Key Takeaways

• Proxy modes (SOCKS5 on port 1055, HTTP on port 1056) let KOReader reach other tailnet devices like Calibre-Web and Wallabag servers.
• Full TUN mode is available on certain Kindle models (PW5/PW6) through custom kernel modules, enabling device-level routing.
• Tailscale SSH is enabled by default in latest community builds, removing need for USBnetworking and its weak default credentials.
• The KOReader-specific Tailscale plugin also supports Kobo and PocketBook devices.

The Proxy Breakthrough: SOCKS5 and HTTP Modes Arrive on Kindle

When the original Tailscale KUAL plugin shipped in late 2025, it solved one problem well: getting your Kindle onto your tailnet. You could SSH in from anywhere, send files via Taildrop, and see that satisfying green dot in the admin console. But the Kindle could not reach other devices on your tailnet. If you wanted KOReader to fetch books from a Calibre-Web server at 100.x.y.z, the connection dropped before it left the Kindle’s network stack.

The reason is architectural. Tailscale on a jailbroken Kindle runs in userspace mode by default, meaning it cannot install kernel-level network routes. The Kindle’s OS does not know how to route 100.x.y.z traffic through Tailscale’s virtual interface. Apps that try to reach another tailnet IP get a network timeout.

The June 2026 update from community developer greywolf1499 changes this entirely. The KUAL plugin now offers three modes: Standard (userspace), Proxy Mode (SOCKS5/HTTP), and Kernel TUN (if supported). Proxy mode is the most broadly useful option because it requires no kernel modifications and works on any jailbroken Kindle model.

In proxy mode, tailscaled listens on two local ports: 127.0.0.1:1055 for SOCKS5 and 127.0.0.1:1056 for HTTP CONNECT. When KOReader or another app sends a request to one of these addresses, the daemon routes it through the Tailscale mesh network to the destination device. The Kindle itself never needs to know how to route 100.x.y.z traffic. It only needs to know how to reach 127.0.0.1.

How to Configure Proxy Mode for KOReader

Getting proxy mode running requires updating your existing Tailscale KUAL installation.

The process breaks down into a few steps:

Update the KUAL plugin. Download the latest release of tailscale_kual and copy the extensions/tailscale folder to your Kindle’s /mnt/us/extensions/ directory. This replaces the old plugin files with the version that includes proxy mode support.

Select proxy mode in KUAL. Open KUAL on your Kindle, tap Tailscale, and you will see three mode options. Select “Proxy Mode (SOCKS5/HTTP).” Start tailscaled first, wait about 10 seconds, then start Tailscale. The plugin will display a confirmation message: “Tailscaled started OK (proxy: localhost:1055).”

Configure KOReader’s proxy settings. Open KOReader. Navigate to Tools > Network > Proxy. Set the proxy type to SOCKS5, host to 127.0.0.1, and port to 1055. If your app prefers HTTP CONNECT, use port 1056 instead. Save the settings.

Point KOReader at your tailnet server. In KOReader’s Calibre or OPDS plugin settings, enter the Tailscale IP address of your server (e.g., 100.x.y.z). When KOReader makes a connection, it routes through the local proxy, which sends traffic over Tailscale’s encrypted tunnel to your server.

The same pattern works for Wallabag, Audiobookshelf, or any other self-hosted service on your tailnet. As long as the app supports proxy configuration, it can reach any device in your mesh network.

Full TUN Mode: When Your Kindle Becomes a Real VPN Client

Proxy mode works well for individual apps that support proxy configuration. But full TUN mode lets every app on your Kindle have tailnet access without per-app settings.

TUN mode installs a virtual network interface at the kernel level. When active, the Kindle’s operating system routes all traffic through Tailscale, just like a traditional VPN client. Every app, from the built-in browser to kterm to KOReader, can reach tailnet IPs without any proxy configuration.

The catch is that TUN mode requires kernel support, and Amazon does not ship the tun kernel module in standard Kindle firmware. Community developers have created custom kernel patches for specific models, primarily the Kindle Paperwhite 5th and 6th generations (PW5/PW6). These patches add the tun module to the kernel, allowing tailscaled to create a TUN interface.

Installing a custom kernel is significantly more involved than updating a KUAL plugin. It requires flashing a modified kernel image, which carries a higher risk of bricking the device. The Kindle Modding Wiki provides model-specific instructions, and you should verify that your firmware version and hardware revision are supported before attempting the process.

When it works, the result is smooth. Your Kindle gets a Tailscale IP address, routes all traffic through the mesh, and can be reached from any other tailnet device without port forwarding or proxy configuration. It behaves exactly like a laptop or phone running Tailscale in full VPN mode.

Tailscale SSH: No More Default Passwords

One of the quietest but most practical improvements in the latest Tailscale KUAL builds is Tailscale SSH enabled by default. The old workflow for SSH access to a jailbroken Kindle involved USBNetworking, which exposes a telnet or SSH server with well-known default credentials. Anyone on your local network could potentially connect.

Tailscale SSH replaces that entirely. It uses Tailscale’s node authentication to verify connections. No passwords. No open ports on the local network. You SSH into your Kindle using its Tailscale IP address or MagicDNS name (ssh root@kindle), and Tailscale handles authentication against your tailnet’s access controls.

The practical benefit is that you can manage your Kindle’s files, install new KUAL extensions, edit configuration files, and run scripts from anywhere with an internet connection. No USB cable required. No need to remember whether you set the root password to mario or kindle.

