Incoming Connections for Tailscale and WireGuardSurge can now accept connections that come in through Tailscale and WireGuard, not just send traffic out. Incoming requests are handled like any other request: they go through your rules and policies and show up in the request list.
Tailscale-
accept-incoming = true: other devices on your tailnet can connect to this device through its tailnet address. For example, they can use Surge's HTTP/SOCKS5 proxy or other services running on this device.
-
advertise-exit-node = true: offer this device as an exit node. Other tailnet devices that select it send all their internet traffic through Surge's rules.
-
advertise-routes = 192.168.1.0/24, ...: offer this device as a subnet router for the listed networks.
- Exit nodes and subnet routes take effect after you approve them in the Tailscale admin console.
WireGuard-
accept-incoming = true: the peer side can open connections to this device through an existing tunnel.
-
listen-port = 51820: Surge acts as a WireGuard server that phones, laptops, and other clients can connect to. A peer can leave out
endpoint; Surge learns the client's address when it connects and keeps up when the address changes.
- Clients can set Surge's tunnel address as their DNS server, and Surge's DNS will answer their queries.
Note: Surge does not apply your Tailscale access control policy to incoming connections. Use rules such as
SRC-IP to limit who can reach which destination.
Requires iOS 5.24.0+ / Mac 6.11.0+. See the Tailscale and WireGuard pages in the manual for details and example configurations.
