- Why one might do this
- Minimum requirements
- Install Raspberry Pi OS on the SD card using Raspberry Pi imager
- Install drivers for the second WiFi interface
- Configure the Pi as a WiFi access point
- Install Tailscale
- Use iptables to route traffic and normalize MTU
- Connect your Apple TV or other device
1. Why one might do this #
Shortly after I wrote a guide to using a Raspberry Pi with dual-WiFi as a WireGuard VPN for an Apple TV, I started experimenting with Tailscale. My WireGuard VPN solution worked well enough, but I wanted to replace my VPN provider with a homespun solution. Tailscale seemed like a great way to solve that problem, especially as I had access to multiple networks.
The setup isn’t very different from the VPN router, though RaspAP is a bit overkill for a Tailscale-based architecture. Instead, this guide will walk through installing only hostapd, which is one tool RaspAP uses under the hood, to turn the Raspberry Pi into a WiFi access point for the Apple TV, eventually routing all its traffic through Tailscale.
2. Minimum requirements #
- Raspberry Pi 4
- SD card for the Pi
- Power supply for the Pi
- Dual-band USB WiFi adapter with 802.11ac
- A case for the Pi
- One computer configured as a Tailscale exit node on a remote network
- Another computer to use for configuring the Pi (I’m on a Mac)
If you don’t need your traffic to go through a remote network, your Tailscale exit node could be the same Raspberry Pi you configure as an access point for the Apple TV, but that’s really no different than connecting to your regular WiFi router.
In an ideal scenario, the remote location you use will be a residential network, though it could be on any machine located anywhere you choose to run a Tailscale exit node. Your use case should determine your needs.
For my purposes, I installed Tailscale on another Raspberry Pi and configured it as an exit node. Then I deployed that machine to a remote network I have access to.
While you should be able to follow along with these commands relatively easily, this guide does assume basic familiarity with the Linux CLI environment, for example with editing files and restarting services.
3. Install Raspberry Pi OS on the SD card using Raspberry Pi imager #
Download Raspberry Pi imager to install Raspberry Pi OS onto your SD card. Follow the instructions in Raspberry Pi imager to select the operating system and SD card. Before you click “write,” click on the button with the gear icon to set up options like allowing SSH, the default user, and the details of your local WiFi network. Save the settings, click “write,” and wait for the imaging to complete.
Plug your newly flashed SD card into your Raspberry Pi and power it on. It should be all set up and connected to your network. Consult your router to learn the new ip address of your Pi. Mine showed up with an address of 192.168.7.183.
4. Install drivers for the second WiFi interface #
Log into the Pi using the username and password you added through Raspberry Pi imager:
Before plugging in the second WiFi adapter, you need to update the system and install additional software and drivers.
First, make sure the system is up to date:
sudo apt update && sudo apt upgrade -y
Now install necessary packages and software to enable building the WiFi driver from source:
sudo apt install -y raspberrypi-kernel-headers bc build-essential dkms git
Reboot the Pi to start using the new headers and updated software:
sudo reboot now
Log back in and download the source for the WiFi driver:
mkdir -p ~/src cd ~/src git clone https://github.com/morrownr/8821cu-20210118.git
Change into the directory:
Configure the Makefile to make it suitable for the Pi. If your Pi is 32 bit:
Or if your Pi is 64 bit:
Install the driver and reboot:
sudo ./install-driver.sh NoPrompt && sudo reboot now
Plug in the AC WiFi adapter and log back in. Check to see that both WiFi interfaces are active:
ip addr show
You should now see two wireless interfaces.
wlan0 is the internal WiFi, and
wlan1 should be the new WiFi adapter.
5. Configure the Pi as a WiFi access point #
Install the software necessary to run the Pi as a WiFi access point:
sudo apt install -y hostapd dnsmasq iptables
/etc/dhcpd.conf to set a static address for the
wlan0 interface and to instruct that interface to ignore WiFi connection details provided by
wpa_supplicant. You will also tell the service to use
wlan1 as a gateway.
