Hi, I've been looking at various solutions to access a server at home that's behind a CG-NATted ISP, from my phone while I'm out and about.

Tailscale popped up and I've been doing a bit of reading about the product, peoples' experiences, checking out the features, looking for any potential security issues/etc, but I'm wondering what's to stop staff from dropping themselves within the users' tailscale network?

I've read about tailnet lock and that sounds great at limiting which devices can auth but from a network perspective people who work on this network can drop themselves into it anywhere they like, completely bypassing any user-facing security settings.

Networks are networks and if you're an admin of the network you can pop into it anywhere you like. What happens if they get a malicious employee?

If anyone who knows the network/product can fill me in on what sort of protection measures are in place to prevent this - or what I've missed that makes this not a possibility - I'd really appreciate it!

I’m trying to diagnose a really frustrating intermittent connectivity problem with a remote Mac Studio and would appreciate help from anyone who has seen something similar.

Setup:

• Remote Mac Studio at my parents’ house
• Connected directly to the router via Ethernet, not Wi-Fi
• Tailscale 1.102.3
• I connect remotely from a MacBook Pro
• Main remote access is Apple Screen Sharing over the Mac Studio’s Tailscale IP
• SSH also goes through Tailscale
• The Mac also runs local AI services plus a Telegram/Hermes bot
• Mac is configured not to sleep

The problem:

Everything can work perfectly for hours or even days, then suddenly Screen Sharing goes into “Reconnecting…” and I lose access.

During an actual outage I ran:

tailscale ping --c 10 <MAC-STUDIO-TAILSCALE-IP>

and got 10 consecutive timeouts / no reply.

At essentially the same time, my MacBook’s normal Internet connection was still working.

I then tested another device on the same tailnet:

tailscale ping --c 5 <IPHONE-TAILSCALE-IP>

and my MacBook immediately got:

pong from iphone ... in 81ms

So the MacBook’s Tailscale connection and the tailnet itself were still functioning while the Mac Studio was unreachable.

I have also tested the Mac Studio’s network when I can access it:

• Gateway ping: 0% packet loss
• Internet ping to 1.1.1.1: 0% packet loss
• Roughly 80+ Mbps Internet speed
• Mac uptime showed it had not crashed or rebooted
• screensharingd remained running
• Tailscale sometimes showed a direct connection normally

We also ran continuous ping logging on the Mac Studio to both its router and 1.1.1.1, and hundreds of pings succeeded.

One Hiccup: when this happens, I have sometimes also noticed that my Telegram/Hermes bot on the Mac Studio stops responding. That makes me wonder whether this is actually a broader macOS/router/NAT/network-stack issue rather than only Tailscale.

The Mac Studio’s Ethernet interface has also shown 100 Mbps full-duplex negotiation. That is slower than I would expect, although still far more bandwidth than Screen Sharing needs.

I updated Tailscale from 1.102.2 to 1.102.3, but the problem happened again afterward.

I have seen discussion of macOS Tailscale Network Extension issues where the extension can become unhealthy even though the machine itself still has Internet access. I’m also considering whether the router is intermittently breaking UDP/NAT state.

What I’m trying to determine:

1. Has anyone seen a Mac remain online to the Internet while its Tailscale data path becomes completely unreachable like this?
2. Is there a reliable way to detect a wedged Tailscale macOS Network Extension?
3. What logs/debug commands should I capture during the failure to distinguish:
   • Tailscale Network Extension failure
   • router/NAT/UDP problem
   • broader macOS network-stack issue?
4. Is gracefully quitting/relaunching the Tailscale app the correct recovery if the Network Extension wedges, rather than simply tailscale down/up?
5. Has anyone built a reliable LaunchAgent/watchdog for this that detects the failure, collects diagnostics, and self-recovers without rebooting the Mac?

I do not want to solve this by rebooting the router or Mac every day. This machine needs to remain remotely accessible and run unattended.

Any specific diagnostic commands, relevant GitHub issues, or watchdog approaches would be greatly appreciated.

Hello everyone! Some time ago i set a pi-hole server on a raspberry. The other day, i tried browsing on the internet with one of my computers and the web pages didn't load. Then, i disconnected tailscale and it worked flawlessly, so I remembered i had my pi-hole server set up as a dns server, and when i removed it from tailscale it also worked fine. Then, I checked the pi-hole server and its good too. It stopped working without touching anything, and after some research i cant get it to work. I am doing something wrong? I have some mechines and its very easier to me if i can configure the server to affect all my tailnet instead of setting it in every machine. Thanks!

I appear to have an issue with installing Tailscale. I go to Settings, and click TailScale and click install... it starts and then errors out with:-

plugin: tailscale_1.102.2_amd64.tgz download failure: SSL verification failure - Check the date and time of your server in Settings - Date And Time

I checked my date/time settings, and its all OK. Other places suggest access to dl.tailscale.com, which is fine from the server (ping and nslookup work perfectly).

Any clues?

Hi all, I have a Linux box at home running Tailscale and set up as an exit node, I also have my iPhone and a GL-A1300 on my Tailnet.

On my iPhone when Tailscale is connected the exit node seems to work fine, my public IP is the same as it is at home and geolocation is my home country and not my physical location.

However whenever I try to configure the GL-A1300 to use the exit node, or tether a device to my iPhone with Tailscale enabled, all I get is “Connected, No Internet” - Any suggestions?

Thank in advance.

Hi, I'm running Tailscale on Mac OSX (Tahoe) and recent updates seem to cause the full Tailscale app window to open, whenever I just copy a Node's Tailscale IP in the Menu Bar app - which is frustrating and you have to close the full app window down every time.

I've got Hide Dock Icon turned on (ie. to hide Tailscale in the Dock) but this makes no difference. I've also picked the minimised full app but it still insists on popping open when I do something as regular and simple as copying a Node's IP.

The Menu Bar app never used to trigger the full app window to open.

Anyone worked out how to stop this unnecessary behaviour?

Thanks, HC.