⏱️ Lectura: 9 min
Tailscale on Kindle, until now, only got you a green dot in the web console: the device joined the tailnet but couldn’t route real traffic from other apps. That changed with a community update that adds proxy mode and, on some models, full TUN mode.
📑 En este artículo
The update turns the e-reader into a nearly full Tailscale client: KOReader can now reach Calibre, Wallabag, or Audiobookshelf servers over the tailnet, without leaving the app.
TL;DR
- A fork of Mitanshu Sukhwani’s Tailscale client, updated by greywolf1499, adds proxy and TUN mode to jailbroken Kindles.
- Proxy mode exposes SOCKS5 on 127.0.0.1:1055 and HTTP CONNECT on 127.0.0.1:1056, both served by tailscaled.
- Previously, Tailscale on Kindle ran only in userspace mode and couldn’t route other apps’ traffic into the tailnet.
- KOReader can now connect to Calibre/OPDS, Wallabag, and Audiobookshelf servers through the Kindle’s Tailscale proxy.
- There’s a native Tailscale plugin for KOReader, tested on Kindle PW5/PW6, Kobo, and PocketBook (author: Victoria Riley Barnett).
- The KOReader plugin integrates with a Syncthing plugin to sync libraries between devices.
- Tailscale SSH ships enabled by default in the new version, no longer relying on USBNetworking SSH’s default username and password.
- On some Kindle models, full TUN mode enables OS-level routing.
What happened with Tailscale on Kindle
The KUAL Tailscale app for Kindle, based on Mitanshu Sukhwani’s original work, received an update from greywolf1499 published on GitHub. The new version ships with Tailscale SSH enabled by default (no more need to open USBNetworking SSH with its default username and password), a proxy mode, and, on certain models, a system-level TUN mode.
Before this change, as described on Tailscale’s official blog, the jailbroken Kindle ran the client in userspace mode: it showed up on the tailnet and accepted incoming SSH, but couldn’t route other apps’ traffic because it had no access to the operating system’s TUN layer.
The practical result was this: KOReader would ask the Kindle’s operating system how to reach a Tailscale IP like 100.x.y.z, the system had no idea how to route that address because Tailscale didn’t control the network layer, and the connection would fail.
Context and history
Tailscale had already covered on its blog the first port of its client to a jailbroken Kindle, an experiment that showed even one of the weakest computers you own could join a mesh network over WireGuard. That first port relied entirely on KUAL, the unofficial app launcher that makes it possible to install third-party software on a jailbroken Kindle.
Kindle jailbreaking is a community process, unsupported by Amazon, that unlocks the device’s underlying Linux system. From there, apps like KOReader, an alternative reader with support for RSS, syncing, and plugins, became the real day-to-day operating system for many advanced users.
The original article’s author, Kevin Purdy, notes that this kind of project lives or dies by keeping up with every Amazon firmware update, which can close off the jailbreak path at any moment. That’s why the standing recommendation is to bring patience: this is community code running on a device in an unofficial state.
Technical details and performance
Proxy mode exposes two protocols on localhost so any app can manually configure its traffic: SOCKS5 on port 1055 and HTTP CONNECT on port 1056, both listened to by the tailscaled daemon. When KOReader, or any other app, points its proxy to 127.0.0.1:1055, tailscaled intercepts the connection and routes it through the tailnet to the destination node.
Having two protocols matters because not every app in the Kindle ecosystem supports SOCKS5 natively. HTTP CONNECT covers the ones that only know how to speak classic HTTP proxy.
sequenceDiagram
participant K as KOReader
participant D as tailscaled
participant N as Remote node
K->>D: connects to the proxy on port 1055 SOCKS5
D->>N: routes traffic via the tailnet
N-->>D: responds with data from the server
D-->>K: delivers the response to the app
Note over K,D: without this proxy the app cannot reach the tailnetFull TUN mode is different: on the models where it works, Tailscale takes control of the network interface at the operating system level, just like on a regular laptop or phone. There, you no longer need to configure the proxy app by app, because all of the device’s traffic can go out through the tailnet.
| Mode | What it enables | Advantage | Limitation |
|---|---|---|---|
| Userspace (classic) | The Kindle shows up on the tailnet and accepts incoming SSH | Already available since the project’s first port | Other Kindle apps can’t reach the tailnet |
| SOCKS5 / HTTP CONNECT proxy | Apps like KOReader route traffic manually via 127.0.0.1 | Works on any jailbroken Kindle | The proxy must be configured app by app |
| Full TUN | OS-level routing | All of the device’s traffic goes through the tailnet | Only available on some Kindle models |
💡 Tip: reserve the Kindle’s Tailscale IP from the admin web console so it doesn’t change every time the device reconnects.
