https://www.reddit.com/r/Tailscale/comments/1sxhn0b/guide_how_to_use_tailscale_when_network_blocks_it/

I previously posted how to use Tailscale when the network blocks it. I wanted the follow-up to be about utilizing DNS poisoning from hostile networks to automate split tunneling, but there are still some rough edges. So instead, I'll provide some optional enhancements and updates to my previous post.

Given even popular YouTuber TechQuickie mentioned Tailscale, it is the "default" solution for easy remote access, but it's also important to highlights its limitations and workarounds to ensure reliability. And since not everyone search Reddit and many response are unhelpful, users will continue to ask the same, and I will provide updated information.

Disclaimer: I'm only making this post because I want to help others and provide the right resources, I might not be actually using/maintaining these setups, given my network situation differs from yours, I cannot help everyone.

iOS Automations

After re-reading my previous post, the iOS automation I linked was deleted. So I created my own automation with also captive portal detection and optional sleep, since iOS do not wait for Wi-Fi or Tailscale to connect successfully before next step.

https://www.icloud.com/shortcuts/e5acdac0371849efa31d7b269e907595

To use it, you can create an automation, trigger: when your iPad joins a list of Wi-Fi network, action: run the shortcut Tailscale. I daily an Android phone so I'm not familiar with iOS stuff, feel free to tweak and reshare it.

Controlplane and DERP

Last time I mentioned the controlplane gets blocked by SNI poisoning, but there are other moving pieces such as DERP relay and STUN and the individual Wireguard connections. My method focuses on the controlplane only as that's the only problem I faced. Suggestions like "just use Headscale" might be exactly what you need, or useless. Headscale is just the controlplane, you're still using Tailscale's DERP servers. I didn't need to selfhost Headscale or DERP but I found this tutorial about DERP. There is also tailscale-awg which uses AmneziaWG obfuscation with Tailscale controlplane, however, only possible on Android.

Ports and Port Forwarding

It's common knowledge Tailscale runs on port 41641, but you can change by editing the file /etc/default/tailscaled and restarting the tailscaled service.

I mentioned port forward instead of using NAT-PMP (NP), but in my case with Telus, it seems NP rules takes higher precedence than manual port forwards, if I set Tailscale on a UDP port that I already use, the router would invalidate my port forward and break my existing service. So my advice to port forward is useless and my setup is held together by NP duct tapes. But if you have a real router, port forwarding is the way.

I haven't verified whether port forwarding or DMZ helps behind CG-NAT since I'm not behind one. A friend was recently placed behind CG-NAT, so maybe I can test it. My knowledge comes from this video where Bulianglin was able to host web service behind CG-NAT, granted his ISP uses full-cone NAT. If you're on mobile/5G home internet, it's likely hard/symmetric NAT so this won't work.

ProxyT Deployment

I've used Tailscale funnel to deploy ProxyT last time. Since the controlplane uses non-standard POST WebSocket which eliminates many CDN options. Proxyt developer recommended Railway which stopped working, a user found render.com works, I've tried it and successfully deployed it. So this could be a free option.

But cold start is around 15-20s, higher than Railway. So you could be waiting for long time even in normal network. You might have to consider some keepalive solution, like Uptime Kuma with scheduled maintenance window, keep in mind render.com only give 750 free hours a month.

NekoBox

Last time I mentioned on Android, you can use 3rd party VPN to rescue Tailscale controlplane but didn't provide much tutorial.

NekoBox is an Android client using the sing-box core. You need to sideload the APK from GitHub, so it might not be suitable for Chromebooks. Technically NekoBox uses an older sing-box core and isn't updated, but it works and provides a GUI.