To use Tailscale SSH, you need to enable it in your Tailscale admin console. Navigate to the Access Controls page and ensure SSH is allowed for your Kindle node. The default policy typically permits SSH between devices in the same tailnet. Once enabled, any device on your tailnet can connect with ssh [email protected].

What You Can Actually Do With a Proxied Kindle

The combination of proxy mode, Tailscale SSH, and Taildrop opens up use cases that go far beyond “reading books.” Here is what becomes possible:

Self-hosted library access. Run Calibre-Web on a home server or NAS. Configure KOReader’s Calibre plugin with your server’s Tailscale IP and the proxy settings above. Your Kindle can browse, download, and sync books from your library from anywhere in the world, with no port forwarding, no public IP, and no cloud service.

Article syncing with Wallabag. Run a Wallabag server on your tailnet. KOReader’s RSS and article-fetching plugins can pull saved articles through the proxy. Read later becomes read anywhere, synced across devices via your own infrastructure.

Audiobookshelf streaming. KOReader supports Audiobookshelf connections. With proxy mode, you can stream audiobooks from your home server to your Kindle. The Kindle’s audio output is limited (Bluetooth or speaker), but for spoken-word content, it works.

Cross-device reading progress. Use Readest or KOReader’s built-in sync to track reading position across your phone, tablet, and Kindle. The proxy connection ensures sync data flows through your tailnet rather than a third-party cloud.

RSS feeds from self-hosted readers. Point KOReader’s RSS reader at a self-hosted feed server like Miniflux or FreshRSS on your tailnet. Your Kindle becomes a distraction-free RSS consumption device.

Remote SSH into other devices. Pair a Bluetooth keyboard with your Kindle, install kterm, and use it as a thin client to SSH into other tailnet devices. For most tasks a laptop is better, but if you need to restart a server and your laptop is across town, a Kindle with a keyboard and Tailscale connection works.

Taildrop for instant document delivery. This remains the most immediately useful feature. Buy a DRM-free EPUB on your phone, open the share menu, select Tailscale, and pick your Kindle. The file lands in /mnt/us/documents/ ready for KOReader to pick up. No USB cable, no email-to-Kindle, no Amazon cloud.

The KOReader-Only Tailscale Plugin for Kobo and PocketBook

If you do not need full tailnet access for your Kindle and only want KOReader to reach other devices, there is a lighter-weight option. Developer Victoria Riley Barnett created the Tailscale KOReader plugin that runs entirely within KOReader. It does not make your Kindle accessible from the tailnet, but it creates the proxy interfaces KOReader needs to reach content servers.

This plugin has been tested on the Kindle PW5, PW6, Kobo devices, and PocketBook readers. Installation is straightforward: copy the plugin into KOReader’s plugins directory, trigger “Install/Update Tailscale” from KOReader’s menu, paste in a Tailscale auth key, and toggle Tailscale on. The plugin creates the same 127.0.0.1:1055 and :1056 proxy endpoints within KOReader’s process space.

The plugin works especially well with the SyncThing plugin for KOReader, enabling file synchronization across multiple e-readers without any cloud dependency. If you run a fleet of KOReader devices across your household, this combination replaces most commercial e-book sync services.

One limitation: the plugin is KOReader-only. If you want to use the Kindle’s built-in browser to access a tailnet dashboard, or if you want other KUAL extensions to reach tailnet devices, you need the full KUAL-based Tailscale plugin with proxy mode enabled.

FAQ: Tailscale on a Jailbroken Kindle

Will Tailscale drain my Kindle battery faster? Yes, but the impact is modest. Tailscale’s WireGuard implementation is lightweight. If you are not actively using remote features, stop tailscaled from the KUAL menu.

Can I use Tailscale and still read books from Amazon? Yes. Jailbreaking does not remove Amazon’s reading software. You can switch between KOReader and the stock Kindle reader. Tailscale runs in the background regardless of which reading app you use.

Does proxy mode work with the Kindle’s built-in browser? The built-in browser does not support SOCKS5 proxy configuration. If you need the browser to reach tailnet addresses, you need full TUN mode on a supported model.

What happens if my Kindle updates its firmware? A firmware update will remove the jailbreak and all KUAL extensions, including Tailscale. You must disable over-the-air updates after jailbreaking. The Kindle Modding Wiki provides instructions for blocking OTA updates.

Can I run Tailscale on a non-jailbroken Kindle? No. Tailscale requires root access to run tailscaled and create network interfaces. Amazon’s locked-down firmware prevents this.

Is the KOReader-only plugin safer than the KUAL plugin? The KOReader plugin runs within KOReader’s sandboxed process, which may reduce the risk of system-level instability. However, both plugins are community-developed and carry the same fundamental warning: you are running unofficial software on a device Amazon designed to be closed.

Related Reading

More in-depth coverage from this blog on closely related topics:

• How GrapheneOS Funds Its Future
• Datto Ransomware Attack Surface Management
• Hyperscaler Capex in 2026: Market Impact
• Opus 5: Next-Gen AI Coding Benchmarks
• Reinforcement Learning Fine-Tunes Open

Sources and References

Sources cited while researching and writing this article:

• greywolf1499
• How to put Tailscale on a jailbroken Kindle (and why you should)
• Mitanshu’s GitHub repo
• Tailscale KOReader plugin
• SyncThing plugin for KOReader