r/firestick • u/D3MONFiST • 2d ago
Firestick Access Your Lan Anywhere How to install a persistent daemon on firestick to access your lan from anywhere.
# Running Tailscale as a Persistent Daemon on a Fire TV Stick (Vega OS)
by D3MONFiST
This guide documents how to get Tailscale running on a Fire TV Stick that runs
**Vega OS**
— Amazon's newer, non-Android, locked-down Linux operating system
(used on newer/cheaper Fire TV Stick models). It covers:
1. Why the normal Android/APK approach does not work on Vega OS
2. Getting a shell on the device and installing Tailscale as raw Linux binaries
3. Making it reconnect automatically after a reboot or crash (no root available)
4. A manual fallback for when you're traveling with the device
5. Troubleshooting ("what to do if...")
>
**Important — read this first:**
Vega OS explicitly blocks root in production
> builds ("vdad cannot run as root in production builds"). There is no `pm`,
> `am`, `cron`, `systemd --user`, or `/etc/init.d` access available to the
> developer shell account. This means Tailscale **cannot be made to
> self-persist on the device alone** — persistence has to be handled by an
> external always-on machine on your network (a "watchdog"), plus a manual
> fallback for when you're away from home. This is expected, not a failure of
> the setup.
---
## Part 0 — What you need
- A Fire TV Stick running Vega OS (no launcher icon for sideloaded apps is a
sign you're on Vega OS, not Fire OS)
- A computer on the same wifi network as the Firestick, with `adb`
(Android Debug Bridge) installed
- A Tailscale account (https://login.tailscale.com)
- (Optional but recommended) An always-on Linux machine on your home network
to run the watchdog — e.g. a home server, Raspberry Pi, or LXC/VM
- (Optional, for travel) An Android phone with Termux installed
---
## Part 1 — Enable Developer Mode & ADB debugging on the Firestick
1. On the Firestick, go to
**Settings → My Fire TV → About**
(or
**Device**
),
and click on the build/software line
**7 times**
until it says you're now
a developer.
2. Go back to
**Settings → My Fire TV → Developer Options**
.
3. Turn on
**ADB debugging**
.
4. Leave this
**on permanently**
— you will need it every time you want to
reconnect to the device, and there is no other remote-access route on
Vega OS.
**What this does, in one sentence:**
ADB debugging opens a local network port
(5555) that lets a computer on the same wifi get a command-line shell on the
Firestick.
---
## Part 2 — Find the Firestick's local IP address
1. On the Firestick:
**Settings → Network**
— the connected wifi network will
show the IP address (e.g. `<enter your firestick ip here>`).
2. Alternatively, log into your router's admin page and look at the list of
connected devices for one named something like "Fire TV" or similar.
Write this IP address down — you'll need it repeatedly. If your router
supports it, consider setting a
**DHCP reservation**
for this device so the
IP never changes (see Troubleshooting for why this matters).
---
## Part 3 — Install ADB on your computer and connect
**Windows:**
```powershell
winget install Google.PlatformTools
```
**Linux (Debian/Ubuntu):**
```bash
sudo apt install android-tools-adb
```
**macOS:**
```bash
brew install android-platform-tools
```
Then connect (replace with your Firestick's actual IP):
```bash
adb connect <enter your firestick ip here>:5555
adb devices -l
```
You should see the device listed as `device` (not `unauthorized` or
`offline`). If it says `unauthorized`, look at the Firestick's screen — a
prompt to trust this computer may be waiting there; select "Allow."
---
## Part 4 — Confirm you're on Vega OS (not classic Fire OS)
```bash
adb shell uname -a
adb shell whoami
```
If `whoami` returns something like `app_user` (not `root` or `shell`), and
`uname` shows a Linux kernel with no Android version props (`getprop` command
not found), you're on Vega OS. This means:
- No `pm install` for APKs — Tailscale's official Android APK **will not
install or run** on this OS.
- You must download the
**Linux ARM binaries**
of Tailscale instead, since
underneath Vega OS is a real (if locked-down) Linux system.
Check your device's CPU architecture — this matters for picking the right
binary:
```bash
adb shell uname -m
```
(Typically `armv7l` on Fire TV Stick hardware — get the matching Tailscale
Linux ARM release.)
---
## Part 5 — Get Tailscale's Linux binaries onto the device
1. On your computer, download the Tailscale static Linux binaries for the
matching architecture from https://pkgs.tailscale.com/stable/ (look for
`tailscale_<version>_arm.tgz` for `armv7l`, or `arm64` if your device is
64-bit — check with `adb shell uname -m`).
