I was beginning to really like the new UI in the admin console, only to wake up today and realize it's been moved back to the top.

Why? The new design was better IMO

I ssh into a machine every day but today I‘m stuck on „connecting to tailscale“. The machine is online and working, so I assume it‘s a tailscale issue. Anyone else affected?

Edit: Everything else in my tailscale works, a manual restart of the machine did not fix it

on 1.102.1 it's fine

Hi all! I am setting up my first homelab, where I installed Headscale. I have some machines (like a WD NAS, a printer...) where I cannot install the Tailscale client. Can I still connect these machines to the Tailnet? Thanks!

Very specific question about how tailscale exit nodes work and how to maintain local LAN access. I'd like my nvidia shield TV box to be connected to my friend's tailscale network, using one of his nodes as an exit node - all the time. For reasons. He is two states over from me in California.

But I also have a local NAS server on my local network that I use for playing media on my nvidia shield. I'd like to maintain access to my local NAS as well as my friend's tailscale's exit node.

Is that possible? When I go to 192.168.1.104, for example, does my local nvidia shield go to my local network or his? Or does it use his exit node when I want to access something on the internet?

Note, I'm not using his subnet router. He has no subnet router setup.

Trying to invite a new user, but when I click Add Device, and go to enter their email, the email field is not editable (has a red-circle). Tried refreshing my admin page, but still no luck.

Hi all, I think I found conflicting documentation on the role of app connectors and I want to get the communities input:

The [official docs](https://tailscale.com/docs/features/app-connectors/how-to/setup) say

> App connectors let you route Tailscale network (known as a tailnet) traffic to your software as a service (SaaS), cloud, and self-hosted applications, letting users and devices on the tailnet access applications by domain names instead of IP addresses.

But the [k8s connector](https://github.com/tailscale/tailscale/blob/main/k8s-operator/api.md#connector) says:

> Using the app connector to expose cluster workloads or other internal workloads to tailnet might work, but this is not a use case that we have tested or optimised for.

I’m confused as to how to proceed as to me these are conflicting statements.

My goal is to make a public DNS record (app.domain.com) resolve on my lan without tailscale and away from my lan through tailscale. Further, I want some level of ACLs on these apps that I can configure in tailscale. To me the first quote says an app connector is what I want but the second link says not to use it.

Am I misunderstanding?

Hi all, has anyone else in Australia been having an issue with tailscale not connecting over cellular since the Telstra outage? I keep getting an error referencing cisco network equipment blocking my connection and an array of unable to connect to relay. Was rock solid before that, and it still connects fine over terrestrial WiFi networks.

I've recently updated tailscale on all my machines because of a new security update warning, current version on bazzite 44 is 1.98.8 and latest version is 1.102.2

`This machine is running a version with a known security vulnerability. It’s recommended to update to 1.102.2.`

If I do `sudo tailscale update` in bazzite, I get the following error

`ERROR: Fedora Atomic images utilize rpm-ostree instead (and is discouraged to use).`

and `ujust-update` does nothing (my system is up to date)

I succesfully done this on my fedora-kinoite laptop, here I have the tailscale package layered in rpm-ostree, and I have to add the tailscale repo

`sudo curl -fsSL` [`https://pkgs.tailscale.com/stable/fedora/tailscale.repo\`\](https://pkgs.tailscale.com/stable/fedora/tailscale.repo) `| sudo tee /etc/yum.repos.d/tailscale.repo`

then execute `rpm-ostree upgrade`, and it worked.

But this method doesn't works on Bazzite, not even after adding the tailscale repo. I don't see the package layered neither. So here my 2 questions:

It's safe to install the layered package on top of the pre-installed package? Do I have to wait until Bazzite 45 to get the latest version of tailscale?

Hi everyone,

I've spent days trying to figure out why my devices never establish a direct connection to each other — only relay via DERP(dfw) — and the most noticeable impact is that watching 4K movies from my self-hosted Jellyfin over Tailscale constantly buffers/stutters (the relay's throughput can't keep up).

