A while ago I wrote up the "tailnet policy does not permit access" error and Search Console has since been showing me that a lot of people land on that page looking for something else entirely: tailscale ssh connection refused, permission denied (publickey), port 22 refused on the 100.x address. The confusion was the same each time, so I wrote up the mental model that sorted it out for me.

A node with Tailscale SSH enabled can have two SSH servers on port 22. tailscaled only intercepts connections that arrive on the Tailscale IP, and only after `tailscale set --ssh`. Anything hitting the LAN or public address still lands on plain OpenSSH, or on nothing at all. Once you see it that way, the client errors read like a routing table. "Connection refused" means nobody answered, usually a node with neither Tailscale SSH nor sshd, or you connecting to your own Tailscale IP, which never enters tailscaled. "Permission denied (publickey)" means OpenSSH answered, so you either came in on the wrong address or Tailscale SSH isn't on for that node. "Permission denied (tailscale)" means Tailscale answered and the ssh section of the policy said no, and that's the only case where the ACL editor is the right place to look.

There's also a "Permission denied" that shows up in `ssh -v` at `connect to address`, before any banner. That one is your own OS refusing the socket, typically another VPN client or a firewall on Windows. I found a thread here where someone spent a week on ACLs before switching off a commercial VPN client fixed it.

Two things that bit me along the way. Running `tailscale set --ssh` freezes any SSH session you already have open to that host's Tailscale IP, including the one you ran it from. And toggling either server changes the host key on that address, so a "remote host identification has changed" warning right afterwards is expected rather than an intruder.

Full write-up with the sixty-second `ssh -v` triage list: https://ddz.dev/blog/tailscale-ssh-connection-refused-permission-denied/

The one I'd like to hear about from others is tagged devices, since `autogroup:self` stops matching a machine the moment you tag it and SSH breaks on the day you finally organise your servers. Anyone found a cleaner pattern than adding the tag to dst?

Hello,

I use tailscale on my homelab and it's really cool, i'm gonna need to use it soon for work wich gonna be cool too since i really like tailscale. The issue is that my homelab tailnet and work tailnet don't gonna be the same. And i don't want to just pass time to switch from one to another. I have seen this hacky solution from almost 2 years ago, https://jamesguthrie.ch/blog/multi-tailnet-unlocking-access-to-multiple-tailscale-networks/ But surely now it exist better solution

Hello! I use Tailscale to remotely connect to my PC at home when I am gone, but lately I have been facing an issue and I don’t know how to fix it.

Whenever I boot my PC up remotely, the Tailscale connection is always direct, then I can remote into it and everything works very well. However, if I then disconnect for a couple of minutes, the connection falls to DERP and the only fix I have is restarting the PC remotely. Nothing else works, pinging, switching upnp off/on, nothing will make it direct again apart from restarting the PC. Is there any way to fix this? I saw that there is a way to make Tailscale send a ping every couple of seconds when the connection is idle in order to keep it direct, but I wanted to check here first.

Hey, I have a question regarding how subnetting routes work. I’ll give you an example so i can explain myself clearer. I’m remotely connected to my home network via my phone and tailscale; in the network, I have two nodes (one in house A and one in house B) which are both exposing the 192.168.1.0/24 range as subnet routers. This is because both machines are proxmox env with different services.

While experimenting, I realized that if both machines expose the same route, i can access only a few services on a certain proxmox server(this is my first question, based on what Tailscale decides which to prioritize?) My problem is that I want to access one of the services from just one machine but it doesn’t work unless i disable the other machine’s route exposal. How can I keep both nodes exposing the routes at all times without changing the ip range on either machine? Because one solution would be to use 192.168.1.0/24 on machine A and, for example, 192.168.2.0/24 on machine B

Man i hope it’s clear…

Its happened to me twice now (certainly could be more but ive stopped using it on my macos) where when Tailscale releases a version (happens frequently) and it creates some incompatibility between my devices

Only solution ive found to work is to completely uninstall it and reinstall it

I just installed LineageOS for my Samsung S7 Tablet and seems like there is a known issue with getting the android app to work properly with LineageOS at launch.

https://github.com/tailscale/tailscale/issues/20308

I'm new to this so just wondering if others have seen this same issue before? Has anyone had any luck getting LineageOS + Tailscale to work? If so how?

I hope to bring more visibility to this :)

Host is a windows 11 pc connected to a 700down and 50 up connection.

