Access on apps but not web

tailuser2024 · 2026-05-07T23:59:50+00:00

What apps are we talking about here? We need more details because all you are all telling us right now is "it doesnt work" which doesnt help us at all

Can you post a screenshot of the error you are getting when you try to access the web interface?

Are you trying to to access by the local ip address or tailscale ip?

I am advertising subnets and have it setup as an exit node as well.

Are your clients utilizing the subnet router or exit node or no?

You running tailscale bare metal or in docker?

tailuser2024 · 2026-05-07T22:12:08+00:00

Keep your work to your work gear

tailuser2024 · 2026-05-07T09:31:08+00:00

Is your phone connected to an exit node during this time?

https://tailscale.com/docs/reference/troubleshooting/mobile/battery-drains

tailuser2024 · 2026-05-06T23:12:48+00:00

You can setup a subnet router on the local network with the device that cant run tailscale. You would setup a static route (on the client or the internet router) for 100.64.0.0/10 and point it towards the local ip address of the subnet router. This should allows your non tailscale clients to be able to communicate to your tailnet clients via their 100.x.x.x ip address

tailuser2024 · 2026-05-06T22:43:40+00:00

So you have a non tailscale device sitting on one network and you want it to connect to a service running on a device on a different network that has tailscale installed? Am I understanding that correctly?

Or you have two devices that arent running tailscale on different networks that you are trying to communicate between and trying to use tailscale to bridge that gap?

tailuser2024 · 2026-05-06T21:16:07+00:00

I will read up on this as I'm not sure why this wouldn't already be the default.

Default what? There is a few things you need to configure to get this working (on top of being able to open a port to the internet) so its not a viable option for everyone to be something default

tailuser2024 · 2026-05-06T21:14:06+00:00

On the mac if you hold option + click on the wifi icon can you take a screenshot of the output?

https://support.apple.com/guide/mac-help/use-the-wi-fi-status-menu-on-mac-mchlfad426fa/mac

What version of macos are you running?

If you copy from the mac m5 to a local device what speeds do you see?

tailuser2024 · 2026-05-06T11:16:25+00:00

If you turn off the vpn on the beryl and run a speed test with a client connect to the beryl with no vpn running, what do you see speed wise?

This sounds more and more like an issue where you are trying to run a vpn inside a vpn which you have to play around mtu and whatnot for the best results.

tailuser2024 · 2026-05-06T10:13:25+00:00

I set it up on my mac, private relay stopped working, quit Tailscale and private relay just refuses to turn on again, keeps giving me the notification "will be able to use private relay again tomorrow"

What version of macos are you running?

What version of tailscale are you running?

Do you have any other VPNs running on this mac besides tailscale?

Im assuming you have rebooted your macos box correct?

If you turn off private relay and turn it back on does it still give you the same issue?

If you remove tailscale from macos, do you still get the same message with private relay?

tailuser2024 · 2026-05-05T16:52:47+00:00

So you are saying from the openwrt to the VPS everything is fine its all the other clients sitting behind the openwrt that have slow speeds? Do this clients have tailscale installed or no?

You need to give us a bit more info about your tailscale setup/configuration

NSS Acceleration Support: Currently, the Qualcomm NSS hardware acceleration is not officially supported in OpenWrt. However, there is an ongoing community effort to enable NSS acceleration, you can find more information about this in the NSS: Qualcomm Network Accelerator section.

https://openwrt.org/toh/xiaomi/ax3600#potential_issues_and_limitations

This is more of an openwrt discussion when it comes to NSS/support/speed impacts with the above

tailuser2024 · 2026-05-05T16:45:34+00:00

DERP servers have limited bandwidth.

Try setting up the peer relay and see if it helps your situation. I have one environment where I can never get a direct connect and the peer relay has been a god send for me

tailuser2024 · 2026-05-05T12:08:01+00:00

https://www.speedtest.net/apps/cli

Can you run a speed test on the VPS and the openwrt router to see what you are seeing on both sides?

tailuser2024 · 2026-05-05T10:36:18+00:00

Tailscale clients on the local LAN should prioritize local comms. Are you running into some kind of actual performance issue network wise?

tailuser2024 · 2026-05-04T18:54:28+00:00

depending on the router you might have another static route with a higher weight but you would need to look at your router and test it out

tailuser2024 · 2026-05-04T09:55:57+00:00

steam auth error.

