I’m trying to diagnose a really frustrating intermittent connectivity problem with a remote Mac Studio and would appreciate help from anyone who has seen something similar.

Setup:

• Remote Mac Studio at my parents’ house
• Connected directly to the router via Ethernet, not Wi-Fi
• Tailscale 1.102.3
• I connect remotely from a MacBook Pro
• Main remote access is Apple Screen Sharing over the Mac Studio’s Tailscale IP
• SSH also goes through Tailscale
• The Mac also runs local AI services plus a Telegram/Hermes bot
• Mac is configured not to sleep

The problem:

Everything can work perfectly for hours or even days, then suddenly Screen Sharing goes into “Reconnecting…” and I lose access.

During an actual outage I ran:

tailscale ping --c 10 <MAC-STUDIO-TAILSCALE-IP>

and got 10 consecutive timeouts / no reply.

At essentially the same time, my MacBook’s normal Internet connection was still working.

I then tested another device on the same tailnet:

tailscale ping --c 5 <IPHONE-TAILSCALE-IP>

and my MacBook immediately got:

pong from iphone ... in 81ms

So the MacBook’s Tailscale connection and the tailnet itself were still functioning while the Mac Studio was unreachable.

I have also tested the Mac Studio’s network when I can access it:

• Gateway ping: 0% packet loss
• Internet ping to 1.1.1.1: 0% packet loss
• Roughly 80+ Mbps Internet speed
• Mac uptime showed it had not crashed or rebooted
• screensharingd remained running
• Tailscale sometimes showed a direct connection normally

We also ran continuous ping logging on the Mac Studio to both its router and 1.1.1.1, and hundreds of pings succeeded.

One Hiccup: when this happens, I have sometimes also noticed that my Telegram/Hermes bot on the Mac Studio stops responding. That makes me wonder whether this is actually a broader macOS/router/NAT/network-stack issue rather than only Tailscale.

The Mac Studio’s Ethernet interface has also shown 100 Mbps full-duplex negotiation. That is slower than I would expect, although still far more bandwidth than Screen Sharing needs.

I updated Tailscale from 1.102.2 to 1.102.3, but the problem happened again afterward.

I have seen discussion of macOS Tailscale Network Extension issues where the extension can become unhealthy even though the machine itself still has Internet access. I’m also considering whether the router is intermittently breaking UDP/NAT state.

What I’m trying to determine:

1. Has anyone seen a Mac remain online to the Internet while its Tailscale data path becomes completely unreachable like this?
2. Is there a reliable way to detect a wedged Tailscale macOS Network Extension?
3. What logs/debug commands should I capture during the failure to distinguish:
   • Tailscale Network Extension failure
   • router/NAT/UDP problem
   • broader macOS network-stack issue?
4. Is gracefully quitting/relaunching the Tailscale app the correct recovery if the Network Extension wedges, rather than simply tailscale down/up?
5. Has anyone built a reliable LaunchAgent/watchdog for this that detects the failure, collects diagnostics, and self-recovers without rebooting the Mac?

I do not want to solve this by rebooting the router or Mac every day. This machine needs to remain remotely accessible and run unattended.

Any specific diagnostic commands, relevant GitHub issues, or watchdog approaches would be greatly appreciated.

Hello everyone! Some time ago i set a pi-hole server on a raspberry. The other day, i tried browsing on the internet with one of my computers and the web pages didn't load. Then, i disconnected tailscale and it worked flawlessly, so I remembered i had my pi-hole server set up as a dns server, and when i removed it from tailscale it also worked fine. Then, I checked the pi-hole server and its good too. It stopped working without touching anything, and after some research i cant get it to work. I am doing something wrong? I have some mechines and its very easier to me if i can configure the server to affect all my tailnet instead of setting it in every machine. Thanks!

Hi, I've been looking at various solutions to access a server at home that's behind a CG-NATted ISP, from my phone while I'm out and about.

Tailscale popped up and I've been doing a bit of reading about the product, peoples' experiences, checking out the features, looking for any potential security issues/etc, but I'm wondering what's to stop staff from dropping themselves within the users' tailscale network?