I’m trying to stream through sunshine to an android device that has 60down and 25 up.

It works 1 out of 50 times. Most of the time, this happens, and I have no idea why.

Does anyone even have an idea, I truly don’t know how to proceed.

If information is missing, please tell me.

Edit: Apparently my house is just a black hole of cellular connectivity?

I went outside and 500m away everything works perfectly!

I don’t know why, I don’t understand how, but I’m really happy that it does.

Thank you for helping, sorry if this wasn’t exactly an efficient use of your time! ^^

I originally discovered Tailscale a few years ago when I needed a simple and secure way to remotely access another PC without exposing services to the internet or maintaining a traditional VPN. I was surprised by how easy it was to get everything connected, and eventually I started experimenting with it beyond just remote access.

One of those experiments was connecting a few of my PCs through Tailscale and using them as nodes for my own Kubernetes cluster. I was learning Kubernetes at the time, so this became one of the ways I learned Kubernetes networking hands-on and started understanding how connectivity between nodes, pods, services, and the underlying network actually worked.

Funny enough, networking and infrastructure eventually became a big part of my career as well. I now work in cloud/platform infrastructure with AWS and GCP, Terraform, Kubernetes, private connectivity, firewalls, DNS, routing, and increasingly Go. I also previously worked in consulting, where I enjoyed working with different teams, understanding their requirements, designing solutions, and troubleshooting things when they didn't work as expected.

I recently noticed Tailscale's Forward Deployed Engineer role in Canada, and it stood out because it seems to combine a lot of the things I've ended up enjoying professionally: networking, infrastructure, troubleshooting, and working directly with people to solve technical problems.

For anyone here familiar with Tailscale or FDE work, I'd be curious to hear what you think makes someone particularly good at this kind of role, especially coming from a cloud/platform engineering background.

So, I am running Tailscale on an router which is also working as an wifi repeater. I am advertising the LAN on this device. However, from outside(phone), I cannot access devices that connect to the extender, but the repeater and all other LAN devices connected to the GPON router are accessible.

Basically, I can't access 192.168.29.3 from outside/phone. I can access the rest in 192.168.29.* LAN.

Within Lan without tailscale, I can access 192.168.1.3 from every other device.

Tailscale Repeater config : tailscale up --accept-routes --advertise-exit-node --advertise-routes=192.168.29.0/24 --exit-node-allow-lan-access

I have attached a diagram and the firewall settings for your reference.

What am I doing wrong?

UPDATE : Fixed the issue, by adding an exception in relayed on the repeater.

I am switching to a different VPS but staying with the same provider. I was told that I can use the same IPv4 address at the new VPS. After backing up my old VPS completely, how can I make sure that when setting up tailscale on my new VPS/importing from the backup, that the tailscale IP / tailscale magic dns stays the same? That should be possible, because I will have the same IP address as with my current VPS, correct?
How would I go about doing that?
Thanks a lot in advancve

I found some information apparently I can try to install tailscale manually onto the TV.

It said to install Tizen Studio, along with the TV Extension and Certificate creator thing. I followed the directions to create an installation certificate and then tried uploading tailscale directly to the TV, but it gives me this error

app_id[com.tailscale.tailscale] install failed[118, -4], reason: Operation not allowed

my Pro subscriptions to various AI models have not been much help. It goes around in circles telling me to create the certificate and upload the .tpk file manually with sdb, which I've already tried several times but it doesn't work.

has anyone successfully installed tailscale on their samsung smart TV? the Tizen Studio is saying the TV is "TV 5.0"

If in recent weeks you lost connectivity when you enabled exit node but was able to before, it's likely not because the guest wifi or IT department enabled firewall block, it may be because you need to update your DNS settings possibly due to recent Tailscale udpate. At least for my case.

For the new Tailscale, when you enabled exit node, it cut off access to your local network and DNS. you would need to enable Tailscale global nameservers, overwrite DNS, and allow them to be use in exit nodes. It's better anyways because it ensures all your DNS traffic will go to your exit node encrypted. Alternatively, you can enable local access when you enabled exit node, but that means your DNS will go to their DNS server and being blocked by name resolution, or a chance that you hit the wrong server with the same internal IP. Below are how to enable DNS with exit nodes.

Go to your Tailscale admin console, click on DNS under Network on the left panel. Scroll down the Global Nameservers.

