{"id":5237,"date":"2026-08-30T11:40:35","date_gmt":"2026-08-30T02:40:35","guid":{"rendered":"https:\/\/donguri3.net\/server-tech\/surface-server-bigsur-tailscale-minecraft-2\/"},"modified":"2026-08-30T11:40:36","modified_gmt":"2026-08-30T02:40:36","slug":"surface-server-bigsur-tailscale-minecraft","status":"publish","type":"post","link":"https:\/\/donguri3.net\/en\/server-tech\/minecraft\/surface-server-bigsur-tailscale-minecraft\/","title":{"rendered":"Recording of Accessing My Home Minecraft Server from On the Go Using an Old MacBook Air (Big Sur)"},"content":{"rendered":"

My old Surface had a battery defect, causing the CPU to run at only a few percent constantly. Although I replaced the battery myself and restored its performance, I accidentally damaged the LCD during the disassembly process. Since using it with a display became difficult, I repurposed it into a headless “home server” (you can read the setup article here \u2192 [Ubuntu 24.04] The Issue of Laptop Wi-Fi Disconnecting Upon Closing the Lid and Its Countermeasures (Surface Pro 5 Practical Example)<\/a>). I now operate it as an energy-efficient server with a battery that can sustain operation during power outages, running a Minecraft server around the clock.
This time, I will summarize the steps I took to securely access my home server from outside using an old MacBook Air (macOS 11 Big Sur) via Tailscale.<\/p>\n

Accessing the Minecraft Server from On the Go with an Old MacBook Air (Big Sur)<\/h2>\n

To make the server enjoyable for the family even when away from home, I looked into ways to securely connect to my home Minecraft server from outside. The laptop I had on hand was an old MacBook Air (macOS 11 Big Sur).
I hit a roadblock here: since Tailscale cannot be installed directly from the App Store (and official GUI packages) on older Macs running Big Sur, I switched to a strategy of building the CLI version (tailscale \/ tailscaled) from source using Go.
Specifically, I built it using Go 1.24 + Tailscale v1.86 tags, and daemonized it using launchd (install-system-daemon).
Furthermore, by properly configuring Subnet routes (Advertise \/ Enable \/ Accept), I established a setup to reach the Minecraft server located behind the home LAN (e.g., 192.168.1.0\/24) without requiring any port forwarding.<\/p>\n

Criteria for Confirmed Connectivity<\/h2>\n
    \n
  1. tailscale status<\/code> outputs Subnet routes: 192.168.1.0\/24 \u2026 (active)<\/code><\/li>\n
  2. ping 192.168.1.10<\/code> (e.g., the server’s LAN IP) receives a response<\/li>\n
  3. nc -vz 192.168.1.10 25565<\/code> returns open<\/code><\/li>\n
  4. Successful connection via the Minecraft client
    \u203b Once all of these are met, you can consider it “Minecraft OK from outside”<\/li>\n<\/ol>\n

    Where I Stumbled: The Triple Hardship of Big Sur, Go, and Tailscale<\/h2>\n
      \n
    • Big Sur is not supported by the current Tailscale app (GUI) \u2192 Apps and pkgs cannot be used<\/li>\n
    • go install tailscale@main<\/code> assumes Go 1.25+ \u2192 Go 1.25 cannot be installed on Big Sur<\/li>\n
    • Therefore, I switched course to building the CLI version (tailscale \/ tailscaled) from scratch using Go 1.24 + older Tailscale tags (v1.86 series)<\/li>\n
    • Lack of GUI means having to manually configure DNS (MagicDNS) and subnet route acceptance<\/li>\n
    • The issue where the PATH changes during sudo<\/code> and tailscale<\/code> cannot be found (\u2192 Solved with a symlink to \/usr\/local\/bin<\/code>)<\/li>\n<\/ul>\n