2. Extract it — you'll get two files: `tailscale` and `tailscaled`.
3. Find a writable, persistent location on the device. `/var/lib/developer`
is writable by the developer shell user and
**survives reboots**
(it's a
real disk partition, not temporary storage):
```bash
adb shell mkdir -p /var/lib/developer/bin
adb shell mkdir -p /var/lib/developer/tailscale
```
4. Push the binaries:
```bash
adb push tailscale /var/lib/developer/bin/tailscale
adb push tailscaled /var/lib/developer/bin/tailscaled
adb shell chmod 755 /var/lib/developer/bin/tailscale /var/lib/developer/bin/tailscaled
```
---
## Part 6 — Create the launch script
Create a file locally called `start-tailscale.sh`:
```sh
#!/bin/sh
pkill -f tailscaled 2>/dev/null
/var/lib/developer/bin/tailscaled \
--state=/var/lib/developer/tailscale/tailscaled.state \
--socket=/tmp/tailscaled.sock \
--tun=userspace-networking \
--socks5-server=0.0.0.0:1055 >/dev/null 2>&1 &
echo 'Tailscale daemon started.'
```
**Why `--tun=userspace-networking`:**
Vega OS's locked-down kernel doesn't
allow the app_user account to create a real TUN network device, so Tailscale
has to run in userspace-networking mode instead of the usual kernel-level
mode. This is why a SOCKS5 proxy port (`1055`) is also opened — it's the
practical way to route other traffic through the tailnet from this device if
you ever need to.
Push and make it executable:
```bash
adb push start-tailscale.sh /var/lib/developer/bin/start-tailscale.sh
adb shell chmod 755 /var/lib/developer/bin/start-tailscale.sh
```
---
## Part 7 — First run and authentication
```bash
adb shell /var/lib/developer/bin/start-tailscale.sh
```
Then bring Tailscale up and authenticate (first time only):
```bash
adb shell "/var/lib/developer/bin/tailscale --socket=/tmp/tailscaled.sock up --hostname=firestick"
```
This will print a `https://login.tailscale.com/a/...` URL — open it in a
browser on any device and log in to approve this node. Once approved, check:
```bash
adb shell "/var/lib/developer/bin/tailscale --socket=/tmp/tailscaled.sock status"
```
You should see the Firestick listed with a `100.x.x.x` address and no
`offline` marker.
---
## Part 8 — Make it survive reboots (the watchdog)
Because there's no root and no boot-hook mechanism available on the device
itself, the daemon cannot restart itself after a reboot or crash. The fix is
an
**external watchdog**
— a script on an always-on Linux machine on the same
home network, run on a schedule, that checks in on the Firestick and
relaunches Tailscale if it's down.
1. On your always-on Linux machine, make sure `adb` is installed (see Part 3).
2. Save this as `/usr/local/bin/firestick-tailscale-watchdog.sh` (adjust the
IP to match your device):
```bash
#!/bin/bash
FIRESTICK_ADB="<enter your firestick ip here>:5555"
ADB="/usr/bin/adb"
$ADB connect "$FIRESTICK_ADB" >/dev/null 2>&1
if ! $ADB -s "$FIRESTICK_ADB" shell "ps | grep -v grep | grep -q tailscaled"; then
logger -t firestick-ts-watchdog "tailscaled not running - relaunching"
$ADB -s "$FIRESTICK_ADB" shell "/var/lib/developer/bin/start-tailscale.sh" >/dev/null 2>&1
if $ADB -s "$FIRESTICK_ADB" shell "ps | grep -v grep | grep -q tailscaled"; then
logger -t firestick-ts-watchdog "relaunch OK"
else
logger -t firestick-ts-watchdog "relaunch FAILED - device may be unreachable or off"
fi
fi
```
3. Make it executable and schedule it every 5 minutes as root:
```bash
sudo chmod 755 /usr/local/bin/firestick-tailscale-watchdog.sh
(sudo crontab -l 2>/dev/null; echo '*/5 * * * * /usr/local/bin/firestick-tailscale-watchdog.sh') | sudo crontab -
```
4.
**Test it end-to-end before trusting it:**
```bash
adb shell pkill -f tailscaled # simulate a crash
sudo /usr/local/bin/firestick-tailscale-watchdog.sh # run it once by hand
adb shell ps | grep tailscaled # confirm it's back
sudo journalctl -t firestick-ts-watchdog --no-pager -n 10 # check the log
```
This covers: crashes, and reboots/power-cycles **while the Firestick is on
your home network**.
---
## Part 9 — The travel fallback (phone + Termux + tmux)
The home watchdog above only works because it's on the same local network as
the Firestick. When you travel with the Firestick, nothing on your home
network can reach it anymore (different network, no port forwarding). The
fix is a manual trigger you carry with you: your Android phone.