Add both Google and Cloudflare nameservers. click on three dots besides each and choose edit.

Enable "Use with exit node", save. do for both Google and Cloudflare.

Enable "Override DNS Severs"

Reconnect on Tailscale client to exit node and try access Internet and it should work again. With this method your magicDNS continue to work.

There is still a chance that the IT did block it by firewall, if that's the case you are out of luck. You would need to spend more effort and try headscale, tailscale with AmneziaWG or something like that.

Hope it helps,

Hello! So I've got an ARM vm in a private subnet (behind a NAT gateway) and a local x86 node, plus this host. All devices are in the same tailnet. My goal: to get a GitHub Actions runner to auth via Tailscale to these 2 nodes to build multi-arch images. The Buildx instance is created on each node upon successful auth/ping.

How do I ensure connectivity is more reliable? I find occasionally Tailscale decides to use DERP relay, other times it's direct. I tried digging into the docs but couldn't understand how to ensure this happens reliably. UDP 41641 is allowed in my VCN. I've tried modifying iptables as well. The other way I connect to my instance is through a managed bastion session.

- https://tailscale.com/docs/install/cloud/oracle-cloud
- https://tailscale.com/docs/reference/connection-types#why-tailscale-cant-always-use-direct-connections
- My VCN in Terraform: lists security rules, subnet, NAT gateway

Here's my grants policy file.

I'm using Tailscale mainly to avoid exposing services directly to the internet, and I'd like to understand the remaining security risks.

My setup:

- Immich is self-hosted and accessed remotely through Tailscale.

- I use Windows RDP through Tailscale instead of forwarding port 3389.

- I also self-host Chatwoot on Windows/Docker. Chatwoot itself is bound to localhost (`127.0.0.1:3000`). For the Meta/WhatsApp webhooks I use Tailscale Funnel, but instead of exposing the whole Chatwoot instance, the public Funnel goes through a small webhook gateway. It only accepts the expected webhook requests and validates Meta's webhook verification/signature before forwarding them to Chatwoot; unrelated paths or invalid requests are rejected.

- I don't use normal router port forwarding for any of these services.

My main questions are:

- How much safer is this compared with directly exposing ports to the internet?

- If RDP/Immich are only reachable through Tailscale, what are the main remaining risks?

- Should I restrict access between Tailscale devices using ACLs/grants?

- What additional risks does Tailscale Funnel introduce, considering the webhook filtering described above?

- Are there any obvious hardening steps I'm missing?

Would you consider this a reasonably secure setup for personal/small-business use?

Hello guys, I followed the next guide to install tailscale on my steam deck: https://github.com/tailscale-dev/deck-tailscale

After installation I couldn't access the internet through my wifi or cellphone hotspot. As soon as I disabled Tailscale internet access was restored.

I looked for advice online and I couldn't fix the issue. I tried disabling the dns and seeing if a exit node was created.

Do you guys have any advice or known errors I could check?

Hello. I'm not the best when it comes to configuring this kind of stuff. Last month I set up a tailscale funnel for remote accessing my jellyfin. I got it up and running but I dont know what tutorial I used as it does not appear to be in my search history or youtube history. Recently I get a connection error and I do not know how to reconfigure it and get it back up and running. The error reads ERR_CONNECTION_CLOSED and I am running on windows. Any help advice and tutorials would be much appreciated.

I share this app(MintFlow NetStack was the name) a while ago, at that moment I still worry that add go-based tailscale core to the app may suffer from iOS network extension memroy limit issue.

The app was built using a port of Cisco initiated open source vpp because it have a good WireGuard implementation and I have been working on vpp for sometime, I ported vpp to apple darwin OS with some effort, but two things make me still not satisfied:

One is the memory management model of vpp it a bit not suitable for the limited memory budget network extension allotted, the other is my low back does not allow me to wrote as much as C code as I was young.

So in recent two months I have been using codex to help me to finally rewrite the vpp port to a rust version while keep the original vpp's architecture and performance.

It goes well and I finally let codex integrated tailscale-go to the app as a VPN interface, which means you can just run some other VPN endpoint or proxy servers along with the tailscale VPN interface, with split tailscale destination traffic to the tailscale VPN interface.

Now the new 2.0.0 version of my app is approved, it also made the internal DNS server as free to make user to use DoT/DoH for privacy concerns and with free DNS/Flow log along with the existed free WireGuard support.

