Runbook: macOS Workstation Onboarding (NAS + Printer) via Tailscale

Client: Mahaffey law firm Maintained by: Triaxis Technical Solutions Platform: macOS (Windows version to be written when needed) Last validated: September 2026

When to Use This Runbook

Use this when a new or replacement Mac needs to be connected to the office NAS and printer, and the machine is not physically at the office, such as when you're prepping it at home.

The method temporarily joins the Mac to the Triaxis tailnet (the one mahaffeynas is on) so it can reach office devices by their LAN IPs through the NAS's subnet route. Everything is configured against LAN IPs, not Tailscale IPs or MagicDNS names, so the same settings keep working once the Mac is on the office network and Tailscale has been removed.

If the Mac is onsite at the office, skip Phase 2 (Tailscale) and Phase 6 (cleanup) entirely. Phases 1, 3, 4, and 5 work the same way directly on the LAN.

Environment Reference

How It Works

New Mac (at home, 192.168.2.x)
   |
   |  Tailscale (accept-routes on)
   v
mahaffeynas (subnet router, advertises 192.168.1.0/24)
   |
   v
Office LAN: NAS 192.168.1.11, printer 192.168.1.113

The Mac sends anything bound for 192.168.1.0/24 through the tunnel to the NAS, which forwards it onto the office LAN.

Prerequisites

• [ ] DSM admin credentials for mahaffeynas
• [ ] Konica Minolta administrator password
• [ ] New employee's name, email address, and intended NAS permissions (match a peer's)
• [ ] Your own Mac on the tailnet
• [ ] The new Mac's local network must NOT be 192.168.1.0/24. If it is, the local LAN wins and nothing reaches the office. Home LAN 192.168.2.0/24 is fine. Don't use the AT&T gateway's own Wi-Fi if it hands out 192.168.1.x.

Phase 1: Admin Prep From Your Own Mac

These steps don't touch the new Mac and can be done anytime.

1.1 Enable subnet routes on your Mac

Tailscale menu bar icon > check Use Tailscale subnets, or use the CLI:

On your Mac (Terminal):

TS=/Applications/Tailscale.app/Contents/MacOS/Tailscale
$TS set --accept-routes=true
nc -vz -G 5 192.168.1.11 5001

While this is on, your Mac can't reach the AT&T gateway admin page at 192.168.1.254, because that traffic goes to the office. Turn it off when finished (see Phase 6.3).

1.2 Create the user in DSM

1. Browse to https://192.168.1.11:5001 and log in as an admin.
2. Control Panel > User & Group > Create.
3. Give the user the same shared folder permissions as a peer in the same role.
4. If staff have individual scan folders on the NAS, create one for the new user now so the printer's scan destination has somewhere to point.

1.3 Add the user to the printer address book

1. Browse to http://192.168.1.113 and log in in Administrator mode.
2. Go to Store Address > Address Book.
3. Open an existing employee's entries first and copy their pattern:
4. Naming and index/abbreviation convention, so the new entry sorts correctly on the panel
5. For SMB entries: whether the host is an IP or a hostname, how the file path is formatted, and whether it uses a shared scan account or per-user credentials
6. New Registration > E-mail: add the new user's email address.
7. New Registration > SMB (only if peers have one): copy a peer's SMB entry exactly, changing only the name and folder path.

Scan-to-email and scan-to-SMB can't be tested remotely. Have the user send one test scan of each type on their first day.

Phase 2: Temporarily Join the New Mac to the Tailnet

2.1 Generate an ephemeral auth key

Tailscale admin console > Settings > Keys > Generate auth key:

An ephemeral node deletes itself from the tailnet when it logs out, so cleanup is nearly automatic.

Exposure note: The tailnet uses the default allow-all ACL and also carries your homelab and personal devices. While the new Mac is joined, it can reach all of them, not just the office subnet. Keep the window short and finish Phase 6 the same night.

2.2 Install and connect Tailscale

1. Install Tailscale (App Store or standalone package; either works).
2. Launch it once and approve the macOS VPN configuration prompt. Don't sign in through the GUI.
3. Connect with the key:

On the new Mac (Terminal):

TS=/Applications/Tailscale.app/Contents/MacOS/Tailscale
$TS up --auth-key=tskey-auth-REPLACE_ME --accept-routes --hostname=newhire-setup

The App Store version doesn't put the tailscale CLI in your PATH, so always use the full path.

