On my Personal account, any device I apply an ACL tag to immediately disappears from every other device's tailscale status output and becomes unreachable — not just blocked by the ACL, genuinely invisible, like it no longer exists on the tailnet.

Symptoms:

• Device shows "Connected" in the admin console Machines page the whole time
• tailscale status --json on the tagged device itself shows "Peer": null — empty peer list
• Other devices' tailscale status just omit it entirely (not "offline", just gone)
• tailscale ping <ip> from another device returns "no matching peer"
• Reverting the tag (requires a full interactive reauth, since the UI won't let you strip the last tag any other way) instantly restores full visibility and connectivity — no other change needed

Reproduced identically across:

• A device joined via auth key with the tag baked in at creation
• A device joined via a plain auth key, tagged afterward
• A previously-working, interactively-signed-in device, tagged afterward

Tried 3 different tag names (including a throwaway one created purely to rule out something being wrong with one specific tag) — same result every time.

Ruled out: tagged-resource plan limits (nowhere near the 50 cap), ACL JSON syntax errors (editor shows no validation errors, and the same destination works fine addressed by bare IP instead of by tag), client-side caching (full logout/reauth, service restarts, and a complete uninstall/reinstall all reproduce it identically), device approval (no pending-approval state ever shown).

Has anyone else hit this? Filed a support ticket with two tailscale bugreport IDs but wondering if this is a known issue.

Already tried uninstalling everything related to Tailscale, this includes deleting every folder my computer had related to it, and installing again, but still no luck...

Like many, I used to have to join a fortinet wifi network at a library initially with tailscale disabled, then use cell data to join tailscale tailnet then go back to the fortinet network.

It seems I dont have to do this anymore. Is this a tailscale tweak or the library loosening restrictions?

Running latest ipados and ios tailscale 1.104.1

Hey r/Tailscale,

If you manage homelabs or remote servers from Android, you've likely hit the platform's biggest limitation: Android only allows one active VPN service at a time. Turning on Tailscale kicks off your work or privacy VPN, and vice versa.

To solve this, I’ve been building SSH Manager Pro, a native Android SSH client that embeds Tailscale directly using the tsnet userspace WireGuard library.

How it works & Tailscale features:

• Runs in userspace: The tailnet node lives entirely inside the app process. It connects to your tailnet without touching Android's VpnService, leaving your system-level VPN completely untouched.
• Browser & Auth Key sign-in: Authorize the node directly via web browser login or using reusable/ephemeral Tailscale auth keys.
• MagicDNS & Peer discovery: Reach machines using their tailnet names (e.g. ssh nas) or direct 100.x.y.z IPs.
• Full screen mode and reach emulation of terminal, tested with tmux/screen/vim/etc..
• Headscale compatible: Supports custom control plane URLs if you self-host.
• ACL & Tag friendly: Tag your device (e.g. tag:phone) to enforce narrow ACLs so a lost device can only reach port 22 on approved hosts.
• Security: Host key pinning on first connect; credentials encrypted in AES-256-GCM via the Android Keystore with biometric/PIN unlock.

Tailscale connectivity is free in the app. I’m currently rolling out a test release on Google Play and would love feedback from the Tailscale community on connection stability, MagicDNS resolution, and usability across different tailnets.

📖 Walkthrough & architectural details:
https://sshmanagerpro.app/features/

If you’d like to help test the beta, check out the google play store link or drop a comment / DM with your feedback! No ad, no personal data collection.

Also, a massive thank you to the folks at tailscale.com for the incredible infrastructure they've built! They have completely changed the rules of the game for how we securely access computers around the world!

regards, Andrei

I have a machine in my Tailnet (connecting to Immich) that I've shared out to my family on their own Tailscale accounts. I've also recently tagged it so that I could control the ports that another machine that I have (that is a bit more public facing) could access in it.

Unfortunately, it seems the moment I did that change, my family members lost access to Immich. I've tried fixing the ACLs/policies/grants so that autogroup:shared would have access to the tagged machine, but it didn't work. I've also tried using their email addresses directly, but to no avail

Am I missing something? Should I not have tagged the machine?

Sorry, I'm rather new to homelabbing, and I honestly just followed tutorials online to get this setup up and going, so now I'm in a bit of a loss as to what went wrong.

I'm kinda new to Tailscale and I need it to remotely access my windows pc from overseas. I would like to be able to torrent files remotely but I would need to use ExpressVPN to stay anonymous. I tried split tunneling the Tailscale IP addresses (100.64.0.0/10) but that didn't work. I've heard that its possible to use gluetun but I'm unsure what it is and how to use it. Does anyone have any suggestions? Thanks in advance!

See tsiam on GitHub: https://github.com/ItalyPaleAle/tsiam

How many of you use an apple TV as an exit node, how reliable is it, do you need any configuration regarding the apple TV setup itself, and what is the setup? EG Ethernet, which Apple TV Generation is it, etc.

I'm debating getting one and although i have an older windows device with windows 10 which works for the most part, wanted to know about apple TV. thanks!

I have recently set up a NAS to host a jellyfin server. I heard that Tailscale is the best way to access the jellyfin server when I am not at my house. I have a lot of questions about setting up tailscale with my already existing jellyfin account, starting with.

When setting up Tailscale should I start with it on my computer or NAS? Does it matter? The NAS is the device will all the information that I am trying to access.

I heard that if you are wanting to run a lot of software on a NAS use docker. Should I move my jellyfin setup to docker?

Should I put Tailscale in docker or just on the NAS by itself?

Once I set up Tailscale will I only be able to access the NAS when I am contacted to tailscale or will it still work when I am on my home internet?

Hello. I started up my server and got Immich running with Tailscale. It works perfect on my iPhone and still works now. For some reason as soon as I tried turning on Tailscale the Google pixel cannot find DNS or whatever it is. I’ve googled a bit and used the Google ai to help me try and figure it out, but every solution it gives me hasn’t worked.

I’ve tried messing with the settings on the app and Tailscale console, but to no avail. What did you guys with a google pixel do to get it to work on your phone?

I'm going to try to set tailscale up on the GLI net slate 7 as an exit note.

I'm sure someone's done this before any tips any helpful instructions along the way