Skip to content
Family Filter

Away from home

The parents’ apps reach the filter API, the history service and the notifier over Tailscale, at real HTTPS addresses that work the same at home and away. Nothing on the Firewalla is reachable from the internet.

Service Address
Filter API https://firewalla.<tailnet>.ts.net:8091
History service https://firewalla.<tailnet>.ts.net:8092
Notifier https://firewalla.<tailnet>.ts.net:8093

Family Filter for Mac’s Settings, connected to the filter at its tailnet address

What each parent needs

Section titled “What each parent needs”
  • Mac: Tailscale installed and connected. Family Filter for Mac is set to the tailnet addresses (Settings ▸ Web blocking, and the history source).
  • iPhone: Tailscale with VPN On Demand, so looking up a *.ts.net name brings it up by itself. Leave Wi-Fi and Cellular on “Do Nothing”, or the trigger doesn’t work. Push notifications don’t need Tailscale.

On the home network without Tailscale, the LAN addresses (the Firewalla’s IP, ports 8091 and 8092) work too.

How it’s built

Section titled “How it’s built”
  • Its own tailnet machine. A tailscale/tailscale container on the Firewalla joins the tailnet as firewalla, tagged tag:firewalla. It uses userspace networking, so it adds no interface or routes to the Firewalla.
  • tailscale serve proxies each port to the matching local service with Tailscale’s certificate, so the apps need no security exception. The child’s devices still use the LAN address for the block page and the certificate.
  • The tailnet policy is the lock. The container has to share the Firewalla’s network, so a tailnet connection to any port of it would reach the Firewalla itself. The policy lets tailnet members reach only ports 8091, 8092 and 8093 on tag:firewalla, and gives the tag nothing outbound. Its tests fail any policy change that would open SSH, the proxy or the Firewalla’s own ports.
  • No subnet route from this machine, on purpose: the tailnet reaches only these three ports.
  • A watcher checks once a minute that the container is online, and restarts it after 3 failures while the internet works.

The home check

Section titled “The home check”

A separate small Tailscale container serves the home check: a public page (through Tailscale Funnel) that answers ok only while home can be reached. The child’s Mac connects its VPN only while the check answers. So if the Firewalla, the power or the home internet fails, the Mac falls back to ordinary internet instead of having none. It has no access to anything else on the tailnet. See the child’s Mac.

Source: filter/README.md