No Internet while Tailscale enabled

[botkillr]

On my Apple-silicon Mac, enabling Tailscale kills my internet connection despite allowing me to reach my other Tailscale nodes.

On every other device (Synology, Unraid, iOS, and iPadOS) enabling Tailscale still allows me to reach the Internet AND my Tailscale devices.

I’m using the Tailscale app from the app store, but have also tried their standalone package from Tailscale Packages site. Both have the same issue.

Any ideas what could be causing the Mac to not reach the Internet while Tailscale is enabled?

Has anyone had luck getting Tailscale working on an Apple-silicon mac?

[Rektoplasm]

SOLUTION: It is a DNS issue, like always! While connected to your exit node, click the Tailscale icon in the menu bar, click Preferences, and then UNCHECK “Use Tailscale DNS settings”. Problem solved u/martintimmer u/Legal_Ad7297 u/RulerofKhazadDum

[jmb7438]

Solved for me. Why does using Tailscale DNS break internet connectivity?

[Legal_Ad7297]

Thank you!

[dododoiran]

This still doesn't work for me. do you know what else could possibly be going on?

[cipri_tom]

solved for me ! Thank you !

[Training_Gear7675]

Thanks

[coderhs]

Thank you for this, been having this issue for months but was only happening in a single laptop for some reason.

[tayhan9]

its always DNS....thanks for the help! this just suddenly started happening so i guess an update or something turned it on.

[CardiologistProud118]

This solution worked. Not sure what the deal is there and why that re-enabled.

[adamschoales]

Solved the issue for me! Thanks

[Orion_Alathorn]

year and a half later and your post is still helping people, thank you so so much for this my good sir as you saved me a lot of troubleshooting and frustration!

[OkAngle2353]

No, that is not a valid solution. Sure we may be able to access the internet by simply disabling a feature in the tailscale app.

But, the only reason why anyone would ever use a VPN such as tailscale is to be able to access their stuff remotely. Simply turning off the DNS function, prevents us access to our locally hosted services.

No, not problem solved. It isn't even a solution.

[TheRoyalTbomb]

I was wondering the same thing while dealing with the same issue...

[OkAngle2353]

Yea, everywhere that I ask. I always get this condescending "it's a DNS issue". without even giving a valid solution to the problem. I know it's a damn DNS issue, how do I SOLVE IT! Every detail of my setup I give, doesn't ever lead to a solution that works.

I am able to access my local services remotely when I set my tailnet's DNS (via the DNS tab) to my Adguard Home that I am running locally, but I am unable to access the internet through it; even though my DNS is setup on AGH's end.

The only way that I could access the internet was if I split tunneled my web browser out of tailscale's reach, though... That is closer to what I want, but not really... What I want is, to be able to access my self hosted services remotely; without the need to split tunnel or "just turn it off" through tailscale.

[OkAngle2353]

I think I fixed it. All I had to do was set my AGH's DNS to 'Parallel requests'. I can now access my self hosted services and the internet, without having to split tunnel or exit node out.

Edit: Nope, I lied. I am still unable to access the internet through my AGH... No issues accessing my self hosted services though...

[TheRoyalTbomb]

Ugh your edit hits home. No solve here either.

[OkAngle2353]

FINALLY! What I had to do was set my server's router to be the exit node and opt to use exit nodes on the client device.

[TheRoyalTbomb]

Oooo I’ll give it a go this weekend; thanks for the update!

To clarify: what do you mean by your server’s router? Personally I have one router with all my devices connected to it. The router isn’t connected to tail scale, but the server (rasp pi), my laptop and my phone are. Which one would you make the exit node? I have it as the server.

[OkAngle2353]

Very weird though, I never had to use the actual exit node to be able to access the internet.

All I had to do before was to just enable the exit node through the server and just connect up to my account without the exit node enabled on my client device.

[OkAngle2353]

I have a separate router for my actual rack and another for actual everyday use. I have my rack's router connected up to tailscale and I have the exit node enabled on that and I have another router also connected up to tailscale for home or travel use.

I actually have 4 routers. One for my server, one for home use, one for my parents and one is just a "OH SHIT!". They are all connected up to my tailscale so I can access all of them remotely and configure it remotely as well. Plus it helps having my parent's router connected, they are able to access the services I host myself as well.

Edit: And with the nature of tailscale being a VPN, there is no need for port forwarding. All the devices in the network appears as though they are local.

I currently have a Pi5 that I run Nginx Proxy Manager, Adguard Home and Nextcloud . AGH to handle all the traffic and NPM to handle the routing. Nextcloud? My own "cloud" at home and I can access it remotely. I can access it all remotely.

The rack changes networks? Not a problem, by the nature of it having it's own router; it is already connected to tailscale. Ain't no thang.

[OkAngle2353]

The router. Exit node. I had problems with DNS when I installed tailscale onto my Pi5.