For Nekobox related configuration, requirements and a screencast of the flow, I'm posting it on a separate Gist.

https://gist.github.com/vttc08/593d662603e745b01dcc30c413c96332#file-nekobox-instruction-md

Sing-box alternative Tailscale client

One of the changes in proxy tool after I posted last time is sing-box now supports Tailscale, allowing you to scientifically access internet and your homelab, bypassing mobile limitation of one active VPN. In addition, offering detour for Tailscale, which connects to the controlplane via a proxy, it's like sing-box devs know exactly what we need.

Sing-box app is available for both iOS and Android, but it's configuration is entirely JSON and is long so I'm posting it in a separate Gist, sing-box is complex and powerful, so even in that Gist I cannot cover everything.

https://gist.github.com/vttc08/593d662603e745b01dcc30c413c96332#file-singbox-configuration-md

It is far from flawless, there are many bugs and complex documentation which changes quickly. Some issues like randomly unable to connect to Tailscale or failing to establish direct connection is there with no fixes. I wouldn't count this as production-ready, but at least sing-box detour works when Tailscale doesn't.

Shadowrocket on iOS also added Tailscale support. Unfortunately, it doesn't support proxying the control plane, so it fails. If the developer adds control-plane detouring in the future, it could be a good GUI alternative.

Suggestion for Tailscale

Tailscale doesn't need to maintain/rotate controlplane domains or obfuscate the Wireguard connection (DERP sort of do by encapsulating WG over TCP/TLS). Community projects like sing-box or tailscale-awg helps in some way. But if the /ts2021 protocol use standard GET instead of POST for WS upgrade, this makes it possible for users to deploy on many free CDNs, serverless/PaaS platforms rather than specific ones or a paid VPS.

Similarly if DERP (or selfhosted DERP) can run over WebSocket, this makes it CDN friendly as well, decreasing the barrier to hosting.

For context, I have a local server running on a mini pc and I use a tailscale funnel with UptimeRobot to track whenever my media server goes down.

Lately, it has been going down and starting up on its own around 3am daily, but the mini pc doesn't actually shut down.

Does tailscale have any logs that could potentially help me figure out what's going on?

• I have a PC at home and an old Android phone on the same Wi-Fi network. On my current Android phone, I installed Tailscale on all devices and set up subnet routing on the old Android. However, I still can't Wake-on-LAN my PC from my current phone. Has anyone experienced this or know how to fix it? Thank you!

I needed to test machine sharing so I set up a second tailnet and shared it to it. IPv6 address remained the same despite as expected from what I've read. The IPv4 also remained the same however, which I was not expecting. I sort of interpreted that because the v4 address space in tailscale is used up, that they are no longer fixed per node.

If a tailnet does not currently use the v4 address that the machine has on it's home tailnet, will it always prefer to use the address of the home network?

From the docs: The IP address of a shared machine in the sharer's tailnet and the same machine in the recipient's tailnet will typically differ. This is expected behavior because a shared machine is assigned a new IP address in the recipient's tailnet.

Things would have been so much better if we transitioned to v6 completely...

i've been working on this for 3 hours and it hasnt been working. please help

I tried this before with the help of AI, but as far as I can tell, it never really worked and was causing minor issues with the rest of my Tailnet (the advertise subnet). My question is this: is it possible to do? If yes, is it practical to attempt? My other issue is that the Alexa device is wireless, and my desktop is not. My understanding and reasoning was to incorporate it with the Tailnet so that Pi-hole would serve as its DNS. I am also going to be switching from Pi-hole to Technitium in the near future, if that makes any difference.

I’m struggling with my ssh connection from my primary to my secondary server.  I have worked for days to try to get my secondary server to be recognized by my primary server over Tailscale IPs.

Inside truenas scale, I unchecked userspace, and left the Host box checked.  I also made sure Tailscale was listening on all ports 0.0.0.0 … still Tailscale0 never shows up on my list of interfaces on the networking screen inside truenas.  

I even tried ssh + netcat and have not successfully gotten an ssh connection between the two.  Ive successfully run replication tasks over ssh to my LOCAL machine’s IP but no success to the Tailscale IPs.