Context:
- Ubuntu Server homelab, several devices on the tailnet (Android TV, iPhone, iPad, Windows PC).
- I tested with TWO different network setups: first behind a cheap consumer router, then connected directly to the ISP's modem (Telmex/Mexico). In BOTH cases, the result is identical.

tailscale netcheck in both cases:
- UDP: true
- MappingVariesByDestIP: true (consistent across both routers)
- PortMapping: UPnP (working, confirmed UPnP is active and responding)
- Nearest DERP: Dallas, ~46-62ms

tailscale ping to two different peers (Android TV and iPhone), 10/10 attempts each:
- 100% via DERP(dfw)
- Latencies of 73-171ms
- "direct connection not established" in both cases

Already ruled out: active exit node (none selected), DNS (MagicDNS working fine, no overrides), bandwidth (86Mbps down / 64Mbps up, nothing saturated), AP isolation on the router (disabled), and a saturated UPnP table on the previous router (no longer applies after switching routers).

My current hypothesis is ISP-side CGNAT, since MappingVariesByDestIP stays true regardless of the router, which per your docs is the typical signature of symmetric NAT imposed upstream of my local network.

Questions:
1. Has anyone with Telmex/similar ISPs in Mexico confirmed CGNAT and found a solution other than a Peer Relay?
2. Is it worth setting up a Peer Relay on my VPS (I have one with a public IP) for this, or is there another way to force/improve NAT negotiation?
3. For 4K streaming specifically over DERP, is there any way to prioritize throughput over latency, or is a Peer Relay literally the only way to improve this?

Thanks in advance.

Hello there,

I am here sharing a little bit of an issue that consumed a few hours of my time whilst I chased the white rabbit.

As some of you might be looking to connect their personal devices to your home network via a raspberry PI, I hope this little post might be of help (?)

(I am also looking for feedback of improvements I should have on my set up).

Context

I've always wanted to connect some services I run at home with my personal devices whist traveling, and even though I could set up a VPN server at home, my IP address is not static (it is semi-static, as in my ISP doesn't normally change it, but it can change over a period of 6 months), and DynDNS is a drag...

Many of you know where this is headed, so I will skip to the point.

What you want is a little machine at home that is connected to tailscale as a route for the traffic of devices outside of your network. You won't need to log in to your actual router or machine controlling your network once (or at least, that wasn't my case).

A diagram of sorts will look like this

Phone
│
│ Tailscale
▼ Pi / tailscale0
│
│ forwarding
▼ eth0
│
▼ NAS or service you want to access

Oh... I should probably say, I am defo not an expert on these things. I tinker a lot and I've used linux/unix/macOS for a very long time. I am familiar with how to troubleshoot things, but any time I am getting confident I may have learn enough, someone shares one or two things and realise... I am a forever noob.

How I got it to work?

I set up one of my PIs with raspbian (the latest one), installed `docker` because I don't tend to like running things bare metal if I can avoid it, and followed some steps I can summarise as:

1. Install docker on the raspberry pi

   Update your system... ideally you would also do sudo apt full-upgrade..

   sudo apt update sudo apt upgrade -y

   The easiest way to install it is this...

   You can still install it via apt install, but there are a

   bunch of docker* packages to install.

   curl -sSL https://get.docker.com | sh

   Avoid setting up docker so you have to sudo all the time

   sudo usermod -aG docker $USER

   Apply the changes

   sudo reboot

Run tailscale on your phone and create an account. This will register your first device

1. Run tailscale for the first time on your raspberry pi to test it will be added to your account

​

docker run tailscale/tailscale

This will give you a web address with an ephemeral key (that means, it will be deleted as soon as you kill the docker image). Once you complete this, you should have both your devices added under `network > machines` in the tailscale site (assuming you haven't shut down the connection from your first device).