Add these lines at the bottom of the file:
interface wlan1 gateway interface wlan0 static ip_address=192.168.56.1/24 static routers=192.168.56.1 nohook wpa_supplicant metric 500
Restart the dhcpcd service:
sudo systemctl restart dhcpcd
Create a configuration file for hostapd:
sudo nano /etc/hostapd/hostapd.conf
Add the following parameters, and don’t forget to change the network SSID and passphrase:
interface=wlan0 hw_mode=g channel=6 ieee80211n=1 wmm_enabled=0 macaddr_acl=0 ignore_broadcast_ssid=0 auth_algs=1 wpa=2 wpa_key_mgmt=WPA-PSK wpa_pairwise=TKIP rsn_pairwise=CCMP # This is the name of the network ssid=Change-To-Your-Network-Name # The network passphrase wpa_passphrase=Your-Network-Password
Make sure hostapd knows about the configuration file:
sudo sed -i 's|#DAEMON_CONF=\"\"|DAEMON_CONF=\"/etc/hostapd/hostapd.conf\"|g' /etc/default/hostapd
Back up the default dnsmasq configuration file:
sudo mv /etc/dnsmasq.conf /etc/dnsmasq.conf.bak
Create a new dnsmasq configuration file at
/etc/dnsmasq.conf with the following content:
interface=wlan0 # Use interface wlan0 server=126.96.36.199 # Use Cloudflare DNS dhcp-range=192.168.56.50,192.168.56.150,12h # IP range and lease time
Enable forwarding of traffic on IPv4 and IPv6:
sudo sed -i 's/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/g' /etc/sysctl.conf sudo sed -i 's/#net.ipv6.conf.all.forwarding=1/net.ipv6.conf.all.forwarding=1/g' /etc/sysctl.conf
Add the following iptables rule to configure a NAT between the two WiFi interfaces:
sudo iptables -t nat -A POSTROUTING -o wlan1 -j MASQUERADE
Save the iptables rules so they can be re-enabled on boot:
sudo sh -c "iptables-save > /etc/iptables.ipv4.nat"
Add the following line to
exit 0 to apply those iptables rules after each boot:
iptables-restore < /etc/iptables.ipv4.nat
dnsmasq services and reboot:
sudo systemctl unmask hostapd sudo systemctl enable hostapd sudo systemctl restart hostapd sudo service dnsmasq restart sudo reboot now
When the Pi comes back online, at this point it should be broadcasting a WiFi network that you can connect to and through which you can get access to the internet. Once you’re connected to the new WiFi network, you can ssh into the Pi using the static IP address you assigned earlier:
6. Install Tailscale #
Tailscale provides excellent documentation for installing on a Raspberry Pi. They also provide a handy one-liner if you’re comfortable with it:
curl -fsSL https://tailscale.com/install.sh | sh
When the installer script finishes, authorize the Pi to access your private tailnet:
sudo tailscale up
Tell Tailscale to use an exit node and allow LAN access:
sudo tailscale up --exit-node=YOUR-TAILSCALE-EXIT-NODE-IP --exit-node-allow-lan-access
Now if you call
curl ifconfig.me from the Pi command line, you should see the IP address of your exit node. But the current configuration breaks internet access from any machine connected to the Pi’s WiFi network. To fix that, you need to add another rule to iptables:
sudo iptables -t nat -A POSTROUTING -o tailscale0 -j MASQUERADE
With that, the Pi knows how to manage traffic between its different interfaces.
curl ifconfig.me from your computer connected to the Pi’s WiFi should now also show the Tailscale exit node IP address.
7. Use iptables to route traffic and normalize MTU #
One more step remains. Tailscale uses an MTU of 1280, while the standard network interface MTU is 1500. What’s MTU?
In networking, maximum transmission unit (MTU) is a measurement representing the largest data packet that a network-connected device will accept. Imagine it as being like a height limit for freeway underpasses or tunnels: Cars and trucks that exceed the height limit cannot fit through, just as packets that exceed the MTU of a network cannot pass through that network.
However, unlike cars and trucks, data packets that exceed MTU are broken up into smaller pieces so that they can fit through. This process is called fragmentation. Fragmented packets are reassembled once they reach their destination.
MTU is measured in bytes — a “byte” is equal to 8 bits of information, meaning 8 ones and zeroes. 1,500 bytes is the maximum MTU size.
Why does this matter? I found that some websites wouldn’t load properly for any machine connected to the Pi’s WiFi. In particular, any website that uses Fastly failed to load because the initial TLS handshake broke down. Testing with
curl produced the following output:
curl --verbose https://fastly.com * Trying 188.8.131.52:443... * Connected to fastly.com (184.108.40.206) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: /etc/ssl/cert.pem * CApath: none * (304) (OUT), TLS handshake, Client hello (1):
From a regular browser, often it would like the request would just hang or it would time out. With so many moving parts in play between a handful of devices, I thought at first it was a networking or DNS issue. After a day of troubleshooting, I traced the issue back to MTU, a known problem as described here and here.
I was able to solve this problem with iptables, as proposed in the forum post:
sudo iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
I’m no networking expert and the fine points of a detailed explanation are beyond me, but as I understand it that rule modifies packet transmission size if it proves problematic for Tailscale to handle.
To make that rule and forwarding traffic through Tailscale persistent, save the iptables rules again:
sudo sh -c "iptables-save > /etc/iptables.ipv4.nat"
With that, you should have a working Raspberry Pi WiFi access point that routes all traffic through a Tailscale exit node.
8. Connect your Apple TV or other device #
Finally, open the Apple TV network settings and connect to the new WiFi network, or do the same from any device you’d like to have use the Tailscale exit node.