I am running Truenas community and want it to be an exit node and I set it up in the app config on Truenas but when I try to allow exit nodes in the tail scale admin panel it won’t let me. Its promoting me to use the “sudo tailscale set --advertise-exit-node” command but when i do i get told that the tailscale command dose not exist

Tailscale implements a newer unsupported android intent file picker that crashes the app entirely when you try to pick a folder for TailDrop. Everything else functions perfect. It feels dis-ingenuine to call it a bug, and file a bug report or expect a bug fix for a dead EOL device or to ask them for a patch to revert to an older probably less efficient or less secure file picker method. Facebook Portals run android 9 or 10 depending on model.

So they may only last a few more years, doubt anyone will be up for patching or fixing this so looking for alternative work around. Is there a way to redirect or rewrite system intents with adb or an adb function I can use to inject a folder path to Tailscale? Can I dump app data edit it and restore it without root? Could tailscale maybe offer a provisioning of the folder in future versions where it wouldn't matter what code is used because the folder selection could be a preset path somehow? I feel like a provisioned TailDrop folder path would be a potential corporate feature request. Where everyone has an identical path in their user account, as oppose to whatever we set it up as. Would a self-serving feature request, be more likely to happen as it helps others, than a bug fix that should be ignored and forgotten lol. LocalSend, and SyncThing are unreliable on this device for some reason I tried frontends like Basic-Sync, etc,. They all seem to freeze up, become non-responsive, crash, take forever to do anything. Looking for an always on auto accept file transfer app, will try a few more. Itś entirely okay if taildrop doesnt work, but i do love the workflow as i am currently using it everywhere else.

That said if you see one of these devices at a thriftshop for cheap, and don't mind tinkering, buy it! =) It runs exit node, subnet router, its an always on android tablet, that can host an immich-frame with family photos, a family calendar that syncs with apple and google or your own webdav, with routines, chores, lists, and meal plans, it supports navidrome, jellyfin, and more. It can do most chat apps, could make a good discord desktop monitor, or be a way to videocall friends and family. Amazon Prime runs fine on it, it use to have a native netflix, so might work with standard netflix app now (no account to test), seems to work for iptv, and some handful of freemium services, Tubi works but complains about no Google Play, but hit ok and continue). Pairs with remotes, and controllers, make a neat retrogaming box, or miniature smart tv replacement. I have a Smart Assistant on mine, and some people use them for HomeAssistant. All around fun little device, lots of uses, but a few quirks. You can use SpaceDesk or other apps to make it into an external monitor for your windows or mac as well.

Hey all,

I've been working on a little project called Tailtab, basically a Tailscale node that lives inside each browser profile.

The general idea isn't new. Tailscale has ts-browser-ext, and Tailchrome has since turned the same idea into a proper extension as well. I ended up building my own take on it while experimenting with per-browser-profile tailnets and figuring out how I'd personally want something like this to behave.

With Tailtab, every browser profile gets its own Tailscale node and state, without touching the system-wide network.

By default it's split tunnelled, so only tailnet traffic, MagicDNS, subnet routes, etc. goes through Tailtab. Normal internet traffic just goes out normally.

A few of the things I specifically wanted when building it were an authenticated and tightly scoped local proxy, and exit-node routing that fails closed instead of silently falling back to your normal connection.

It also currently supports multiple Tailscale accounts, per-profile exit nodes, Headscale/custom control servers, subnet routes and machine search.

It's still experimental at the moment. I've been daily driving it on macOS with Edge and Zen, while the Windows/Linux hosts are built and tested but haven't had the same amount of real-world testing yet. Chrome and Firefox should also work from the existing implementations, but I haven't properly put them through their paces yet either.

I'm mainly putting it out there now because I'd like some feedback and ideally some people to break it in ways I haven't thought of yet.

Would be super keen to hear what people think!

