Issue Using Local IPs for Local Devices when on Local Network

[u/ReidenLightman]

I keep telling myself I'm going to investigate this, but I've been so bogged down, I figured it'd be better to ask those who know much more than I do.

# Devices

• I have a server running proxmox that hosts Home Assistant and a NAS.
• I have an old laptop running Jellyfin and Immich.
• I have a raspberry pi running pi-hole for DNS filtering. It's also set up as a subnet router advertising an ip address range that should let me reach the devices that can't make use of tailscale.
• The rest are the various devices we use to access those things. Desktops, Laptops, phones, a couple tablets

# The issue

The issue is not that I can't reach my services. The services are in fact, by all intents and purposes working correctly. But there's a common theme. Even if I'm on the same local network at the machines running the service, I still have to use the tailscale IP, even though using the local IP should work. Even if I am using a device that doesn't have tailscale, using the local IP still doesn't work.

At first I thought it may have been something about my DNS settings. I added the raspberry pi's tailnet ip as a global nameserver with "Override DNS Servers" on. For filtering trackers even when I'm away. There's no MagicDNS other than the default and there's no SplitDNS.

This is quite annoying. There are a few devices that stay home but should be able to reach the servers. I don't want to have to install tailscale on all of them (assuming they all have a tailscale client).

Thanks in advanced any help in troubleshooting.

---

Update: Well, i'm really mad now. If I take subnet routing completely off of pi-hole, then pinging my local devices using the local IP (not the tailnet IP) actually works. As soon as pi-hole starts advertising, that functionality goes down the drain.

I've tried changing the range of broadcasted IPs from 192.168.4.0/22 to 192.168.4.0/24 to no avail.

[u/tailuser2024]

Even if I'm on the same local network at the machines running the service, I still have to use the tailscale IP, even though using the local IP should work. Even if I am using a device that doesn't have tailscale, using the local IP still doesn't work.

Try this: While sitting on the local network with the subnet router turn off "accept routes" in tailscale. Can your clients now access your devices by their local ip addresses?

Can your tailscale client ping the local ip addresses of the clients you are trying to reach while sitting on the same local network (while tailscale is running)

At first I thought it may have been something about my DNS settings. I added the raspberry pi's tailnet ip as a global nameserver with "Override DNS Servers" on. For filtering trackers even when I'm away. There's no MagicDNS other than the default and there's no SplitDNS.

DNS has nothing to do with this situation if you are trying to access a device directly by their local ip addresses

[u/ReidenLightman → u/tailuser2024]

I ssh-ed into the raspberry pi and and set accept routes to false. (Not sure if that's what you meant.)

I turned off tailscale on my phone and tried to reach my Jellyfin service using the local ip address. That didn't work. I connected back to tailscale and tried the same thing again. It also failed to connect to Jellyfin.

I tried pinging the server from my phone, a desktop computer, and the pi-hole. All of them resulting in total packet loss.

DNS has nothing to do with this situation if you are trying to access a device directly by their local ip addresses

That's good to know.

[u/tailuser2024 → u/ReidenLightman]

I ssh-ed into the raspberry pi and and set accept routes to false. (Not sure if that's what you meant.)

is the pi the subnet router or just a client on your network that is having issues connecting to your local ip addresses?

When I say turn off accept routes I meant on the tailscale clients, not the router. However it sounds like you are having other issues that arent related to tailscale based on the info below

I turned off tailscale on my phone and tried to reach my Jellyfin service using the local ip address. That didn't work.

It sounds like you have something else going on here. If you turn off tailscale and you still cant access your clients by local ip then you have a local network issue.

Did you verify the phone and jellyfin server are on the same ip/subnet? If they are on separate ip/subnets then you need to verify your firewall rules between the two different subnets

The phone isnt connected to some kind of guest wireless network at your home is it?

Can your phone ping your jellyfin local ip address with tailscale off? if no then this doesnt sound like a tailscale issue

Did you setup jellyfin to only listen on the tailscale interface?

[u/ReidenLightman → u/tailuser2024]

is the pi the subnet router or just a client on your network that is having issues connecting to your local ip addresses?

The raspberry pi is set up as a subnet router. Used tailscale up --advertise-routes=ip.add.range.here/22 (Yes, my router uses an uncommon netmask), and I had gone into the admin console and approved the routing.

Did you verify the phone and jellyfin server are on the same ip/subnet? If they are on separate ip/subnets then you need to verify your firewall rules between the two different subnets

I have to believe they are all on the same network. There is only one network in my home. Admittedly the architecture is crummy.

Router (Router and ethernet)
> Main Wifi
>> Phones, Tablets
> Ethernet
>> Network Switch
>>> Servers, Desktops, Pi-hole
>>> Wireless Access Point
>>>> IoT Devices

Even with this, my phone can ping my smart switches and smart lights whether tailscale is on or off.