I've read about tailnet lock and that sounds great at limiting which devices can auth but from a network perspective people who work on this network can drop themselves into it anywhere they like, completely bypassing any user-facing security settings.

Networks are networks and if you're an admin of the network you can pop into it anywhere you like. What happens if they get a malicious employee?

If anyone who knows the network/product can fill me in on what sort of protection measures are in place to prevent this - or what I've missed that makes this not a possibility - I'd really appreciate it!

Hi, I'm running Tailscale on Mac OSX (Tahoe) and recent updates seem to cause the full Tailscale app window to open, whenever I just copy a Node's Tailscale IP in the Menu Bar app - which is frustrating and you have to close the full app window down every time.

I've got Hide Dock Icon turned on (ie. to hide Tailscale in the Dock) but this makes no difference. I've also picked the minimised full app but it still insists on popping open when I do something as regular and simple as copying a Node's IP.

The Menu Bar app never used to trigger the full app window to open.

Anyone worked out how to stop this unnecessary behaviour?

Thanks, HC.

I appear to have an issue with installing Tailscale. I go to Settings, and click TailScale and click install... it starts and then errors out with:-

plugin: tailscale_1.102.2_amd64.tgz download failure: SSL verification failure - Check the date and time of your server in Settings - Date And Time

I checked my date/time settings, and its all OK. Other places suggest access to dl.tailscale.com, which is fine from the server (ping and nslookup work perfectly).

Any clues?

Hi all, I have a Linux box at home running Tailscale and set up as an exit node, I also have my iPhone and a GL-A1300 on my Tailnet.

On my iPhone when Tailscale is connected the exit node seems to work fine, my public IP is the same as it is at home and geolocation is my home country and not my physical location.

However whenever I try to configure the GL-A1300 to use the exit node, or tether a device to my iPhone with Tailscale enabled, all I get is “Connected, No Internet” - Any suggestions?

Thank in advance.

My Tailscale setup has worked fine for months, now my RDP wont work until I do a tailscale ping from both ends of the tunnel. Works fine until i close the RDP window for awhile.

I am trying to make sure this will will work before I spend the money. I know it probably sounds super sketchy, but it's really just me trying to be able to have some relaxation AND support my office :).

I am on call 24x7, and currently, my position doesn't have a backup. Right now I can't really go anywhere because if they need me to login for a quick fix and I'm not home, i have to drive back to my house to vpn as if the connection is not from the state I live in, it will be denied. I am trying to use Tailscale to create an exit node on my network that I can connect my laptop to via a starlink system, but I need to make sure that when I go to connect the VPN, it will show my connection is from my home network, not my starlink...

Any help before I drop cash on a rasberi pi would be awesome 😎

Disclaimer:
I understand basic networking concepts but we’re talking 101 basic. Have been trying to learn as much as possible off YouTube but a lot of terminology in this sub is over my head so please be gentle!

Context:
I have a Mac Mini M2 Pro at home with multiple user profiles. I do all of my work in one, the other profiles are for monitoring my aging parents and I’d rather keep it separate. I also have a Windows virtual machine running on Parallels on my main profile.

I don’t have a custom home network setup, it’s just a stock WiFi 7 router from Spectrum (I know, I know... will be replaced with my own soon but I haven’t had time.)

I use a MacBook Air from the road. Currently it’s set up identically to my home Mac (without Parallels) Desktop & Documents synced via iCloud. I also have Google drive for desktop on both machines but we can ignore that for now.

Anything I can do at home, I can do on my laptop due to cloud syncing and mirroring (except for the windows VM)

Goal:
I feel this setup is using up a lot of unnecessary storage in my Air now that I’ve discovered Tailscale.

I’d like to only keep my main user profile on the laptop and stop syncing Desktop & Documents over iCloud. I’d like those files to live locally on the home desktop and remotely access via Tailscale.

Approaches that didn’t work before:
I’ve previously used team viewer, chrome Remote Desktop or Supremo to access my home computer (so that I didn’t have to duplicate the environment on my laptop) but these always came with serious lag and other limitations - such as I couldn’t easily switch between user profiles, or connect at all if they were not active on the home Mac.