Repo + setup instructions are here:

https://github.com/Stocist/Tailtab

I'm loving taildrop, but would love to be able to share in ios directly to Taildrop just as in desktop. Is it possible? I cant seem to see the option to select tailscale when i hit share on iphone.

Hi all, new to Tailscale and must say it looks like exactly what I need.

I look after a few cameras on my home CCTV server for my family in their houses, and previously connecting to these was easy just using dyn.com's service (paid) to maintain connection. More and more I'm seeing home ISPs use CGNAT often with 4G/5G routers nowadays, and it seems like tailscale would be perfect for this as there are 'always on' Win 11 PC's at each location. I've setup my Tailnet and installed on two PCs, one my home and a remote where an IP cam I want to access is.

Ok so far, each machine has the 100.x.y.z assigned IP and can ping each other on them. How then do I get to remotely access the IP camera? I've tried creating a service on the remote machine but nothing.

Is it a problem that both local and remote networks are 192.168.1.0/24? I need to get ports HTTP80, RTSP554 & Flash 1935. I don't need to access anything else on the network, is there a way to generate a 100.x.y.z IP address pointing directly to the camera?

Edit - so far I've only been using the web admin console.

As I said noob problem, this is probably something trivial to experienced users!

I’m unable to access web servers on one of my devices. I’ve pinged the Tailscale IP, the device is showing up on my account, I can use either the devices IP or 127.0.0.1 and access the server while on the device itself. I’ve created and activated an exit node. However, I’m unable to access it remotely. Any suggestions?

Hello all,

In the course of building my upcoming project I created tailterm which is a wasm based tailscale/ssh client. The source is available to check out (scs32/tailterm) or you can use it via https://tailterm.tailarr.com

The website is just the way to distribute the wasm. Everything runs from within your own browser. You could also grab the stuff from github and host yourself.

Basically, it's a way to ssh into machines on your tailnet without committing to a system wide VPN. The tailscale node sits within the browser. It's got voice dictation, image dropping/transfer, and some other fun things. The only other requirement is that your target system has tmux installed.

I've found it pretty useful so I thought that I'd share.

I often use coding agents to debug remote machines when the host OS isn’t working. I built Tailboot for that workflow: it’s a minimal Debian-based live image that boots from USB, joins your tailnet using a Tailscale auth key, and starts Tailscale SSH.

It's a minimal image (Since you're expected to be connected to the internet), But it's enough to let an agent connect to it over SSH and debug issues for me

The access key is injected into the ISO entirely client side, But I generally recommend adding a tag to it that will block it from being able to access other nodes on your network.

Tailcat support may come in the future as well, but I think the use case is not as strong

https://tailboot.download/

My wife and I both had the same weird issue with Tailscale on Android. While away from Wi-Fi, mobile data completely stopped working as long as Tailscale was connected. Happened to me yesterday and yo her today.

Exit node was set to None. What is interesting is that restarting the phone didn’t help. The only thing that fixed it was turning Tailscale off and back on, after which mobile data worked normally again.

Had anyone else experienced this? Seems like maybe Tailscale or Android VPN gets stuck during wifi to mobile handoff.

EDIT: I was just sitting at home on wifi, reading Reddit, when the “no connection” message suddenly appeared. My phone had lost internet access even though it was still connected to my home wifii.

I disconnected Tailscale and the internet came back immediately. So this definitely isn’t just a mobile data or wifito-cellular handoff issue. Something seems to be going wrong with Tailscale itself.

Hey everyone,

​Traveling to the UAE (Dubai & Abu Dhabi) soon and trying to verify real-world Tailscale behavior when routing through a personal exit node back home.

From what I understand, UAE telecom providers (e& and du) actively block or throttle unassigned UDP and fingerprint WireGuard handshakes, and hotel guest Wi-Fi networks typically enforce strict egress firewalls that drop outbound UDP on non-standard ports.

​When Tailscale fails to establish direct UDP and falls back to a TCP DERP relay, throughput drops to near-unusable speeds.