2.3 Verify routing and reachability

On the new Mac (Terminal):

route -n get 192.168.1.11 | grep interface
nc -vz -G 5 192.168.1.11 445
nc -vz -G 5 192.168.1.113 631

Expected results:

• route shows a utunN interface, not en0. If you see en0, a local network is claiming 192.168.1.0/24 (see Troubleshooting).
• Port 445 (SMB) on the NAS: succeeded
• Port 631 (IPP) on the printer: succeeded

Use nc rather than ping. ICMP through the Synology subnet router can be unreliable even when TCP works.

2.4 Lower the MTU (only if something stalls)

The office WAN has a known large-packet blackhole. Small pings and connection checks succeed, but bigger transfers hang silently. If mounting the share, adding the printer, or loading the printer web UI hangs, lower the MTU on the Tailscale interface. Use the utunN name from step 2.3.

On the new Mac (Terminal):

sudo ifconfig utunN mtu 1180

This isn't persistent. It resets when Tailscale disconnects, which is fine for a one-time setup.

Phase 3: Map the NAS Share

3.1 Connect

1. In Finder, press Cmd+K.
2. Server address: smb://192.168.1.11/Shared
3. Click + to save it as a favorite server.
4. Click Connect and sign in as the new user's DSM account. Don't use an admin account.
5. Check Remember this password in my keychain.

Use the LAN IP. Don't use the Tailscale IP or the MagicDNS name, which resolve to Tailscale addresses and will break once Tailscale is removed.

3.2 Auto-mount at login

1. With the share mounted, open System Settings > General > Login Items & Extensions.
2. Under Open at Login, click +.
3. Select the mounted volume under Locations and click Open.

Repeat Phase 3 for any additional shares.

Phase 4: Add the Printer

1. System Settings > Printers & Scanners > Add Printer, Scanner, or Fax.
2. Select the IP tab (globe icon).
3. Address: 192.168.1.113
4. Protocol: Internet Printing Protocol - IPP
5. Wait for the Mac to query the printer:
6. If Use fills in AirPrint or the bizhub model, accept it. No driver needed.
7. If it falls back to Generic PostScript, or the office needs stapling, finishing, or department codes, install the Konica Minolta macOS driver for the exact model, then select it under Use.
8. Name: the same display name the rest of the office uses.
9. Click Add.

Printer discovery (Bonjour/AirPrint browsing) doesn't work across Tailscale. Always add the printer by IP.

A test print works remotely, but it will sit in the office output tray. Skip it, or give someone onsite a heads-up.

Phase 5: Other Software

• RustDesk
• __________
• __________

Phase 6: Cleanup (Required)

Don't skip this. If Tailscale stays on the new Mac with subnets enabled, it will cause subnet route recursion on the office LAN: traffic to local devices goes through the tunnel instead of the switch, causing intermittent failures and corruption. This is the same problem fixed on mahaffeyfamlaw.

6.1 Remove Tailscale from the new Mac

On the new Mac (Terminal):

TS=/Applications/Tailscale.app/Contents/MacOS/Tailscale
$TS logout

Then:

1. Quit Tailscale from the menu bar.
2. Delete Tailscale from Applications.
3. System Settings > VPN: remove any leftover Tailscale entry.

6.2 Verify in the admin console

• [ ] The newhire-setup node no longer appears under Machines
• [ ] Settings > Keys: the auth key shows as used or expired (revoke it if not)

6.3 Revert your own Mac

Tailscale menu bar icon > uncheck Use Tailscale subnets, or:

On your Mac (Terminal):

TS=/Applications/Tailscale.app/Contents/MacOS/Tailscale
$TS set --accept-routes=false
route -n get 192.168.1.254 | grep interface

The route should show your physical interface (en0 or similar), not utunN. Your AT&T gateway at 192.168.1.254 should be reachable again.

Day-One Verification (User Onsite)

• [ ] NAS share mounts automatically at login
• [ ] Test print succeeds
• [ ] Test scan-to-email arrives
• [ ] Test scan-to-SMB lands in the right folder (if applicable)
• [ ] Tailscale is not installed on the Mac
• [ ] RustDesk connects

Troubleshooting