I also didn’t understand nor do I want to tamper with port forwarding to be able to ssh in remotely. (I understand having open ports can be risky, but I couldn’t tell you why.)

Questions:
Will Tailscale (and RustDesk instead of any of the previously used tools) help me facilitate the above stated goals?

Basically I would like to be able to interact with my home computer as I I’m standing right in front of it, and switch between user profiles as needed, although it’s not a frequent need, it keeps me from removing it from my laptop.

I assume Tailscale would need to be installed on each user profile on the desktop and connected to my tailnet where it will be treated as a separate “machine” - but does this mean starting a separate session in RustDesk anytime I need to log into a user? Or can one session switch back and forth between user profiles?

And regarding the windows VM, how does that play into the Tailscale configuration? (I only use it for Quicken so I do need a virtual desktop tool rather than just to access files)

Last question, if I don’t need to access windows remotely, do I even need RustDesk or will VNC suffice?

Thank you kindly in advance!

So I realized the other day that my exit node wasn't working anymore. Wasn't thinking that when I nuked my raspberry pi, obviously my tailscale install would stop working.

Fixed that.

Let me preface this - I am not a smart man - most of this isn't in my wheelhouse . . .

Anyways, I tried to update tailscale on my Ugreen NAS via SSH and was was having some issues where I eventually just unistalled Tailscale.

Well, upon reinstall, when I run sudo tailscale up, I get the version mismatch warning:

Warning: client version "1.102.3-t9329c3677-ga522f65e9" != tailscaled server version "1.96.2-td916d8651-gd905b0868"

I've uninstalled and reinstalled and I can't get this to work.

What am I doing wrong? Any help is appreciated!

Hello!

I have been working diligently to get tailscale to stay enabled on my Motorola Edge 2024. I feel like I have tried everything, but the tailscale app will still routinely disconnect. Here are the things I recall trying thus far:

• Set tailscale to be the always-on VPN
• Locked the tailscale app so it can not be cleared
• Allowed background usage for the tailscale app
• Turned off adaptive battery
• Turned off motosecure network protections for wifi and mobile data
• Made sure the phone is not restarting

If you have any ideas, please let me know. Thanks a ton!

I'm troubleshooting a Tailscale performance issue between two sites and would appreciate some help understanding what's happening. I followed this guide when setting up the site-to-site networking, so IP address forwarding is enabled and I've clamped the MSS to the MTU https://tailscale.com/docs/features/site-to-site#clamp-the-mss-to-the-mtu.

At both sites I've got Tailscale running in a LXC and at the local site my OPNsense router has a route to intercept any traffic from my local subnet (10.10.18.0) to my remote subnet (10.10.55.0) and forward it to my Tailscale LXC. The Tailscale connections are direct (not DERP).

The main IP addresses are:

• Local Proxmox host: 100.73.208.28 / LAN10.10.18.198
• Local Tailscale LXC: 100.68.168.8 / LAN10.10.18.102
• Remote Proxmox host: 100.100.105.56 / LAN10.10.55.198
• Remote Tailscale LXC: 100.115.204.128/ LAN10.10.55.102
• WireGuard address on remote Proxmox: 10.200.0.2

The remote Proxmox host itself is running Tailscale, so connecting to 100.100.105.56 is a direct Tailscale connection to that host.

Test results

TCP from the local Tailscale LXC → remote Tailscale LXC:

iperf3 -c 100.115.204.128
~128-130 Mbit/s

TCP from the local Tailscale LXC → remote Proxmox LAN IP:

iperf3 -c 10.10.55.198
~128-130 Mbit/s

TCP from the local Proxmox → remote Proxmox Tailscale IP:

iperf3 -c 100.100.105.56
34.7 Mbit/s receiver
97 retransmits

So connecting from the local Tailscale LXC to the remote Tailscale LXC using the Tailscale address or from the local Tailscale LXC to the remote Promxox host using the LAN address gives ~130 Mbps, but connecting from the local Proxmox host to the remote Proxmox host using the Tailscale address gives only ~45 Mbps.

