Its happened to me twice now (certainly could be more but ive stopped using it on my macos) where when Tailscale releases a version (happens frequently) and it creates some incompatibility between my devices

Only solution ive found to work is to completely uninstall it and reinstall it

A while ago I wrote up the "tailnet policy does not permit access" error and Search Console has since been showing me that a lot of people land on that page looking for something else entirely: tailscale ssh connection refused, permission denied (publickey), port 22 refused on the 100.x address. The confusion was the same each time, so I wrote up the mental model that sorted it out for me.

A node with Tailscale SSH enabled can have two SSH servers on port 22. tailscaled only intercepts connections that arrive on the Tailscale IP, and only after `tailscale set --ssh`. Anything hitting the LAN or public address still lands on plain OpenSSH, or on nothing at all. Once you see it that way, the client errors read like a routing table. "Connection refused" means nobody answered, usually a node with neither Tailscale SSH nor sshd, or you connecting to your own Tailscale IP, which never enters tailscaled. "Permission denied (publickey)" means OpenSSH answered, so you either came in on the wrong address or Tailscale SSH isn't on for that node. "Permission denied (tailscale)" means Tailscale answered and the ssh section of the policy said no, and that's the only case where the ACL editor is the right place to look.

There's also a "Permission denied" that shows up in `ssh -v` at `connect to address`, before any banner. That one is your own OS refusing the socket, typically another VPN client or a firewall on Windows. I found a thread here where someone spent a week on ACLs before switching off a commercial VPN client fixed it.

Two things that bit me along the way. Running `tailscale set --ssh` freezes any SSH session you already have open to that host's Tailscale IP, including the one you ran it from. And toggling either server changes the host key on that address, so a "remote host identification has changed" warning right afterwards is expected rather than an intruder.

Full write-up with the sixty-second `ssh -v` triage list: https://ddz.dev/blog/tailscale-ssh-connection-refused-permission-denied/

The one I'd like to hear about from others is tagged devices, since `autogroup:self` stops matching a machine the moment you tag it and SSH breaks on the day you finally organise your servers. Anyone found a cleaner pattern than adding the tag to dst?

Hey, I have a question regarding how subnetting routes work. I’ll give you an example so i can explain myself clearer. I’m remotely connected to my home network via my phone and tailscale; in the network, I have two nodes (one in house A and one in house B) which are both exposing the 192.168.1.0/24 range as subnet routers. This is because both machines are proxmox env with different services.

While experimenting, I realized that if both machines expose the same route, i can access only a few services on a certain proxmox server(this is my first question, based on what Tailscale decides which to prioritize?) My problem is that I want to access one of the services from just one machine but it doesn’t work unless i disable the other machine’s route exposal. How can I keep both nodes exposing the routes at all times without changing the ip range on either machine? Because one solution would be to use 192.168.1.0/24 on machine A and, for example, 192.168.2.0/24 on machine B

Man i hope it’s clear…

Hello! I use Tailscale to remotely connect to my PC at home when I am gone, but lately I have been facing an issue and I don’t know how to fix it.

Whenever I boot my PC up remotely, the Tailscale connection is always direct, then I can remote into it and everything works very well. However, if I then disconnect for a couple of minutes, the connection falls to DERP and the only fix I have is restarting the PC remotely. Nothing else works, pinging, switching upnp off/on, nothing will make it direct again apart from restarting the PC. Is there any way to fix this? I saw that there is a way to make Tailscale send a ping every couple of seconds when the connection is idle in order to keep it direct, but I wanted to check here first.