Outbound event/recipient connections

[AIE207]

Attempting to send images over the Tailnet using the Events/Recipients settings on a new AXIS Q6325-LE (FW 12.7.53). Unable to establish any type of outbound connection (HTTP, FTP recipients) from the camera node to any other node on the Tailnet. Inbound connections on the camera's Tailscale IP work great (ping, HTTP, SSH). Is this a limitation of the user space networking? Thank you.

Adding: Installed the latest Tailscale version 1.94.1, aarch64, with no change in behavior. Camera OS: Artpec-9/aarch64.

[AIE207]

Anyone have any thoughts on this issue? Thank you!

[tylerbarnett]

I also reached this problematic issue, assuming because the network doesn't sit at the root anymore for version 12?

[Mo3he]

Unfortunately, this is a known limitation of user space networking.

The non-root variant uses --tun=userspace-networking, which means Tailscale runs as a SOCKS5/HTTP proxy rather than creating a real network interface.
The camera's OS network stack doesn't route through Tailscale, only applications that are explicitly configured to use the SOCKS5 proxy (localhost:1055) will use the tunnel.

What works:

Inbound connections to the camera's Tailscale IP (Tailscale handles these directly)
Anything that explicitly uses the SOCKS5 proxy.

What doesn't work:

Outbound connections from the camera's OS/apps (HTTP recipients, FTP, event triggers) these go out through the camera's real network stack, completely bypassing Tailscale.

The only option that works 100% is to use the ROOT variant on OS11, which creates a real tailscale0 interface, all traffic routes normally.

I have built my own event system for Axis devices that has built in sock5 support https://github.com/Mo3he/Event-Engine-ACAP Give it a try and see if it solves your needs.

[Mo3he]

Update — v1.96.4-proxy adds an HTTP CONNECT proxy that should solve this for outbound HTTP/HTTPS recipients.

The new v1.96.4-proxy release (all non-ROOT variants) now starts an HTTP CONNECT proxy on localhost:8080 alongside the existing SOCKS5 proxy. You can point the camera's built-in proxy settings directly at Tailscale:

System → Network → Global proxies:

• HTTP proxy: http://127.0.0.1:8080
• HTTPS proxy: http://127.0.0.1:8080

System → MQTT → Broker:

• HTTP proxy: http://127.0.0.1:8080
• HTTPS proxy: http://127.0.0.1:8080

Once set, outbound HTTP/HTTPS event recipients and similar connections should route through the Tailscale tunnel automatically — no ROOT variant needed.

FTP recipients won't work through this (FTP isn't HTTP), and the ROOT variant on OS11 is still the only option for full transparent routing of all protocols. But for HTTP/HTTPS this should cover the common cases.

Give it a try and let me know how it goes!