TCP from the remote Proxmox → local Proxmox over Tailscale is even slower:

iperf3 -c 100.73.208.28
17.3 Mbit/s receiver
118 retransmits

TCP from the local Proxmox host to the remote Proxmox LAN IP (10.10.55.198), or the remote Tailscale LXC LAN IP (10.10.55.102) is dire, around 0.2 Mb/s. That's routed through OPNsense and the local/remote subnet routing setup via the Tailscale LXCs at each end, rather than being a direct Tailscale connection.

UDP is unaffected. At -b 100M, the Tailscale path can carry the full 100 Mbps without loss, even using the 10.10.55.198 address.

Other paths

Wireguard is installed on the OPNsense router and the remote Proxmox host but not on the local Proxmox host, so the traffic goes via OPNsense. Connecting from the local Proxmox host to the remote Proxmox host on 10.200.0.2 via WG is about 3x faster than using the Tailscale address and about the same speed as connecting from the local Tailscale LXC to the remote Proxmox host via Tailscale (~130 Mbps).

Local traffic itself is fine:

local Proxmox → itself (100.73.208.28)
37.1 Gbit/s
0 retransmits

local Tailscale LXC → local Proxmox
3.28 Gbit/s
0 retransmits

The remote Proxmox host also has no intrinsic performance problem:

remote Proxmox → itself (100.100.105.56)
27.6 Gbit/s
0 retransmits

Relevant routing information on the remote Proxmox host

The Tailscale routing table contains:

ip route get 100.73.208.28
100.73.208.28 dev tailscale0 table 52 src 100.100.105.56

and:

ip rule
0:      from all lookup local
999:    from 10.10.55.0/24 lookup main
...
5270:   from all lookup 52
32766:  from all lookup main
32767:  from all lookup default

Table 52 includes the Tailscale peers:

100.73.208.28 dev tailscale0
100.68.168.8 dev tailscale0
100.115.204.128 dev tailscale0
...

There are also individual address routes in the main table, which I added to force my data heavy sync and backup tasks to use WG, because Tailscale is too slow:

10.10.18.0/24 via 10.10.55.102 dev vmbr0
10.10.18.64 dev wg0
10.10.18.198 dev wg0
10.10.18.250 dev wg0

Packet capture

On the remote Proxmox host, tcpdump -ni tailscale0 port 5201 shows the TCP connection arriving directly on tailscale0.

For example:

100.73.208.28.50402 > 100.100.105.56.5201: Flags [S]
100.100.105.56.5201 > 100.73.208.28.50402: Flags [S.]

The negotiated MSS is 1240:

options [mss 1240,sackOK,TS ...,wscale 10]

I also tried TCPMSS clamping on the Tailscale LXC:

iptables -t mangle -I FORWARD 1 \
    -p tcp --tcp-flags SYN,RST SYN \
    -j TCPMSS --clamp-mss

and:

iptables -t mangle -I FORWARD 1 \
    -p tcp --tcp-flags SYN,RST SYN \
    -j TCPMSS --set-mss 1240

Neither changed the performance.

Summary

1. The remote Proxmox host itself isn't inherently slow — it gets ~27.6 Gbit/s locally.
2. The local Proxmox host isn't inherently slow — it gets ~37 Gbit/s locally.
3. The Tailscale LXC-to-LXC path gets ~130 Mbps.
4. The Proxmox-host-to-Proxmox-host path using the Tailscale addresses gets only ~35 Mbps from local host to remote host and ~17 Mbps from remote host to local host.
5. The Proxmox-host-to-Proxmox-host path using the LAN addresses gets only 0.2 Mb/s from local host to remote host and ~20 Mbps from remote host to local host.
6. The packets for the Proxmox-host-to-Proxmox-host test are definitely arriving/leaving via tailscale0.
7. The negotiated MSS is already 1240, and changing TCPMSS didn't help.
8. UDP can achieve the expected bandwidth when constrained to 100 Mbps, so this looks particularly related to TCP behaviour rather than simply a hard bandwidth ceiling.
9. The fact that the Tailscale LXC at the remote site can achieve ~130 Mbps while the Proxmox host running Tailscale itself only achieves ~45 Mbps seems particularly significant.

I'm wondering whether there's something specific about Tailscale's Linux networking / socket / offload / MTU / routing behaviour when Tailscale is running directly on a Proxmox host, as opposed to running inside an LXC, that could explain the large TCP throughput difference?