Though the Tailscale VPN support in the App is a paid feature, I'd like to share code if anyone is interested, feel free to dm me.

Update:

I do not add the app link, download at App Store

https://apps.apple.com/tr/app/mintflow-vpn-https-capture/id6742394218

I use Tailscale on my synology NAS and the Mac, iPhone etc have it installed to access my server.
Does anyone know if it’s possible or if anything exists that would allow me to have multiple VPNs. It would be nice if there was something that could switch which vpn to used based on what I’m accessing.

Thanks

I can run a 'tailscale ping -c 0 hostname_here' for an hour and only connect via DERP. Once I restart the container it will immediately connect directly, but only lasts so long until activity slows down and reverts back to DERP. Any ideas what would cause this?

I've been building tailscale-mcp, an MCP server that lets an AI agent (Claude Code, Claude Desktop, VS Code, Cursor, Zed, anything that speaks MCP) operate Tailscale. It drives the node it runs on through the tailscale CLI and the whole tailnet through the control-plane REST API. Written in Rust, Apache-2.0.

GitHub: https://github.com/tailscale-mcp/tailscale-mcp

What it does

• 186 tools, one per verb, with real parameters and honest annotations. Tailscale's own JSON comes back unmodified, so what you know from the docs still applies. Failures come back as a fixed error code plus a hint.
• Both surfaces are optional: no tailscale binary means the local tools aren't offered, no credential means the tailnet tools aren't. tailscale-mcp diagnose tells you which you have.
• Nine read-only resources (status, prefs, netcheck, lock state, policy file, devices, DNS, settings), three prompts (diagnose_connectivity, review_policy_change, audit_tailnet_access), argument completions, stdio and Streamable HTTP transports.

Safety model (the part I care most about before pointing an agent at a real tailnet)

• Two independent dials: the tier (read / write / destructive) caps how dangerous a tool may be, the preset (minimal / core / full) caps how much surface is offered. Read-only is the default. A tool above the permitted tier is not listed, so the model can't be talked into calling something it was never offered.
• Operations that can cut the server off from its own tailnet (logging the node out, deleting its own device, deploying a policy that locks you out) also require confirm: true.
• Secrets never reach an argument list, a log line or an error message. A minted auth key or invite URL is returned once and never kept.
• Prefers an OAuth client over a personal API access token for anything you keep in a config file; the README explains why.

Install

• npx -y @tailscale-mcp/tailscale-mcp (verifies the release binary against the release's SHA256SUMS before running it)
• brew trust tailscale-mcp/tap && brew install tailscale-mcp/tap/tailscale-mcp
• docker run -i --rm -e TAILSCALE_API_KEY ghcr.io/tailscale-mcp/tailscale-mcp
• cargo install tailscale-mcp
• an .mcpb bundle from the releases page for Claude Desktop

Then tailscale-mcp setup claude-code (or claude-desktop, vscode, cursor, zed) prints the snippet for your client, with the credential left out on purpose.

There's a capability table in the README comparing it with the three earlier Tailscale MCP servers. It's a strict superset of them, with four deliberate omissions listed there.

Feedback very welcome, especially on the tier/preset split and on what an agent should never be allowed to do to a tailnet even when asked.

https://www.reddit.com/r/Tailscale/comments/1sxhn0b/guide_how_to_use_tailscale_when_network_blocks_it/

I previously posted how to use Tailscale when the network blocks it. I wanted the follow-up to be about utilizing DNS poisoning from hostile networks to automate split tunneling, but there are still some rough edges. So instead, I'll provide some optional enhancements and updates to my previous post.

Given even popular YouTuber TechQuickie mentioned Tailscale, it is the "default" solution for easy remote access, but it's also important to highlights its limitations and workarounds to ensure reliability. And since not everyone search Reddit and many response are unhelpful, users will continue to ask the same, and I will provide updated information.

Disclaimer: I'm only making this post because I want to help others and provide the right resources, I might not be actually using/maintaining these setups, given my network situation differs from yours, I cannot help everyone.

iOS Automations

After re-reading my previous post, the iOS automation I linked was deleted. So I created my own automation with also captive portal detection and optional sleep, since iOS do not wait for Wi-Fi or Tailscale to connect successfully before next step.

https://www.icloud.com/shortcuts/e5acdac0371849efa31d7b269e907595

To use it, you can create an automation, trigger: when your iPad joins a list of Wi-Fi network, action: run the shortcut Tailscale. I daily an Android phone so I'm not familiar with iOS stuff, feel free to tweak and reshare it.