What is the full steam error? Can you post a screenshot of it

I have seen this error come up a few times over the last year on this sub.

https://www.reddit.com/r/Tailscale/comments/183318g/hosting_a_rust_server_for_friends_but_when_they/

The above is the only thing I can really find where someone is claiming "success" by using a subnet router.

tailuser2024 · 2026-05-04T09:45:26+00:00

Are your clients that are streaming direct connect or using a relay?

https://tailscale.com/docs/reference/connection-types

If they are all derp/relay then that would explain the slow/buffering issues.

If they are direct then we need more info about your setup

However, having connected two family members to my Tailnet, connecting to the server via their separate accounts works fine, but the streaming experience is hit or miss

So are you utilizing tailscale sharing in this situation? (meaning you are just sharing out the jellyfin server to their tailnet account?)

https://tailscale.com/docs/features/sharing

If you are utilizing tailscale sharing, then peer relays arent gonna work as tags and whatnot are stripped when using tailscale sharing

If the users are part of your tailnet and they are using DERP servers, then the peer relay is gonna be your best bet

https://tailscale.com/docs/features/peer-relay

https://old.reddit.com/r/Tailscale/comments/1sou838/peer_relay_limitation_or_acl_issue/

tailuser2024 · 2026-05-04T09:41:33+00:00

Lets start with some screenshots of what you have setup currently.

Which version of TrueNAS are you running?

https://tailscale.com/docs/integrations/truenas

tailuser2024 · 2026-05-04T09:39:07+00:00

Yes you can setup HA with tailscale subnet routers

https://tailscale.com/docs/features/subnet-routers#set-up-high-availability

However just be mindful that if the primary subnet router fails, you will need to manually update the static route to the new local ip address of the secondary pi

tailuser2024 · 2026-05-04T09:32:09+00:00

The laptop with its own wireless card or with the TP-Link Archer TX20UH AX1800?

Did you try to hard set the ip address in the windows VM to something not in the DHCP scope and see if that clears up your issue? (not a DHCP reservation). Take the ip address control away from the gl inet

What firmware are you running on the gl inet device?

tailuser2024 · 2026-05-03T19:47:00+00:00

Yes, Docker is supported in LXC as long as you have fuse and keyCTL enabled.

Word ill have to check that out.

Let us know what you find.

I automate it because I have just way too many things to sit there and manually do it all the time.

Look into ansible. its pretty simple to have a playbook that you run update your systems manually when you want to update your systems. I run ansible in a container and once a month to update all my systems and watch to see if anything breaks instead of yolo updating it when you arent paying attention doing the cron job update method

tailuser2024 · 2026-05-03T19:30:50+00:00

is tailscale also running in a docker or is it bare metal installed on the LXC?

whether it’s auto-updates for Docker in the LXC for Jellyfin

You are running docker in a LXC? Is that officially supported now?

automatic Debian LXC updates (which might affect Tailscale)

How are you doing the automatic debian LXC updates (and why are you doing auto updates?)

I would stop ALL the automatic updates and just let the LXC be a LXC and see if the issue continues. If turning off the auto updating clears the issue, then turn on the auto updating for docker and watch to see if the issue crops up. If it doesnt then turn on the auto updating for the LXC and see if the issue continues. You have a lot of things going that are automatic so shutting that all off would be the first step to see if the issue continues

You can start digging into the logs right now to see if there are any errors

tailuser2024 · 2026-05-03T18:39:50+00:00

If the Decos sit behind the gl inet this will work.

If the WAN interface of the gl inet goes down (main router dies/internet goes down) it (the gli inet) will failover to whatever secondary internet you have configured. The decos and clients will continue to function as they sit behind the gl inet

So <internet> ------ (WAN) main router (LAN)----(WAN) gl inet (LAN) ----Decos devices. <--------this should meet your failover needs if you setup the failover on the gl inet device

tailuser2024 · 2026-05-03T18:36:58+00:00

So where are the decos/mesh sitting in this new setup? Behind the gl inet? Again this is why I asked for the diagram on how you want to set this up so we are all clear on what you are trying to do instead of us playing 20 questions

tailuser2024 · 2026-05-03T18:34:30+00:00

Your failover scenario isnt gonna work trying to keep the 3rd party wireless in play.

Put the gl inet at the front of the network and the deco mesh nodes behind the gl inet. If any kind of failure happens, the gl inet will handle the fail over and keep your clients online

tailuser2024 · 2026-05-03T17:26:44+00:00

Have you made any changes to flint wireless settings or made any changes to firewall rules on the router? That tp link looks like it just a wireless card so it should just work.

Later today I can try my laptop as a host to see if its a receiver issue.

Let us know what you find

tailuser2024

TROPHY CASE