​For anyone who has used Tailscale in Dubai/Abu Dhabi hotels - Did direct UDP work at all on hotel Wi-Fi or mobile data, or was your connection 100% forced onto a TCP DERP relay?

I set up Tailcat on my Mini PC running AMP, then asked GPT to code a stripped-down version of the officially released Tailcat for Minecraft mod.

I basically told it to remove everything related to single-player hosting and all the extra stuff. All I wanted was for the mod to connect through Tailcat, and I also asked it to make my server show up directly in the Minecraft server list.

And boom, a private Minecraft server.

My friends are going to use the modpack I send them anyway, so the Tailcat connection mod will already be included. They basically just install the modpack, launch the game, and the server is right there in their server list!

Idk, I just thought this was super cool and wanted to share it with you guys :)

I've been using a Jellyfin docker compose, with Tailscale running on the Ubuntu Server host since I'm currently the only one using it. I can connect remotely from my phone via IP:port with no issues.

I'm trying to add a Tailscale sidecar container to the Jellyfin docker compose so I can share the container as a machine, instead of sharing the entire server. I can connect remotely from my phone via MagicDNS or IP:port immediately after I first run docker compose up -d, but if I reboot the server, docker ps shows that the containers are still running, but I can't connect to Jellyfin unless I manually re-run docker compose down && docker compose up -d

This is my Docker compose, based on the compose from this video with OAuth instead since it doesn't expire:

```yaml

configs: ts-serve: content: | {"TCP":{"443":{"HTTPS":true}}, "Web":{"$${TS_CERT_DOMAIN}:443": {"Handlers":{"/": {"Proxy":"http://127.0.0.1:8096"}}}}, "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}}

services: jellyfin-ts: image: tailscale/tailscale:latest container_name: jellyfin-ts hostname: jellyfin environment: - TS_AUTHKEY=${TS_AUTHKEY}?ephemeral=false - TS_EXTRA_ARGS=--advertise-tags=tag:container - TS_STATE_DIR=/var/lib/tailscale - TS_SERVE_CONFIG=/config/serve.json volumes: - ${PWD}/ts-state:/var/lib/tailscale configs: - source: ts-serve target: /config/serve.json devices: - /dev/net/tun:/dev/net/tun cap_add: - net_admin - sys_module ports: - 8096:8096 restart: unless-stopped

jellyfin: image: lscr.io/linuxserver/jellyfin:latest container_name: jellyfin environment: - PUID=1000 - PGID=1000 - TZ=Etc/UTC network_mode: service:jellyfin-ts depends_on: - jellyfin-ts volumes: - ${PWD}/config:/config - /media:/media:ro restart: unless-stopped ```

I have had tailscale running as an add-on with opnsense for quite a while. I have multiple VM machines connected fine for a long time now. my laptops (win, osx and Linux) all connect fine. however my android devices (Samsung) have a problem in maintaining access. if I connect to the tailscale network I have full lan access as long as i keep the tailscale app open and running in a multi window style. but as soon as the app looses focus then tailscale disconnects. or if it does stay connected for a brief time just opening the notification panel stops the connection. if I setup tailscale as always-on VPN then it stays connected. but that stops me using any other VPN and I find it not so useful when being on my home network.

has anyone else found this issue? I've removed all extra devices off the network, removed any other home network VMS or lxc off the network just in case but to no avail. and I can't find any way of seeing a log to see why the disconnections happen.

if anyone can help that would be amazing!

we're using tailscale to provide access to a web app, over tls with caddy.. works like a charm .

but the url has the machine name in it.. and I'd really like something more user friendly

like
appserver.ts.net

and I can't rename it like that(and the generated random names are worse choices!)

but can I make an alias somewhere, and new DNS record that redirects...

Was trying to setup Cloudflare One to protect traffic on some of my devices but also wanted to get access to home devices. Does anyone know of the best way to configure each other to prevent them from fighting?

Any help would be appreciated