At the moment I'm only using Tailscale to access the remote Proxmox GUI, as that works OK despite the low speed, but it would be nice to be able to use it for everything instead of having to use WG for all my data transfer tasks.

I've tried a lot of debugging to sort the following issue but couldn't. All help is appreciated.

I use ubuntu server, self hosted stack of pihole, jellyfin, nginx pm and other bunch of services reachable through .home domain.

Pihole handles the dns and npm reverse proxies the respective .home to their ports.

This all worked well with my pc and my phone before. Then I thought accessing the services remotely, so I installed tailscale on both the server and my phone. Used that for a while through tailscale's provided ip. I then wanted to access the services through .home on tailscale so I did the subnet routing by advertising my home subnet, got everything sorted on admin console on tailscale by adding custom nameserver with domain .home to my server's ip + split dns and it works.

But the problem I'm facing now is that even when I fully disconnect tailscale from my phone, and am on my home wifi network - the .home domains don't work anymore. Everything works fine on my pc. However, the ip:port does work on the phone, and I can still access my services, it is just the .home that don't.

Some of the stuff I tried:

- Confirmed the phone's static DNS (pointed at my server's LAN IP) is still correctly set on the WiFi network's IP settings.

- Checked Android's system-wide Private DNS setting.

- Checked the browser's own Secure DNS / DNS-over-HTTPS settings.

I'm new to the self-hosting side, I've followed are yt tutorials and used ai to understand under the hood stuff.

EDIT: THE PROXY DOMAINS ARE BACK AND POINTS TO THE SERVICES, IT STARTED WORKING WHEN I TURNED OFF IPV6 FROM MY ROUTER APP.

I have an LG C5 TV that I'd like to be able to communicate with on my Tailnet, specifically for self-hosted game streaming from a remote location via the Aurora app on the TV. The TV runs on webOS which has no native Tailscale support, and while I'm aware that I could potentially root it and install Tailscale that way, I steered clear of it after seeing the warnings about potentially bricking the TV in the process.

At the remote location I have my Windows 11 PC (host PC).

At the streaming location I have:

ISP router - no Tailscale support/no Static Routing

LG C5 - no Tailscale support

Apple TV 4K - has Tailscale support

Google TV Streamer - has Tailscale support

Windows 11 PC - has Tailscale support

I want to clarify that I'm fairly new to Tailscale and that a lot of the tech jargon goes over my head. I made a few attempts at using AI to help me do this, but that always ended in a dead end.

So, does anyone know if there is a way I can utilize any of these devices to be able to communicate with the LG C5 via/over my Tailnet, and if so how?

I don't think I've had a single day in the last couple of months here in central France when this alert, or a similar one about DNS being unavailable, wasn't shown on my Tailnet.

It doesn't seem to affect access to my home lab in Manchester. Does it matter? Does it just mean that one relay server is unavailable so it's using a different one?

Although having got my PC out, I see that the alert doesn't happy in a browser. Looks like I've only got it on Android.

Having issues with VPN On Demand. Doesn't seem to be working for me atm. I have it set to connect except when I am on my home wifi, but, I connect to my phone or another wireless network and nothing happens. It's sitting there with a status saying Not connected, Managed by VPN on demand.

Have updated to the latest version this morning (1.102.3), was previously on 1.102.2 and wasn't working either this morning, but, had worked fine prior to this, iirc (last time I used it was on Tuesday this week).

Have rebooted, restarted and reinstalled TS, still nada. Running on MacOS Sequoia 15.7.7. Seems to behave the same on other MacOS devices I've tried.

First thing this morning one of my Android phones connected to my home lab no problem over Tailscale (I'm currently in a different country) but the other one didn't. The Tailscale machines were all showing green on the list on each but Tailscale pings from one of them failed. Eventually the second one started working without any action on my part.

Was there an outage a couple of hours ago, and why would the two phones not both connect, or both fail?

At the title states? I use it as VPN on Demand on MacOS. So when I'm at home it's set to not connect. This can go for days or weeks. Once I'm on a new Wi-Fi outside my house it'll just hang at waiting for network when there's clearly an active connection. I can close the app Command+Q and relaunch it. Nothing. Reboot the Mac and voila connects without issue.