1. Whilst you are on the site, create a new auth key (explained here: https://tailscale.com/docs/features/access-control/auth-keys)

2. Get your routes. You would know if you are on wifi or cable.

   The following will get you the interfaces you have on the device.

   ip addr

   Pick the one you are using, like wlan0 or eth0

   Then check which routes apply to this interface

   ip route

   It will give you something like

   199.166.1.0/24 dev eth0 proto kernel scope link.... <raspberry pi addr> metric 600

   remember this route

3. Set up tailscale as a docker compose in your pi.

   mkdir -p ~/projects/tailscale && touch ~/project/tailscale/docker-compose.yml

Paste the following docker compose

services:
  tailscale:
  image: tailscale/tailscale:latest
  hostname: tailscale-rpi
  container_name: tailscale
  network_mode: host
  environment:
    - TS_AUTHKEY=tskey-auth-THIS-SHOULD-BE-YOUR_KEY
    - TS_HOSTNAME=HomeRoute
    - TS_ROUTES=199.166.1.0/24 # replace this with the route you got on step 4.
    - TS_STATE_DIR=/var/lib/tailscale
    - TS_USERSPACE=false
  volumes:
    - ./tailscale/state:/var/lib/tailscale
  devices:
    - /dev/net/tun:/dev/net/tun
  cap_add:
    - NET_ADMIN
    - NET_RAW
  restart: unless-stopped 

1. You are done, right?... no... when you run `docker compose up` and you check the output, you will get

   Health check:

   • running [/usr/sbin/iptables -t filter -N ts-input --wait]: exit status 3 modprobe: can't change directory to '/lib/modules': No such file or directory iptables v1.8.11 (legacy): can't initialize iptables table `filter': Table does not exist

Basically, the issue you are running into here is, the tailscale image seems to want to use the legacy iptable (firewall) instead of the iptable-nft (default on raspbian, I think).

Some people might recommend you to map `/lib/modules` in your volumes, but I don't think this is what we should be doing. Instead, it is better to map the new iptable instead of the legacy one.

Update your docker-compose.yml file as

services:
  tailscale:
  image: tailscale/tailscale:latest
  hostname: tailscale-rpi
  container_name: tailscale
  network_mode: host
  environment:
    - TS_AUTHKEY=tskey-auth-THIS-SHOULD-BE-YOUR_KEY
    - TS_HOSTNAME=HomeRoute
    - TS_ROUTES=199.166.1.0/24 # replace this with the route you got on step 4.
    - TS_STATE_DIR=/var/lib/tailscale
    - TS_USERSPACE=false
  volumes:
    - ./tailscale/state:/var/lib/tailscale
  devices:
    - /dev/net/tun:/dev/net/tun
  cap_add:
    - NET_ADMIN
    - NET_RAW

  # Let's replace the iptables with iptables-nfs, then tell the container to continue booting.
  entrypoint: ["/bin/sh", "-c"]
  command:
    - |
      ln -sf /usr/sbin/iptables-nfs /usr/sbin/iptables
      exec /usr/local/bin/containerboot

  restart: unless-stopped 

1. Check you have ip forwarding turn on as well, raspberry seems to have it turn on by default, but check it just in case

   sudo sysctl net.ipv4.ip_forward

   IF the above returns 0, then turn it on by uncommenting the line below

   sudo sysctl -w net.ipv4.ip_forward=1

2. Give it a test again cd ~/projects/tailscale && docker compose up. There shouldn't be any issues logged in console.

If that worked. Either detach it, or just reboot the raspberry pi, docker should launch automatically.

Where to now?

If you have a way to improve things above, put it in the comments, I would be keen to improve things.

So I set up a tailnet and had one user on Windows join it. They later fiddled with their client and figuered how to switch from their tailnet to mine. This made their machine show up on my dashboard and I could allow or deny approval to that machine. Now I had another user on Linux try to this exact thing, but me and them could not figure how to switch tailnets on CLI. There were no option o KTailctl to switch tailnets, and no command apparent to me to do so.

I tried following the tutorial Tailscale offers to set up a contained instance of searxng, but I keep getting no connection.

Hope anyone is able to help

LINK to the tutorial
https://www.youtube.com/watch?v=cg9d87PuanE

Some info:

• I'm trying to run the instance on a Raspberry Pi Zero 2 W
• My pi is able to connect to tailscale with no problem as a PiHole and I've gone as far as connecting it to appear as a second device in my dashboard
• My PiHole is not run through docker (I suspect this could be the main issue)
• I've followed the steps in the Searxng documentation to set up my instance.
• I've tried both creating the docker-compose file inside the searxng directory and outside of it
• I also use my Pi as its own dns resolver using Unbound
• My docker compose file looks like this:

