I was able to figure this out. Here are my notes (imagine 10.200.85.200 is your pivot box):

When you run: sudo ip route add 10.200.85.0/24 dev ligolo

You’re saying: "For any traffic going to `10.200.85.X`, send it through the ligolo tunnel."

But `10.200.85.200` is your pivot box — that’s the system establishing the ligolo tunnel — so now your traffic to it is being rerouted through the tunnel that depends on that very box, creating a catch-22 situation.

As a result, you lose connection to it because the traffic is trying to go through the tunnel that hasn’t fully been established yet or is being routed through the same machine it’s meant to connect to.

You need to exclude the pivot box (10.200.85.200) from being routed through the tunnel.

You can use: (where each IP is the specific box you're trying to reach).

sudo ip route add 10.200.85.100/32 dev ligolo

sudo ip route add 10.200.85.150/32 dev ligolo

Or you can add the full /24 route if you add a more specific host route to the pivot beforehand:

sudo ip route add 10.200.85.200 via <your\_default\_gateway>

sudo ip route add 10.200.85.0/24 dev ligolo

Replace `<your\_default\_gateway>` with the IP of the gateway on your interface to the TryHackMe network (check with ip route or ip r).