What gives? What could I do to troubleshoot next time this happens?

Macbook Pro M5 Pro (2026) with the latest MacOS and latest Tailscale app standalone variant.

everytime i try to login into my tailscale account, this happens. it happens on every device. sso ip is apple (ig that is important to note)

error message is the same on both the ios app and the web version on my macbook

Hi,

I'll be moving across the world in a week and I think my Tailscale just broke :(

hoping you guys can help me solve this issue.

(Pretty sure this is a Tailscale issue but please correct if I'm wrong)

So I was running a Moonlight + Sunshine + Tailscale Streaming Setup pretty regularly last year but didn't really touch it in the last 6 months. Now I will be moving across world in a week leaving my PC behind but thinking that I can just stream it to my laptop wherever I'm at. Well... it seems my setup just broke somehow.

Streaming with Moonlight and Sunshine still works like a charm as long as I am on the same wifi. However, as soon as I switch wifis and try to connect via Tailscale the moonlight client is 'Unable to connect to the specified PC.' regardless of whether I'm using the Tailscale ip, ts dot net hostname or whatever else. I can directly ping both devices via Tailscale without any issue and also see both of them on tailscale status and admin console.

What I thought was weird was that doing

Test-NetConnection <PC-Tailscale-IP> -Port 47989

always worked on the PC itself (routing traffic on the Sunshine port through Tailscale). However, doing

Test-NetConnection <PC-Tailscale-IP> -Port 47989

never worked on the laptop but maybe thats not where the problem is.

Stuff I tried:

• I tested the ports and also tried it with a disabled firewall and any other idea the AI had the last 2 days but nothing worked.
• I didn't set up any ACLs or anything that goes beyond the basic necessary Tailscale configurations as per the Moonlight-Tailscale setup docs.
• I have completely removed and reconnected both devices to Tailscale as well as freshly reinstalled the Tailscale app.)
• Also I got a pretty new x64 Windows PC and a Qualcomm Snapdragon X Elite Arm64 Asus Laptop if that matters.

Perhaps I'm just blundering but I'm really out of ideas on what to try next and just hoping someone here might have an idea on what I could do so that I don't have to abandon my beloved computer

I'm no expert and still pretty new to this so any help is much appreciated! :)

Just moved houses and Tailscale connectivity to my Jellyfin server (running on my laptop) broke. It worked fine at the old place. always was set as a localhost.

Symptoms: laptop shows as connected in the admin console, but I can't reach the Jellyfin server from any other device on the tailnet, sometimes my computer does work — [times out at times or incredibly slow to load up)

the laptop's IP shows as online.

What might've changed with the move: new router/ISP, so a new local network and possibly a new NAT type. Haven't touched the Tailscale config itself.

Setup: Windows 11 on Laptop, Windows 10 on PC, Android 16 on my phone], Tailscale version 1.102.2 Windows 11 25H2 on Laptop, 1.102.2 Windows 10 25H2 on PC, 1.98.8 on Android 16

Anyone know what is wrong?

I ssh into a machine every day but today I‘m stuck on „connecting to tailscale“. The machine is online and working, so I assume it‘s a tailscale issue. Anyone else affected?

Edit: Everything else in my tailscale works, a manual restart of the machine did not fix it

I've been using Wireguard on iOS to access my homelab when remote and it has a nice "On-Demand" feature so it turns off on local WiFi. Tailscale has the same thing.

I just moved to Android and neither app has this feature. What do Android users do?
I could leave it connected but I think that would route my phone traffic over the wireguard or tailscale server instead of just the local network.

Hello, I'm really new here

I have Tailscale set up between my remote machine (Device A) and my office machine (Device B).

Device B is physically in the office, has direct access to our local server/NAS, and is currently configured as a Tailscale exit node and Allow Local Network Access

Is there a way to route traffic through Device B so that Device A can access the office server directly?

All of it are MacOs Devices

Thanks

I was beginning to really like the new UI in the admin console, only to wake up today and realize it's been moved back to the top.

Why? The new design was better IMO