How to start testing it
There are two paths, and both require a Kindle that’s already jailbroken with KUAL installed. The first is the Tailscale app for KUAL with proxy mode; the second is the native KOReader plugin, which also works on Kobo and PocketBook.
To copy the KOReader plugin to the device connected via USB, the commands vary depending on your operating system:
# macOS
cp -r tailscale.koplugin /Volumes/KINDLE/koreader/plugins/
# Linux
cp -r tailscale.koplugin /media/$USER/KINDLE/koreader/plugins/
# Windows (PowerShell)
Copy-Item -Recurse .\tailscale.koplugin E:\koreader\plugins\With the plugin copied over, open the KOReader menu, run the Install/Update Tailscale option, copy your Tailscale auth key to the directory the plugin asks for, and turn on the Tailscale toggle. Then configure KOReader’s proxy with the exact values exposed by tailscaled:
# KOReader > Network > Proxy
type = socks5
host = 127.0.0.1
port = 1055
# HTTP CONNECT alternative
type = http_connect
host = 127.0.0.1
port = 1056To confirm it’s active, check the Tailscale admin web console: the Kindle should show up with a green dot. If you have SSH access via Tailscale from another node, you can also run tailscale status and verify the Kindle shows as online.
Impact and analysis
The most practical use case is reading your own content without depending on Amazon’s cloud: a self-hosted Calibre or OPDS server, a Wallabag account for saved articles, or Audiobookshelf for audiobooks, all reachable from the Kindle via the tailnet, without exposing those servers to the public internet.
It also enables more eccentric uses, like using Readest to track reading progress across devices, hooking KOReader’s RSS reader up to a self-hosted server, or SSHing into other tailnet nodes with a Bluetooth keyboard and the kterm app. The original article’s author admits it himself: SSHing from a Kindle with a Bluetooth keyboard isn’t especially practical, but it has real appeal for anyone building weird hardware projects.
The biggest remaining limitation is device coverage. The KOReader plugin is confirmed working on Kindle PW5, PW6, Kobo, and PocketBook, but Kevin Purdy himself reports he couldn’t get it working on his standard 11th-generation Kindle. This is community code running on officially unsupported hardware: any Amazon firmware update can break the entire jailbreak, so it shouldn’t be relied on for anything critical.
⚠️ Heads up: neither Amazon nor Tailscale officially support a jailbroken Kindle. A firmware update can render both the jailbreak and the Tailscale client useless overnight.
What’s next
Tailscale explicitly asked its community to share their Kindle, Kobo, or other e-paper device configurations on Reddit, Discord, Bluesky, X, Mastodon, or LinkedIn. That’s a sign the project remains experimental and depends on the jailbreak community itself documenting which models work with the KOReader plugin and which don’t.
The most likely near-term outcome is that the list of devices compatible with the plugin, currently PW5, PW6, Kobo, and PocketBook, will grow as more users test different models and report results in the plugin’s repository.
📖 Summary on Telegram: View summary
Try it yourself: if you already have a jailbroken Kindle with KUAL, install the latest version of the Tailscale client from its GitHub repository and turn on proxy mode today.
Frequently Asked Questions
Do I need to jailbreak my Kindle to use Tailscale?
Yes. Without a jailbreak there’s no way to install KUAL or any Tailscale client on the device; Amazon doesn’t offer that option out of the box.
Does full TUN mode work on any Kindle?
No. Only some models allow Tailscale to take control of the network interface at the operating system level; on the rest you have to use proxy mode.
What’s the difference between SOCKS5 and HTTP CONNECT?
They’re two different proxy protocols that tailscaled exposes in parallel, on ports 1055 and 1056: each app uses whichever one it supports.
Does it work on Kobo or PocketBook, not just Kindle?
Yes, through the native Tailscale plugin for KOReader, which runs the same way on those devices as long as they have KOReader installed.
Is this an official Tailscale product?
No. It’s community code that interacts with a jailbreak unsupported by both Amazon and Tailscale.
What’s this useful for in practice?
For reading and syncing content from your own servers, like Calibre, Wallabag, Audiobookshelf, or RSS, without exposing them to the public internet.
References
- Tailscale Blog: original post about the new proxy and TUN modes for jailbroken Kindle.
- Official KOReader Repository: source code for the reader used as the base for the Tailscale plugin.
- Tailscale.com: official site for the WireGuard-based mesh networking project.
📱 Enjoying this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day. @programacion
0 Comments