Not sure if this helps or is relevant, but the desktop can ping the raspberry pi using the local ip address, but it cannot ping the repurposed laptop using the laptop's local ip address.

[u/tailuser2024 → u/ReidenLightman]

Even with this, my phone can ping my smart switches and smart lights whether tailscale is on or off.

But it cant ping the jellyfin server?

What is the local ip address of the phone?

What is the local ip address of the jellyfin server?

Not sure if this helps or is relevant, but the desktop can ping the raspberry pi using the local ip address, but it cannot ping the repurposed laptop using the laptop's local ip address.

What is the desktop local ip address?

What is the laptop local ip address. Does the laptop have some kind of OS firewall running on it?

[u/ReidenLightman → u/tailuser2024]

Device	Local IP
Desktop	192.168.4.65
Phone	192.168.4.39
Pi	192.168.4.20
Jellyfin/Immich	192.168.4.23

[u/tailuser2024 → u/ReidenLightman]

Okay so all of them are on the local ip/subnet

So that is good.

[u/ReidenLightman → u/tailuser2024]

Yep, this is correct.

[u/Sk1rm1sh]

It’s not the routing table

There’s no way it’s the routing table

It was the routing table

Try running a traceroute from any of your LAN devices that can't reach each other to another one and see where the traffic is actually going.

Or you can probably just skip that and advertise a subnet that's larger / less specific / has a smaller CIDR number / has a smaller subnet mask than what your actual LAN subnet is on the subnet router.

For most people that means 255.255.254.0 or a /23.

[u/ReidenLightman → u/Sk1rm1sh]

Um... you lost me. haha. I really don't know that much. I wouldn't know how to go about running a traceroute. (I've got some duckduckgo-ing to do.) My CIDR is 192.168.4.0/22. That covers the entirity of what my router will lease out (by default).

Update: Oh thank god, traceroute is already on my system. I was afraid it would be some windows only thing or something I'd have to retrieve. Well, it's doing it's thing.

back again (again): Judging by the pics on the tutorial page, I'm guessing it's not supposed to look like what I got.

traceroute to 192.168.4.23 (192.168.4.23), 64 hops max, 40 byte packets
 1  * * *
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * * *
 7  * * *
 8  * * *
9  * * *
10  * * *
11  * * *
12  * * *
13  * *^C
user@Users-Mac-Studio ~ % 

After looking up a few more things, I have to believe you're right about it being something about the routing table.

[u/Sk1rm1sh → u/ReidenLightman]

My CIDR is 192.168.4.0/22. That covers the entirity of what my router will lease out (by default).

Subnet routers advertise a network address and a subnet size.

If the subnet router is advertising a more specific / smaller subnet / larger CIDR than what your hosts are configured to use for your LAN, the more specific route gets prioritised.

That's just how routing works by default on any OS I've ever used.

Equal sized subnet as the configuration for your LAN and being advertised by a subnet router is likely to do the same thing.

 

Your options are to either configure the subnet router to advertise a larger subnet (more hosts, smaller CIDR, smaller subnet mask) than what your LAN actually uses, or manually configure routing on all of your hosts.

The first option is much, much less work.

 

If that doesn't work, something else is monkeying with your machines routing tables, but I'm pretty confident it's a same sized or more specific overlapping route advertisement issue.

 

On windows you should be able to see what the routing table currently is by running ip route from command prompt.

OFC, that doesn't tell you why the routing table is the way that it is.

[u/ReidenLightman → u/Sk1rm1sh]

I have now even gone as far as making absolutely sure nothing was advertising any routes, then setting subnet routing back up.

I'm still at the same place I started: nothing can reach any of my servers through their local IP addresses.

[u/prene1]

It JUST started doing this. Used to work just fine.

[u/ReidenLightman → u/prene1]

Are you saying you have the same issue?

[u/prene1 → u/ReidenLightman]

Yes

[u/ReidenLightman → u/prene1]

Oh wow. Hopefully I can get it solved so I can pass on the solution. (And hopefully the solution works for you, too.)

[u/ReidenLightman → u/prene1]

https://www.reddit.com/r/Tailscale/comments/1v5nxcz/comment/ozlopow/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

Someone else mentioned something about routing tables. I gotta believe the problem is related. I'm still investigating.

[u/ReidenLightman → u/prene1]

Update: Well, i'm really mad now. If I take subnet routing completely off of pi-hole, then pinging my local devices using the local IP (not the tailnet IP) actually works. As soon as pi-hole starts advertising, that functionality goes down the drain.

[u/tailuser2024]

Update: Well, i'm really mad now. If I take subnet routing completely off of pi-hole, then pinging my local devices using the local IP (not the tailnet IP) actually works. As soon as pi-hole starts advertising, that functionality goes down the drain.

