sock",
"--tun=userspace-networking",
"--socks5-server=localhost:1055",
"--outbound-http-proxy-listen=localhost:1055"
], stdout=subprocess.PIPE, stderr=subprocess.PIPE)

# Loop for tailscale up command
while True:
result = subprocess.run([
"./tailscale", "up",
f"--authkey={os.environ.get('TAILSCALE_AUTHKEY')}",
f"--hostname={os.environ.get('TAILSCALE_HOSTNAME')}",
"--advertise-exit-node",
os.environ.get('TAILSCALE_ADDITIONAL_ARGS', "")
], stdout=subprocess.PIPE, stderr=subprocess.PIPE)

if result.returncode == 0:
break
else:
time.sleep(0.1)

# Sleep indefinitely
while True:
time.sleep(1)

if __name__ == "__main__":
main()
import os
import subprocess
import time

def main():
# Run game_server subprocess
subprocess.Popen(["game_server"], stdout=subprocess.PIPE, stderr=subprocess.PIPE)

# Run tailscaled subprocess
subprocess.Popen([
"./tailscaled", "--state=/var/lib/tailscale/tailscaled.state",
"--socket=/var/run/tailscale/tailscaled.sock",
"--tun=userspace-networking",
"--socks5-server=localhost:1055",
"--outbound-http-proxy-listen=localhost:1055"
], stdout=subprocess.PIPE, stderr=subprocess.PIPE)

# Loop for tailscale up command
while True:
result = subprocess.run([
"./tailscale", "up",
f"--authkey={os.environ.get('TAILSCALE_AUTHKEY')}",
f"--hostname={os.environ.get('TAILSCALE_HOSTNAME')}",
"--advertise-exit-node",
os.environ.get('TAILSCALE_ADDITIONAL_ARGS', "")
], stdout=subprocess.PIPE, stderr=subprocess.PIPE)

if result.returncode == 0:
break
else:
time.sleep(0.1)