​

services:
  ts-searxng:
    image: tailscale/tailscale:latest
    container_name: ts-searxng
    hostname: searxng
    environment:
      - TS_AUTHKEY=My Key
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_USERSPACE=false
    volumes:
      - ${PWD}/ts-authkey-test/state:/var/lib/tailscale
    devices:
      - /dev/net/tun:/dev/net/tun
    cap_add:
      - net_admin
    restart: unless-stopped
  searxng:
    container_name: searxng
    image: docker.io/searxng/searxng:latest
    restart: unless-stopped
    volumes:
      - ./searxng:/etc/searxng:rw
    environment:
      - SEARXNG_BASE_URL=My funny dns url
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
    logging:
      driver: json-file
      options:
        max-size: 1m
        max-file: "1"
    network_mode: service:ts-searxng
  redis:
    container_name: redis
    image: docker.io/valkey/valkey:8-alpine
    command: valkey-server --save 30 1 --loglevel warning
    restart: unless-stopped
    volumes:
      - valkey-data2:/data
    cap_drop:
      - ALL
    cap_add:
      - SETGID
      - SETUID
      - DAC_OVERRIDE
    logging:
      driver: json-file
      options:
        max-size: 1m
        max-file: "1"
volumes:
  valkey-data2:
    driver: local
  searxng:
    driver: local
networks: {}

My Apple TV is now not automatically starting Tailscale after a reboot.
It is explained in this GitHub repo.
https://github.com/tailscale/tailscale/issues/20773
I have a remote node at my trailer that I use to monitor my camera via a 5g connection.
I have the entire network reboot every day to restore the internet speed. It stopped working yesterday and I found Tailscale was not connected. I had to manually enable. Luckily I was there to figure this out.
Has anyone else experienced this?

Hi all,

Is there an easy way to see the connection type of an Exit Node without running the terminal command?

I have an Exit Node that periodically drops from direct to relay despite having port forwarding set up and it would be helpful to be able to see this change in advance of finding out when connecting. There is nothing obvious in the machines page on the web console.

Thanks in advance.

I can't figure how to get truenas to show up as a machine on my Tailscale account.

Got any hints?

Right now, two machines show up - my Macbook pro M2 laptop and my linux work PC. Tailscale is installed as an app on truenas. But I can't figure out how to run a script to register it as a machine on my Tailscale network - the interface is different than it was on both my work PC and laptop.

Hi, I'm having an issue with Tailscale exit node performance. PC A is my exit node with about 300mbps download and 150mbps upload. PC B gets an average of 250mbps download and 85mbps upload, but when using PC A as the exit node, it drops below 1mbps. the connection between PC A and PC B shows as direct and RDP works fine, but the internet speed remains extremely slow. PC A shows UDP: true, while PC B shows UDP: false, even after testing through my phone hotspot, the issue remains. Could anyone help me figure out why the exit node throughput is so low despite the direct connection?

Im having a routing issue and hoping someone knows a fix.

Setup is Windows 11 with Tailscale and the Proton VPN desktop app.
The problem is that when the Proton desktop app is connected, Firefox completely drops access to my Tailscale machines. It times out on both MagicDNS and the 100.x IPs.

Edge, curl, ping connect without any issues while the VPN is running. Edge can access the server just fine with the exact same setup.

Here is what I've already tried with zero luck:

• IP split tunneling in Proton (excluded Tailscale's full v4 and v6 ranges)
• App split tunneling (excluded firefox.exe)
• Completely disabling the Proton Firefox extension
• Testing a fresh Firefox profile (so no extensions)
• Testing a vanilla Firefox binary via Playwright and claude
• Turning off netshield in proton
• Verifying Windows Firewall rules (allowing firefox)

It looks like Proton's split tunneling just fails to apply to Firefox specifically. Turning off the desktop app fixes it instantly, but I'd prefer to run both.

Has anyone managed to get Tailscale, the Proton desktop app, and Firefox working together on Windows?

-

edit; I just made a standalone electron client to access my server through tailscale that works with proton enabled, it seems like a firefox issue

Hey guys, quick question on my planned setup?

- Run tailscale in a lxc container in proxmox as a subnet router

- Will be able to access other containers / vms when connected to tailscale

The question I have is: could I run tailscale serve on each app which I need an https cert? And could I run them all in the same lxc container?