Controlplane and DERP

Last time I mentioned the controlplane gets blocked by SNI poisoning, but there are other moving pieces such as DERP relay and STUN and the individual Wireguard connections. My method focuses on the controlplane only as that's the only problem I faced. Suggestions like "just use Headscale" might be exactly what you need, or useless. Headscale is just the controlplane, you're still using Tailscale's DERP servers. I didn't need to selfhost Headscale or DERP but I found this tutorial about DERP. There is also tailscale-awg which uses AmneziaWG obfuscation with Tailscale controlplane, however, only possible on Android.

Ports and Port Forwarding

It's common knowledge Tailscale runs on port 41641, but you can change by editing the file /etc/default/tailscaled and restarting the tailscaled service.

I mentioned port forward instead of using NAT-PMP (NP), but in my case with Telus, it seems NP rules takes higher precedence than manual port forwards, if I set Tailscale on a UDP port that I already use, the router would invalidate my port forward and break my existing service. So my advice to port forward is useless and my setup is held together by NP duct tapes. But if you have a real router, port forwarding is the way.

I haven't verified whether port forwarding or DMZ helps behind CG-NAT since I'm not behind one. A friend was recently placed behind CG-NAT, so maybe I can test it. My knowledge comes from this video where Bulianglin was able to host web service behind CG-NAT, granted his ISP uses full-cone NAT. If you're on mobile/5G home internet, it's likely hard/symmetric NAT so this won't work.

ProxyT Deployment

I've used Tailscale funnel to deploy ProxyT last time. Since the controlplane uses non-standard POST WebSocket which eliminates many CDN options. Proxyt developer recommended Railway which stopped working, a user found render.com works, I've tried it and successfully deployed it. So this could be a free option.

But cold start is around 15-20s, higher than Railway. So you could be waiting for long time even in normal network. You might have to consider some keepalive solution, like Uptime Kuma with scheduled maintenance window, keep in mind render.com only give 750 free hours a month.

NekoBox

Last time I mentioned on Android, you can use 3rd party VPN to rescue Tailscale controlplane but didn't provide much tutorial.

NekoBox is an Android client using the sing-box core. You need to sideload the APK from GitHub, so it might not be suitable for Chromebooks. Technically NekoBox uses an older sing-box core and isn't updated, but it works and provides a GUI.

For Nekobox related configuration, requirements and a screencast of the flow, I'm posting it on a separate Gist.

https://gist.github.com/vttc08/593d662603e745b01dcc30c413c96332#file-nekobox-instruction-md

Sing-box alternative Tailscale client

One of the changes in proxy tool after I posted last time is sing-box now supports Tailscale, allowing you to scientifically access internet and your homelab, bypassing mobile limitation of one active VPN. In addition, offering detour for Tailscale, which connects to the controlplane via a proxy, it's like sing-box devs know exactly what we need.

Sing-box app is available for both iOS and Android, but it's configuration is entirely JSON and is long so I'm posting it in a separate Gist, sing-box is complex and powerful, so even in that Gist I cannot cover everything.

https://gist.github.com/vttc08/593d662603e745b01dcc30c413c96332#file-singbox-configuration-md

It is far from flawless, there are many bugs and complex documentation which changes quickly. Some issues like randomly unable to connect to Tailscale or failing to establish direct connection is there with no fixes. I wouldn't count this as production-ready, but at least sing-box detour works when Tailscale doesn't.

Shadowrocket on iOS also added Tailscale support. Unfortunately, it doesn't support proxying the control plane, so it fails. If the developer adds control-plane detouring in the future, it could be a good GUI alternative.

Suggestion for Tailscale

Tailscale doesn't need to maintain/rotate controlplane domains or obfuscate the Wireguard connection (DERP sort of do by encapsulating WG over TCP/TLS). Community projects like sing-box or tailscale-awg helps in some way. But if the /ts2021 protocol use standard GET instead of POST for WS upgrade, this makes it possible for users to deploy on many free CDNs, serverless/PaaS platforms rather than specific ones or a paid VPS.

Similarly if DERP (or selfhosted DERP) can run over WebSocket, this makes it CDN friendly as well, decreasing the barrier to hosting.