# Sleep indefinitely
while True:
time.sleep(1)

if __name__ == "__main__":
main()
This also creates an exit node
thomas
thomasβ€’14mo ago
Please note I didn't test that I had chatGTP write that based on this project: https://github.com/Andrew-Bekhiet/railway_tailscale_vpn/blob/master/start.sh I didn't even read all the lines
GitHub
railway_tailscale_vpn/start.sh at master Β· Andrew-Bekhiet/railway_t...
Host personal VPN on Railway using Tailscale. Contribute to Andrew-Bekhiet/railway_tailscale_vpn development by creating an account on GitHub.
thomas
thomasβ€’14mo ago
I think this would work for you and if it doesn't I want it too now please keep me updated
Dayblox
DaybloxOPβ€’14mo ago
I'll test this out tomorrow, thanks for the idea
thomas
thomasβ€’14mo ago
No problem, I kinda want this to be possible for my own reasons you could use this to ssh into your own service
Brody
Brodyβ€’14mo ago
didn't copper do this exact same thing? https://railway.app/changelog/2023-10-13-railway-hacks-2023#railway-hacks-2023
Cooper hacked together a way to tunnel via the CLI from local dev into a Railway Private Network over encrypted WireGuard
though I'm pretty what he did would be geared towards dev purposes, like accessing a database that is only accessible over the private network
thomas
thomasβ€’14mo ago
It's not exactly the same but yes. and it is really cool but I haven't tried it yet
Brody
Brodyβ€’14mo ago
the real question is, would it ever make it to GA?
thomas
thomasβ€’14mo ago
I don't know what I can say or not say about that yet. I'm still learning the lines in the sand. When you put something in GA you are promising it will work
Brody
Brodyβ€’14mo ago
thats is true, it could be available as a branch and the curious people could build their own cli from that branch πŸ‘€
Dayblox
DaybloxOPβ€’14mo ago
I'm trying out twingate to try their dns management, but the lookup fails :/
No description
Brody
Brodyβ€’14mo ago
what dns resolver are you using
Dayblox
DaybloxOPβ€’14mo ago
It's using the internal one, at least it's supposed to
Brody
Brodyβ€’14mo ago
what is it
Dayblox
DaybloxOPβ€’14mo ago
The railway private network dns
Brody
Brodyβ€’14mo ago
yes, what is the address for it
Dayblox
DaybloxOPβ€’14mo ago
Idk, it's provided by the private network dhcp? Is there a fixed address for it?
Dayblox
DaybloxOPβ€’14mo ago
uh, can you guide me?
Brody
Brodyβ€’14mo ago
never used twingate before
Dayblox
DaybloxOPβ€’14mo ago
on what you linked
Brody
Brodyβ€’14mo ago
No description
Brody
Brodyβ€’14mo ago
thats the internal networks dns resolver
Dayblox
DaybloxOPβ€’14mo ago
Oh cool
Brody
Brodyβ€’14mo ago
thats why i was asking, if you dont know what resolver address you are using, how can you be sure you are using the right resolver address in the first place
Dayblox
DaybloxOPβ€’14mo ago
No description
Dayblox
DaybloxOPβ€’14mo ago
It's resolving
Brody
Brodyβ€’14mo ago
it should return a ipv6 address unless twingate is doing an ipv4 to ipv6 proxy
Dayblox
DaybloxOPβ€’14mo ago
Not sure, it might be
No description
Brody
Brodyβ€’14mo ago
ping it then
Dayblox
DaybloxOPβ€’14mo ago
It seems I cannot It might be because of my connector setup
Brody
Brodyβ€’14mo ago
have you tried thomas's code?
Dayblox
DaybloxOPβ€’14mo ago
Not yet Before I do I wanna exhaust the easier options Is there a way to start a dockerhub service with --sysctl net.ipv4.ping_group_range ?
Brody
Brodyβ€’14mo ago
the private network is ipv6 only
Dayblox
DaybloxOPβ€’14mo ago
True, still how can I pass --sysctl arg?
Brody
Brodyβ€’14mo ago
you cant thomas said it, and im going to say it again, i dont think railway is the best solution for this (game server)
Dayblox
DaybloxOPβ€’14mo ago
I know I know But I live for this kind of tinkering I assume "expensive" services like game servers are profitable for railway, so how is public udp not a thing?
thomas
thomasβ€’14mo ago
I mean I don't think we have many game servers because until recently we had one region would be very limiting. It's been a requested feature for a long time:
Dayblox
DaybloxOPβ€’14mo ago
That's fair
thomas
thomasβ€’14mo ago
Allow non-HTTP port forwarding | Feature Requests | Railway
I would like to run an app with a plain TCP or UDP port connection that isnβ€˜t http. Railway would give me a way to publicly access that port and connect to it
Dayblox
DaybloxOPβ€’14mo ago
But now that we have regions πŸ‘€
thomas
thomasβ€’14mo ago
but it's not easy to do, and we probaby would just re-do private netowrking while we are at it
Dayblox
DaybloxOPβ€’14mo ago
yep upvoted yesterday πŸ‘Ό
thomas
thomasβ€’14mo ago
that's the best way to tell us what to do, that's all I do a bunch of the time What server are you trying to run
thomas
thomasβ€’14mo ago
lol I wonder what one of our servers could do there
Dayblox
DaybloxOPβ€’14mo ago
Meaning performance-wise?
thomas
thomasβ€’14mo ago
at least that game is pretty latency resistant
Dayblox
DaybloxOPβ€’14mo ago
Yeah it's very well optimized
thomas
thomasβ€’14mo ago
Yeah, for me routing thur my tailscale VPN on railway addes about 50ms of latancy
Dayblox
DaybloxOPβ€’14mo ago
But that's just what triggered my little investigation
thomas
thomasβ€’14mo ago
I think in that game it should be fine Do you have a github repo
Dayblox
DaybloxOPβ€’14mo ago
So you embed tailscale with a script like the one you showed? for?
thomas
thomasβ€’14mo ago
It's just a template project for a tailscale exit node: https://railway.app/template/uIBpGp It's like a really cheap VPN
Dayblox
DaybloxOPβ€’14mo ago
Yeah but how do you test your latency? Oh exit node so all your traffic I see But you haven't managed to ping internal network
thomas
thomasβ€’14mo ago
Turn on using railway as my exit node: https://speed.cloudflare.com/ turn off exit node, same test
Internet Speed Test - Measure Network Performance | Cloudflare
Test your Internet connection. Check your network performance with our Internet speed test. Powered by Cloudflare's global edge network.
thomas
thomasβ€’14mo ago
No because your are not meant to be able to via UDP not saying you can't get it to work
Dayblox
DaybloxOPβ€’14mo ago
Have you managed via TCP? or even ICMP
thomas
thomasβ€’14mo ago
I think brody could if he wanted to but no
Dayblox
DaybloxOPβ€’14mo ago
I haven't even managed to ping services in the private network
Brody
Brodyβ€’14mo ago
being brutally honest, hosting games servers on railway doesnt really interest me
Dayblox
DaybloxOPβ€’14mo ago
It's just my use case, but Thomas' is to ssh for instance
thomas
thomasβ€’14mo ago
not everything has to interest you haha, no worrys man You just shared a way we leak the internal IP earlier
Dayblox
DaybloxOPβ€’14mo ago
Find your own use case πŸ˜†
thomas
thomasβ€’14mo ago
and I think you where right
Brody
Brodyβ€’14mo ago
i did?
thomas
thomasβ€’14mo ago
I think I mis read this
Brody
Brodyβ€’14mo ago
oh yeah thats harmless
thomas
thomasβ€’14mo ago
oh yeah, for sure not worried about it you would just break your code if you tried to use that for long
Brody
Brodyβ€’14mo ago
could a udp -> tcp -> udp proxy work?
Dayblox
DaybloxOPβ€’14mo ago
Probably, but I feel like I'm close to getting it working What's weird is I can nslookup, but the lookup from the controller fails no template?
Brody
Brodyβ€’14mo ago
nope πŸ™‚
thomas
thomasβ€’14mo ago
What is this?
Brody
Brodyβ€’14mo ago
a little app I made
Dayblox
DaybloxOPβ€’14mo ago
make a template!
Brody
Brodyβ€’14mo ago
why tho lol
Dayblox
DaybloxOPβ€’14mo ago
So people can ping their private networks
thomas
thomasβ€’14mo ago
It looks very official, nice job
Brody
Brodyβ€’14mo ago
people can do that from their services I did snag a nice subdomain
Dayblox
DaybloxOPβ€’14mo ago
People can probably remake every template lol
Brody
Brodyβ€’14mo ago
you weren't the first to try to port check or ping a service in a completely different private network don't worry
Dayblox
DaybloxOPβ€’14mo ago
haha
Brody
Brodyβ€’14mo ago
wouldn't be very private if you could do that though
Dayblox
DaybloxOPβ€’14mo ago
looked official as thomas said Ok options exhausted, I'll look into embedding tailscale in the service
Want results from more Discord servers?
Add your server