Set up a Tailscale Forwarder

What is the Tailscale Forwarder?

The Tailscale Forwarder is a lightweight TCP proxy that joins your tailnet as a machine and forwards traffic from ports on that machine to services on your Railway private network.

In practice, this means any device connected to your tailnet can reach your Railway services — like databases — through the forwarder, without those services ever being exposed to the public internet.

About this tutorial

This tutorial will help you connect to your database via the private network without you having to use public endpoints.

For occasional access from your own machine, the Railway CLI can open a temporary tunnel to a private database with railway connect <service> --tunnel-only. A Tailscale Forwarder is the right tool when you need a permanent route into the private network — constant traffic, multiple services, or access from every device on your tailnet.

Deploying the Tailscale Forwarder into your project means that you can access your services' private ports from any device connected to your tailnet, by connecting to the forwarder's machine name.

This tutorial aims to provide a simple step-by-step guide on setting up everything needed so that you can access your services over the private network.

Objectives

In this tutorial, you'll learn how to do the following: -

• Generate a reusable Auth Key.
• Enable MagicDNS.
• Deploy the Tailscale Forwarder template.
• (Bonus) Connect to Postgres locally through the forwarder.

Prerequisites

This guide assumes you are familiar with the concepts of Private Network, for a quick explainer check out the guide and reference page.

In Railway -

• Have all the services you plan on connecting to via the tailnet, listening on :: (all interfaces).

  This is necessary because the forwarder will communicate with your services over Railway's private network.

  All database services already do this but for information on configuring your service to listen on ::, see here.

In Tailscale -

• Have an account.

  You can sign up here - For what this template achieves you do not need a paid plan.

• Have the Tailscale app installed on your computer.

  You can find the downloads for your OS here.

1. Getting an auth key

The Auth key will authenticate the Tailscale machine that you'll deploy into your Railway project in a later step.

• Head over to the Keys page located within the settings menu on the Tailscale dashboard.

• Click Generate auth key.

  Put in a description and enable the Reusable option, leaving all other settings as the default.

  A reusable key lets the forwarder register itself again whenever it starts without existing state — for example, when you deploy a forwarder into another environment.

• Click Generate key.

  Tailscale will now show you the newly generated auth key, be sure to copy it down.

• Click Done.

2. Enable MagicDNS

MagicDNS lets devices on your tailnet resolve the forwarder by its machine name, giving you a stable hostname to connect to.

• Open the DNS page.

• Under the Tailnet DNS header, make sure MagicDNS is enabled.

  MagicDNS is enabled by default on new tailnets, so there's a good chance you don't need to change anything here.

• On the device you'll be connecting from, make sure the Tailscale app is set to use Tailscale's DNS resolver (Use Tailscale DNS in the app's settings). Without it, your computer won't be able to resolve the forwarder's machine name.

3. Deploy the Tailscale Forwarder

This will be the gateway into your environment's private network.

• Open the project that contains the services you want to access privately.

  For this tutorial, you will deploy the forwarder into a project with a Postgres database service.

• In the top right of the project canvas, click Create → Choose Template.

• Search for the Tailscale Forwarder template and select it.

• A ghost service will appear, asking you to configure the template's variables -

  • TS_AUTHKEY - Paste in your reusable Auth Key from earlier.

  • CONNECTION_MAPPING_1 - The port forwarding rule, in the format <source port>:<target host>:<target port>.

    For this tutorial's Postgres example, use 5432:postgres.railway.internal:5432 - this forwards port 5432 on the forwarder to the database's private domain and port.

• Click Deploy Template

This template will start to deploy and once deployed it will register itself as a machine in your tailnet, you can see it in the Machines dashboard.

The machine name is derived automatically from your project, environment, and service names, e.g. my-project-production-tailscale-forwarder - you'll use this name to connect in the next step.

The template also deploys with a volume attached, which persists the forwarder's Tailscale state (it sets TS_EPHEMERAL=false) so that restarts and redeploys keep the same machine identity instead of registering duplicate machines in your tailnet.

Unlike the previous subnet router setup, there are no subnet routes to approve.

Forwarding more services

To reach additional services through the same forwarder, add more CONNECTION_MAPPING_[n] variables (CONNECTION_MAPPING_2, CONNECTION_MAPPING_3, and so on) to the forwarder service, each with a unique source port.

HTTPS forwarding

For HTTP services, you can prefix a mapping with https: (e.g. https:8080:my-service.railway.internal:8080) to have the forwarder terminate TLS with a certificate for its machine name. This requires HTTPS to be enabled on your tailnet in addition to MagicDNS.

That is it for all the configurations needed, you can now reach any mapped service through the forwarder's machine name from any device connected to your tailnet!

4. Connecting to a service on the private network (bonus)

This tutorial has used Postgres as an example service, so let's finally connect to it through the forwarder!

Rather than connecting to the railway.internal private domain directly - those domains only resolve inside your environment - you connect to the forwarder's machine name and the source port from your connection mapping, e.g. -

postgresql://postgres:<PGPASSWORD>@my-project-production-tailscale-forwarder:5432/railway

You can use any database GUI tool you prefer, or none at all, since your setup allows you to connect to the database over the private network using any software.

Example: Your prisma migrate deploy or python manage.py migrate commands will now work locally using the forwarder's hostname, without the need to use the public host and port for the database.

Additional Resources

This tutorial explains how to set up a Tailscale Forwarder on Railway but does not delve into all the terminology and settings related to Tailscale.

We recommend reviewing the following Tailscale documentation:

• Auth keys
• MagicDNS
• Machine names
• Enabling HTTPS
• Tailscale FAQ

You can also check out the forwarder's source repository for the full list of supported configuration options.