# LXC Container + Tailscale Setup on Proxmox
(We have got vpn at home)

# LXC Container + Tailscale Setup on Proxmox

*Part of the* ***Proxmox Baremetal Journey*** *series*

I wanted to make my Proxmox homelab more secure and flexible by using **Tailscale** on an **Ubuntu 22.04 LXC container**. The end goal: turn the LXC into a subnet router and exit node for my entire Tailscale network. And later add IDS/IPS for experimentation.  This post documents the steps to install and set-up tailscale.

Think of this as both a **how-to guide** and a **"learn from my setup journey"** story.

---

## 1\. Preparing the LXC in Proxmox

When creating your container in Proxmox, you’ll need to enable nesting and ensure the tun device is available.

Here is my config : `/etc/pve/lxc/100.conf` (for container CT100):

```ini
arch: amd64
cores: 2
features: nesting=1
hostname: CT100
memory: 512
net0: name=eth0,bridge=vmbr0,hwaddr=BC:24:11:58:98:29,ip=dhcp,type=veth
rootfs: local-lvm:vm-100-disk-0,size=8G
swap: 512
unprivileged: 1
lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file
```

## 2\. Configure Netplan for Networking

Inside the container, set up DHCP with Netplan:

```bash
nano /etc/netplan/50-cloud-init.yaml
```

```yaml
network:
  version: 2
  ethernets:
    eth0:
      dhcp4: true
```

Apply changes:

```bash
sudo netplan apply
```

Verify IP:

```bash
ip a
```

*Screenshot of IP output:*

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757531550269/39f9adf2-c25d-4f6d-80c8-89737cbbbcb9.png align="center")

*Screenshot of netplan config:*

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757531570783/5663eb47-3f99-47b2-a0a9-8259ac4524da.png align="center")

## 3\. Install Tailscale

Follow the [official guide](https://tailscale.com/kb/1187/install-ubuntu-2204):

```bash
curl -fsSL https://tailscale.com/install.sh | sh
```

Bring Tailscale up:

```bash
sudo tailscale up
```

A browser window will open asking to connect your device.

*Tailscale auth screen:*

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757531760498/09079f0c-304a-4d90-b46e-e60b2cb378fd.png align="center")

## 4\. Enable Subnet Routing & Exit Node

Advertise your container as an exit node:

```bash
sudo tailscale up --advertise-exit-node
```

Or to route your LAN subnet:

```bash
sudo tailscale up --advertise-routes=<>
```

Approve routes in the Tailscale admin console.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757531914595/9701b40f-f7b1-4fdd-8049-53946137a753.png align="center")


##  5\. Using the LXC as Exit Node

On another Tailscale device, set the container as your exit node:

```bash
sudo tailscale up --exit-node=<LXC_IP>
```

Replace `<LXC_IP>` with the container’s Tailscale or LAN IP.

---

## 6\. Handling Key Expiry

By default, Tailscale auth keys expire. If you need reusable or long-lived keys, check [Key Expiry Docs](https://tailscale.com/kb/1028/key-expiry).

Generate and use reusable keys for automation.

---

## Takeaways

* Nesting + tun device are **required** in the LXC config.
    
* Netplan must be configured with DHCP.
    
* Tailscale can easily advertise routes and exit node.
    
* Keys expire unless replaced with reusable ones.
    
With this setup, my Proxmox-hosted LXC is now a fully functioning **VPN gateway + exit node** for my Tailscale network.