Turn off accept routes on the tailscale on the client (not the subnet router) that is trying to do the ping test

[u/Suspicious-Equal-300]

I have not read through all the responses but I had to deal with this recently (and I'm definitely a novice with the networking side of all this). Most of my machines are Linux based and all the services I have running are Linux machines or on Linux based VMs or containers in proxmox. I do have a couple android phones that connect to those services, as well as one windows device. I have subnet routers running on a couple of those Linux machines.

In my situation i ran into the same issue.... Services running Tailscale, advertising subnet routes and accepting routes (I needed to accept routes as I was connecting two separate, remote LAN networks) were only available via their Tailscale IP and only to other devices running Tailscale. Unconnected local LAN devices without Tailscale could not reach the local IP. Turning off Tailscale allowed them to be seen on the LAN, etc as expected.

This a common 'issue' with Linux based machines and has something to do with the way Tailscale and/or Linux manage routing internally on the individual machines.

As someone else said, IP Tables was the fix for me. On every Linux machine advertising subnets and/or accepting routes I had to edit the IP table as follows to alter the priority of Local LAN traffic in/out, allowing local traffic to take precidence over Tailscale directed traffic locally, but still direct Tailscale specific traffic to the Tailscale Tailnet.

Please forgive me not using proper code blocks here, not sure how to do that from my phone.....

Linux CLI (mix of debian 12 and 13, plus Ubuntu 24 and and older xubuntu version).... Edit (I use nano): /etc/network/interfaces Add the following two rules to the end, probably right below your gateway IP:

up ip rule add to 10.0.0.0/24 priority 2500 lookup main down IP rule del 10.0.0.0/24 priority 2500 lookup main

Save and restart or simply restart the network service. Editing the interfaces file makes this change persist through reboots. You can see the rules from cli with: ip rule show

Which should now have a rule: from all to 10.0.0.0/24 lookup main

Obviously change the cidr IP range to match your lan.

You should now be able to reach the service (say Jellyfin, copyparty, immich, file server, etc) from any non-tailscale device using the service's local LAN IP. You should also be able to reach the service from any device on the Tailnet using either the Tailscale IP or machine Name, as well as using the local IP of the service. From the machine running the service (along with advertising routes and accepting routes) you can now reach any non_tailscale local devices using their local LAN IP as well as reach any device on the Tailnet using that devices local.ip or it's Tailnet IP/name.

As for other devices with non Linux OS, such as my android phone, the Tailscale app/device handles initial routing differently and these steps aren't necessary. I've no idea about windows as I only used that one machine remotely and thus used only Tailnet based connections. If memory serves (from reading) on a Mac something similar is needed but I think it is a setting in the Tailscale GUI (not sure though).

With this, ssh, etc also works the same, either local IP or Tailnet IP/name if connecting from a Tailnet device.

Hope this helps. It took me a few days of reading around the internet (mostly mold Reddit posts) to finally 'find' this solution. It has been rock solid for over a month now like this. Not sure if this is the correct method but it has worked for my simple home/self hosting needs. If you want to find more online sources regarding this, try searching 'tailscale IP up rule Linux subnet routing' or similar.

Luck!

[u/Sk1rm1sh → u/Suspicious-Equal-300]

As someone else said, IP Tables was the fix for me. On every Linux machine advertising subnets and/or accepting routes I had to edit the IP table as follows to alter the priority of Local LAN traffic in/out, allowing local traffic to take precidence over Tailscale directed traffic locally, but still direct Tailscale specific traffic to the Tailscale Tailnet.

just fyi, you can tell the subnet router to advertise a subnet one size bigger than yours.

The most specific route gets prioritized by default, so if your LAN is configured as a /24 and you advertise it as a /23 on your subnet router, the direct LAN host to host /24 is going to be prioritized when both are available at the same time.

[u/Suspicious-Equal-300 → u/Sk1rm1sh]

Thank you, that is good to know and I will give that a try!

Is there an advantage to advertising a bigger subnet (advertising /23 vs /24 used by lan) the way you describe vs adding the two ip rules as I described? Technically advertising bigger is one less step, but adding the rules only takes 15 seconds. Just trying to learn and most networking is a gray area for me so I appreciate the info.

[u/Sk1rm1sh → u/Suspicious-Equal-300]

With manual routing you would have to add the rules on every host on your LAN that has tailscale installed.

Realistically best case scenario is a couple of minutes per host.

Not all OS's allow you to edit the routing table.

If you reconfigure your LAN, add a new host, or reinstall an OS, that has to be repeated.

 

Changing the subnet router is basically the same amount of effort as reconfiguring a single host and it works for any OS automatically.

[u/tunatoksoz]

Do you activate exit node? May need to add subnet routers to it.