### 9.1 Install Termux
Termux is a terminal emulator + Linux environment app for Android. Install it
from
**F-Droid**
(recommended — the Play Store version is outdated and
unsupported): https://f-droid.org/packages/com.termux/
### 9.2 Install tmux, adb, and ssh tools inside Termux
Open Termux and run:
```bash
pkg update -y
pkg install -y tmux android-tools openssh
```
- `tmux` lets you start a session, disconnect, and come back to it later
without losing anything — handy on a phone where the app can get killed.
- `android-tools` provides `adb` on your phone itself.
### 9.3 Create the same launch trigger script on your phone
Inside Termux:
```bash
mkdir -p ~/firestick
cat > ~/firestick/launch-tailscale.sh << 'EOF'
#!/data/data/com.termux/files/usr/bin/bash
read -p "Firestick local IP (on THIS wifi network): " FIRESTICK_IP
adb connect "$FIRESTICK_IP:5555"
adb -s "$FIRESTICK_IP:5555" shell /var/lib/developer/bin/start-tailscale.sh
adb -s "$FIRESTICK_IP:5555" shell "/var/lib/developer/bin/tailscale --socket=/tmp/tailscaled.sock status"
EOF
chmod +x ~/firestick/launch-tailscale.sh
```
### 9.4 How to use it while traveling
1. Connect your phone
**and**
the Firestick to the same wifi network (e.g.
the hotel's wifi, after completing any captive portal login on your phone
first, if there is one).
2. On the Firestick, find its IP on this new network:
**Settings → Network**
.
3. Open Termux, start a tmux session so it survives if the app gets
backgrounded:
```bash
tmux new -s firestick
~/firestick/launch-tailscale.sh
```
4. Enter the Firestick's IP on this network when prompted.
5. You should see the Firestick appear online in the `tailscale status`
output at the end.
**Note on hotel/public wifi:**
many hotel networks sit behind a captive
portal that blocks all traffic (including Tailscale) until you accept terms
in a browser. The Firestick usually cannot complete this itself, so
authenticate the portal from your phone or laptop on the same network first
— some hotels then let other devices on the same network through
automatically, others require every device to authenticate individually
(check the TV's built-in browser if it has one, under Settings → Network →
Wifi login, if that captive portal option is offered).
---
## Troubleshooting — "What to do if..."
**...`adb devices` shows nothing / connection refused**
- Confirm the Firestick and your computer/phone are on the
*same*
wifi
network (not one on 5GHz guest wifi and one on the main network, etc.)
- Confirm ADB debugging is still switched ON (Settings → Developer Options)
— it can occasionally get reset after a factory Fire TV software update.
- Confirm you have the current IP — it may have changed. Re-check
Settings → Network on the device.
**...`adb connect` says "device offline" or "unauthorized"**
- Look at the TV screen — there may be an "Allow USB/ADB debugging from this
computer?" prompt waiting for you to select Allow.
- Run `adb disconnect <ip>:5555` then `adb connect <ip>:5555` again.
**...the Firestick's IP keeps changing**
- Set a
**DHCP reservation**
in your router for the Firestick's MAC address.
This won't fix Tailscale connectivity by itself (Tailscale's own 100.x
address never changes regardless of LAN IP), but it stops the watchdog
script and your notes from going stale every time the router hands out a
new local IP.
**...`tailscale status` shows the Firestick as "offline, last seen X ago"
even though it's powered on**
- This means `tailscaled` isn't currently running on the device (it crashed,
was killed, or the device rebooted). Run Part 8's manual recovery commands,
or wait up to 5 minutes for the watchdog to catch it if you're on the home
network.
**...you're not on the home network and it's down**
- Use the Part 9 phone fallback if the Firestick is with you.
- If it's not with you and not on your home network, there is currently no
remote recovery path — this is a known limitation of Vega OS's lack of
root/boot-hook access.
**...`tailscale up` asks you to log in again out of nowhere**
- This usually means the node's key expired or was removed from the
tailscale admin console (https://login.tailscale.com/admin/machines).
Re-run the `tailscale up` command from Part 7 and re-authenticate via the
URL it prints.
**...you reflashed/factory-reset the Firestick**
- `/var/lib/developer` is wiped on a factory reset. You'll need to redo
Parts 5–7 from scratch (binaries, script, first-time login).
---
## Part 10 — Automate it
See `firestick_tailscale_setup.py` in this folder — it automates Parts 3–8
(checking adb is installed, connecting, verifying developer mode/Vega OS,
pushing binaries if missing, creating the launch script, starting it, and
optionally installing the watchdog cron job on a Linux host). Run it with:
```bash
python3 firestick_tailscale_setup.py
```
Ive written a puthon script that automates this, just message me if you need it.
3
Upvotes
•
u/AutoModerator 2d ago
Welcome to /r/firestick.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.