      Steps to Use Tailscale on Big Sur<\/h2>\n

      Installing Go 1.24 (Including Measures to Prevent Accidental Upgrades to 1.25)<\/h3>\n
      brew update\nbrew install go\ngo version # \u2192 Confirm go1.24.x\ngo env -w GOTOOLCHAIN=local # Prevent automatic fetching of newer toolchains<\/pre>\n
      Building Tailscale (CLI\/Daemon) with Older Tags<\/h3>\n
      # Don't forget the 'v'\ngo install tailscale.com\/cmd\/tailscale@v1.86.2\ngo install tailscale.com\/cmd\/tailscaled@v1.86.2\n\n# User PATH\necho 'export PATH=\"$HOME\/go\/bin:$PATH\"' >> ~\/.zshrc && exec $SHELL -l\n\n# Make it easy to use with sudo (optional)\nsudo ln -s $HOME\/go\/bin\/tailscale \/usr\/local\/bin\/tailscale\nsudo ln -s $HOME\/go\/bin\/tailscaled \/usr\/local\/bin\/tailscaled<\/pre>\n
      Daemonization (Ensuring VPN Automatically Establishes After Reboot)<\/h3>\n
      sudo tailscaled install-system-daemon\nsudo tailscale up # Log in via browser only for the first time\ntailscale status<\/pre>\n
      From then on, tailscaled<\/code> will automatically start even after a Mac reboot, reconnecting a few to ten-odd seconds later using saved settings.<\/p>\n
      Properly Routing Subnet Routes (The Three-Step Process of “Advertise \/ Approve \/ Accept”)<\/h3>\n
        \n
      • “Advertise” on the subnet router (e.g., a LAN-side Linux machine like PiKVM)<\/li>\n<\/ul>\n
        sudo tailscale set --advertise-routes=192.168.1.0\/24\n# Use SNAT if you don't want to place static routes on routers or LAN devices\nsudo tailscale set --snat-subnet-routes=true\n# (Just in case on Linux) sudo sysctl -w net.ipv4.ip_forward=1<\/pre>\n
          \n
        • “Approve (Enable)” in the Admin Console
          Machines \u2192 Subnet router \u2192 Route settings \u2192 Enable 192.168.232.0\/24<\/li>\n
        • “Accept” on the client (Big Sur MBA)<\/li>\n<\/ul>\n
          sudo tailscale set --accept-routes=true\ntailscale status # OK if \"\u2026 (active)\" is appended<\/pre>\n
          What Exactly Are Subnet Routes? (Explaining the Mechanism in “Visual Terms”)<\/h2>\n
            \n
          • 100.x.x.x<\/code> is each node’s own Tailscale IP<\/li>\n
          • Subnet routes share paths to “bring the entire existing LAN beyond that node (e.g., 192.168.1.0\/24) onto the VPN”<\/li>\n
          • That is why the 3-step process of Advertise (which LAN to carry) \u2192 Approve (permission to distribute) \u2192 Accept (client application) is mandatory<\/li>\n
          • Clients physically located on the same subnet basically do not use the VPN route for that prefix (a specification to avoid conflicts)<\/li>\n<\/ul>\n
            Operation Check and Final Verification (Concluding on a “Practical Impact Basis”)<\/p>\n
            tailscale status\nroute -n get 192.168.1.1\nnetstat -rn | egrep '192\\.168\\.232|utun'\nping -c 3 192.168.1.10\nnc -vz 192.168.1.10 25565<\/pre>\n
            If nc<\/code> successfully reaches the open<\/code> state, you are mostly good to go with the Minecraft client as well. Don’t forget to configure MagicDNS if you prefer connecting by name.<\/p>\n
            Conclusion: How to Give Old Hardware “One More Role”<\/h2>\n
              \n
              Even with a broken screen, a Surface can function adequately as a quiet, energy-efficient server. The key points for Ubuntu deployment have already been summarized in a previous article.<\/div>\n
            • Even though the Big Sur MBA does not officially support the app, it was made practical via the Go 1.24 + Tailscale v1.86 (CLI) route.<\/li>\n
            • The stumbling blocks are Subnet routes (Advertise\/Approve\/Accept) and DNS (MagicDNS must be set manually). Once successfully configured, the VPN starts automatically even after reboots.<\/li>\n
            • Join your home Minecraft server securely from anywhere without needing port forwarding. I think this is a realistic way to give old hardware another chance in the spotlight.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
              My old Surface had a battery defect, causing the CPU to run at only a few percent constantly. Although I repla […]<\/p>\n","protected":false},"author":4,"featured_media":2293,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_locale":"en_US","_original_post":"https:\/\/donguri3.net\/?p=2290","footnotes":""},"categories":[1168],"tags":[119,105,913,771,485,352,24,92,10,131],"class_list":["post-5237","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-minecraft","tag-cdn","tag-linux","tag-minecraft","tag-surface-pro-5","tag-tailscale","tag-ubuntu","tag-vpn","tag-wireguard","tag-server","tag-131","en-US"],"_links":{"self":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts\/5237","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/comments?post=5237"}],"version-history":[{"count":1,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts\/5237\/revisions"}],"predecessor-version":[{"id":5240,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts\/5237\/revisions\/5240"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/media\/2293"}],"wp:attachment":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/media?parent=5237"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/categories?post=5237"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/tags?post=5237"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}