# Tailscale - securing MQTT messages between 2 servers
**URL:** https://discourse.nodered.org/t/tailscale-securing-mqtt-messages-between-2-servers/94458
**Category:** General
**Created:** [8 January 2025 15:35 UTC](https://discourse.nodered.org/t/tailscale-securing-mqtt-messages-between-2-servers/94458 "2025-01-08T15:35:22Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)
#### Post date: [8 January 2025 15:35 UTC](https://discourse.nodered.org/t/tailscale-securing-mqtt-messages-between-2-servers/94458/1 "2025-01-08T15:35:23Z")
I'm using a local raspberry pi a little like a hub, to connect to local IoT devices, and to pass the data via MQTT to a Oracle cloud server, to save the data on a database, and display it on Node-RED dashboards.
Having just updated both servers, I've used @BartButenaers's Tailscript guide to create a secure network.
Up to now, I've configured MQTT to work using both broker & client Public IP addresses in the normal manner, but realised that I can now reconfigure it to work completely within my Tailscale network, so I don't need TLS, certificates, etc, and trust Tailscale to ensure MQTT security & privacy.
So I thought I'd share the process here, if anyone else is interested.
- It's important that both servers need to be in the same Tailscale network
First we need to bind the Mosquitto broker to the Tailscale IP to ensure it listens only on the tailnet, so on the broker obtain it's tailscale IPv4 address;
`tailscale ip`
Make a note of it, and then edit the Mosquitto config file - (typically `/etc/mosquitto/mosquitto.conf` or `/etc/mosquitto/conf.d/default.conf`)
```auto
listener 1883 100.x.x.x
allow_anonymous true
```
...using your desired port number, and the Tailscale IPv4 address which was obtained above.
_(I listen on a different port for my local MQTT traffic)_
Restart Mosquitto, usually `sudo systemctl restart mosquitto`
In the client MQTT node, use the same port number and also the same Tailscale IPv4 address which was obtained above.
Deploy and it should then subscribe to the broker.
NOTE!! If you setup [Access Control](https://github.com/bartbutenaers/Node-RED-Tailscale-Tutorial/blob/main/docs/tailscale_access_control.md), you may need to change or remove the ACL rule, so that the server is able to access the other server (between client & broker).
---
### Author:  [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)
#### Post date: [10 January 2025 18:19 UTC](https://discourse.nodered.org/t/tailscale-securing-mqtt-messages-between-2-servers/94458/2 "2025-01-10T18:19:55Z")
I did find a problem with this however.. If the system is rebooted, the Mosquitto service starts before Tailscale is fully loaded, which results in a Mosquitto error, which it does not recover from ;
```auto
1736531759: Opening ipv4 listen socket on port 1883. <--- Local Port
1736531759: Opening ipv4 listen socket on port 2057. <--- Tailscale Port
1736531759: Error: Cannot assign requested address
```
I tried adding a dependency in the Mosquitto service file;
```auto
[Unit]
After=tailscaled.service
Requires=tailscaled.service
```
which didn't work, I'm assuming that the Tailscale interface is not fully ready by the time the Mosquitto service starts.
So instead, added a 10 second delay to Mosquitto starting, by adding it to the Mosquitto service file;
```auto
[Service]
ExecStartPre=/bin/sleep 10
```
which seems a bit hacky, but none the less works reliably, although I'm open to other suggestions.
---
### Author:  [@system](https://discourse.nodered.org/u/system)
#### Post date: [10 April 2025 18:20 UTC](https://discourse.nodered.org/t/tailscale-securing-mqtt-messages-between-2-servers/94458/3 "2025-04-10T18:20:18Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.