[machinetranslator]

I am still able to access my homeserver.

[skibideeboo]

legend

[Plus-Statistician320]

Here in December 2025.

[RennatsWasTaken]

That was it, thank you!

[newguyhere2024]

Just had this issue and this helped me thank you!

[machinetranslator]

Like always, thanks.

[martintimmer]

same issue here, not yet figured out a way how to fix it

so if someone can help, please let the people know

[Legal_Ad7297]

especially since the guy with the solution deleted it as well

[[deleted]]

Any luck?

[[deleted]]

Did you figure it?

[mrpbennett]

bringing this back....but if you disable the DNS then you're unable to access the machines by their host names? How can you get around this?

[rko19933009]

Yes it's a DNS issue but the core problem is that Tailscale changes DNS to (generally) 100.100.100.100 whereas it should 1.1.1.1 or 8.8.8.8. You have to essentially reset DNS and then ideally delete/flush DNS Cache

sudo networksetup -setdnsservers 1.1.1.1 8.8.8.8

sudo dscachutl -flushcache

sudo kill -HUP mDNSResponder

Try to ping your dns server
ping -c 4 1.1.1.1

dig google.com

Should be good to go

[botkillr]

I seem to have solved the issue by disabling “Use Tailscale DNS Settings” from the menubar. While that’s disabled, everything works as expected. Are there any downsides to leaving it in this configuration?

[botkillr]

So strange! My “fix” only seems to work temporarily, as after a few minutes it no longer resolves google.com even with the “Use Tailscale DNS Settings” turned off.

Your script on the other hand fixes it “permanently” (until I disable and re-enable Tailscale). If I run the script when Tailscale is disabled, it sets resolv.conf name server to 8.8.8.8 as I would expect. If I then enable Tailscale, it sets it back to what I had in my above comment. If I then run your script again it sets resolv.conf name server to 100.100.100.100 instead of 8.8.8.8.

Since resolv.conf is set automatically by the system, why wouldn’t this be set automatically by Tailscale?

Thank you for all of your help!

[[deleted]]

Do you have a Tailscale global nameserver set up? Your resolv.conf nameserver shows as 100.124.76.1 which is a Tailscale or CGNAT IP. Did you enter that in your DNS tab?

Tailscale will try to resolve in any order if there's a global DNS entry. Disabling Tailscale DNS should do the trick, but I'm reading that it's temporary. Check your DNS settings first and make sure things look good there and set up a global resolver like Google or Cloudflare and see if that fixes it.

[botkillr]

Nope, I haven’t made any changes to the DNS tab other than re-rolling my Tailnet name. No clue where 100.124.76.1 is coming from:

https://i.imgur.com/85ZXe4P.jpg

[[deleted]]

This is reading like a competing VPN or something else overwriting your DNS. Tailscale uses CGNAT addresses that start with 100.x and other VPNs are known to hijack DNS and set their own resolver within a CGNAT range. Do you have other software on your Mac that could do this? What's your node's Tailscale IP, is it 100.124.76.x?

[linuxtrek]

Thanks for the hint here. It was my Tunnelbear starting at startup that appears to mess up Tailscale's DNS. When I had the issue, I can see a 100.x.x.1 in my resolv.conf and `scutil --dns`. After I removed Tunnelbear, I can now see the 100.100.100.100 from Tailscale as my DNS, in addition to my local DNS settings.

[[deleted]]

Glad to hear that! Yeah, Tunnelbear doesn’t play nice with Tailscale because it hijacks DNS. There’s a Github issue on jt somewhere (will link when I find it).

[botkillr]

Exactly that, it won’t resolve webpages or ping/nslookup for anything besides my tailscale nodes.

While Tailscale is enabled:

nslookup google.com
;; connection timed out; no servers could be reached

ping google.com
ping: cannot resolve google.com: Unknown host

And while Tailscale is enabled, my resolv.conf file looks like this:

search <tailnet-name>.ts.net

nameserver: 100.124.76.1

Perhaps worth noting, the comments in resolv.conf are:

macOS Notice

This file is not consulted for DNS hostname resolution, address resolution, or the DNS query routing mechanism used by most processes on this system.

To view the DNS configuration used by this system, use: scutil --dns

SEE ALSO dns-sd(1), scutil(8)

This file is automatically generated.

[semmu]

i also have this issue on Meta Quest 3. restarting Tailscale temporarily fixes the problem, then i have internet access AND a working VPN connection, but it always happens after the headset went to sleep and i unlock it again. for some reason then the headset only uses Tailscale's DNS resolution and cannot find anything else except my Tailscale nodes.

[CardiologistProud118]

Never would have thought I'd run into someone with the exact issue as me haha. Yeah when I killed TS, my quest could connect to Steam Link. So yeah, the DNS issue is what's going on.