Forwarded from 
Incoming Connections for Tailscale and WireGuard

Surge can now accept connections that come in through Tailscale and WireGuard, not just send traffic out. Incoming requests are handled like any other request: they go through your rules and policies and show up in the request list.

Tailscale
- accept-incoming = true: other devices on your tailnet can connect to this device through its tailnet address. For example, they can use Surge's HTTP/SOCKS5 proxy or other services running on this device.
- advertise-exit-node = true: offer this device as an exit node. Other tailnet devices that select it send all their internet traffic through Surge's rules.
- advertise-routes = 192.168.1.0/24, ...: offer this device as a subnet router for the listed networks.
- Exit nodes and subnet routes take effect after you approve them in the Tailscale admin console.

WireGuard
- accept-incoming = true: the peer side can open connections to this device through an existing tunnel.
- listen-port = 51820: Surge acts as a WireGuard server that phones, laptops, and other clients can connect to. A peer can leave out endpoint; Surge learns the client's address when it connects and keeps up when the address changes.
- Clients can set Surge's tunnel address as their DNS server, and Surge's DNS will answer their queries.

Note: Surge does not apply your Tailscale access control policy to incoming connections. Use rules such as SRC-IP to limit who can reach which destination.

Requires iOS 5.24.0+ / Mac 6.11.0+. See the Tailscale and WireGuard pages in the manual for details and example configurations.