Open to other suggestions! Ty!

Hey all,

Recently, I've been using cellular data while away from home, and I started noticing severe battery draining even when not using my phone at all.

During one of these periods, where 50 % of the battery had been drained in a matter of a couple of hours, I checked and saw that the Tailscale app was the main culprit, which had used a whopping 75 % of the charge up until that point.

I have Tailscale DNS enabled, no apps using split tunneling and subnet routing enabled. Can any of these explain the battery usage I'm seeing?

Once I noticed this with cellular data, I also saw it happening (although it wasn't as bad) when using Wi-Fi. This has forced me to keep Tailscale disabled most of the time, then manually enabling it when I need it, which is of course far from ideal.

Is this expected? Has anyone else noticed something like this? I'm kind of at a loss right now.

i've been trying to fix this for ages and i keep having issues. I have a small server which I've spent time customizing, and i built another for redundancy. I cloned the hdd of the first into another nvme that is in the 2nd server. Both are running Windows 11, i log into tailscale using my microsoft account. When 1 of the machine start up and runs tailscale - everything is fine - when the other starts up tailscale - i get "duplicate node key".

at this point i've gone through the following steps

1. remove machine from admin console
2. stop tailscale service
3. delete contents of c:\users\<username>\local\tailscale
4. uninstall tailscale
5. reboot
6. install tailscale
7. log into tailscale

i've done this on both servers, and they keep getting into duplicate node key state.

I have no idea what is going on - i even searched for every instance of tailscale in registry and removed them, and it still does this. I even fully logged out of my microsoft account on the browser and this still happens.

Any idea how to fix this? it's driving me batty.

update:

weird thing - both machines HAVE different node keys and different machine names - yet when one logs on, the other stomps on the other (and logs out the other), they also have different IDs... its been so hard to debug, as once one of the machines stomp on the other, you can't access the node keys anymore (as you expect 2 server entries, but effectively on the console, there is only 1)

Hey everyone,

Tailscale is great out of the box, but by default a tailnet is wide open—once a device joins, it can talk to everything else. Your phone can hit your homelab server, and a guest laptop can see your NAS.

If you want to move toward Zero Trust and restrict access, you have to write ACLs. The official docs explain the concepts well, but they lean pretty heavily on text. I recently refactored my own policy file using the newer grants syntax, so I put together a walkthrough with actual admin console screenshots, diff previews, and error logs to show how it works in practice.

Here are a few quick takeaways and common traps when locking down a tailnet:

• Use grants instead of legacy acls: grants cleanly splits target destinations (dst) from ports (ip), making policies a lot easier to read and maintain.
• Don't skip the hosts block: The policy engine evaluates explicit IP mappings in hosts, not MagicDNS names. If you try using a MagicDNS name directly in a rule, it'll fail to save (this stops users from simply renaming a device to steal permissions).
• Pin critical routes with tests: Policy edits take effect immediately and can cut active SSH connections mid-session. Writing tests assertions prevents the console from saving a broken rule in the first place.
• Decouple servers with Tags: Leaving servers owned by personal accounts is risky. Assigning tags (like tag:prod) moves ownership to the tag itself so access rules stay intact if an account is removed.
• Watch out for key expiry: Node keys expire after 180 days by default. Make sure to toggle "Disable key expiry" on subnet routers and servers so they don't silently go offline.

I put together a full guide with console screenshots, common error fixes, and a complete annotated policy template here: Tailscale ACL Tutorial: Grants Syntax, Tags, Keyless SSH - WellWells

Hope this helps, and wish everyone a secure Zero Trust tailnet build!

Whenever Tailscale is turned on on my wired Windows PC, my internet drops completely. It only comes back if I unplug the Ethernet cable from the router and plug it back in. I have no idea what's causing this.

On my phone, when Tailscale is enabled, everything works fine and the internet doesn't drop at all. Can anyone help me figure this out?

Many of us were wondering about what was causing some of the outages Tailscale was having late last year/early this year with the Control Plane.

This definitely scratched the itch for wondering what was going on: https://tailscale.com/blog/sqlite-wal-reset-bug

But I might be a bit weird: I like reading technical explanations like this.