Tailscale Browser-Router by Nope-im-not-pro

Tailscale Browser-Router is a proxy switch for Firefox. The extension does not create a tunnel of its own; it decides per request whether that request goes through the local SOCKS5 port of a userspace tailscaled or straight out to the internet.

WHAT IT DOES
Every request is switched between tunnel and direct connection based on the rule set and the active mode. Only browser traffic is affected; the rest of the system is untouched.

MODES
- Off: everything direct.
- Global: everything through the tunnel.
- Allowlist: only matching domains through the tunnel.
- Blocklist: everything through the tunnel except matching domains.
- Per-tab: tunnel state per browser tab.

FAIL-CLOSED AND LEAK GUARD
A tunnel decision always returns SOCKS. If the tunnel is dead, the connection fails visibly - there is no silent fallback to a direct connection. The leak guard sets WebRTC to disable_non_proxied_udp and turns off prefetch/network predictor; DNS is resolved through the tunnel (proxyDNS) and IPv6 follows the routing decision. The status light turns green only when the full set is confirmed.

REQUIREMENTS
The extension requires a separately running Tailscale client in userspace mode:
tailscaled --tun=userspace-networking --socks5-server=localhost:1055
Optionally, a native messaging host (Python 3, source in the project repository) controls that daemon directly from the user interface. Without the host the extension runs in degraded mode: the switch works, but the tunnel must be started manually. Firefox 140 or newer.

WHAT IT DOES NOT DO
No system-wide VPN. No Tailscale client of its own and no replacement for one. No data collection, no telemetry, no developer-operated servers - rule set and mode live in local browser storage only.

Source code and documentation: https://github.com/Nope-im-not-pro/TailScale-Browser-Extension
License: GPL-3.0-or-later. Tailscale is a trademark of Tailscale Inc.; this project is not affiliated with Tailscale Inc.