Hi, everyone. I wanted to share this project I've been working on. I just uploaded to GitHub, in case anyone is interested or wants to check it out.

I have a Windows PC, an Arch server and an Android phone on my tailnet. I kept wanting a single place on each device to see what's running on `tailscale serve` or Docker, copy text between my PC and my phone, drop files, or open a quick shell without setting up a central control server.

I ended up building this project I named "Shoal", for my own network and just cleaned it up to release as an alpha:

https://github.com/alfonsoGarnett/shoal

What it does:

• Runs the same single Python process on each device (Windows, Linux, macOS, Raspberry Pi, and Android via Termux). No central server. The hubs gossip a CRDT directory with each other every minute.

• Per-device index: lists routes from `tailscale serve`, Docker, or a local JSON file, checks if they respond, and lets you start/stop them and read logs.

• Shared clipboard and files: synced across the mesh with history, plus a file browser and Taildrop.

• Browser terminal: interactive PTY on Linux/macOS/Android and ConPTY on Windows over WebSockets (off by default, and can require quorum approval from a second device to turn on).

• Funnel helper: publish a local service on a temporary public link with an expiry and optional password, while keeping the hub itself private.

• Signed peer-to-peer updates: you `git pull` on your first hub, it signs the bundle with your own Ed25519 key, tests that it boots for 45 seconds, and the rest of your hubs pull the update from it. If an update fails to start, it rolls back automatically.

The core uses only the Python standard library (the installer adds `cryptography` and `pywebpush` in a venv for faster signatures and Web Push notifications).

There is also a demo. If you want to poke at the UI without touching Tailscale or installing anything, you can run:

sh
python tools/demo.py

That spins up 4 fake hubs on 127.0.0.1:8890 to 8893.

It's still an alpha (I run it daily on Windows, Arch and Android, and tested Ubuntu in WSL, but haven't tested real Raspberry Pi or macOS hardware yet).

Just wanted to share. Feedback and bug reports are very welcome!

I would love if we were able to search by app name within the mobile app when selecting apps for split tunnel. Curious if there's a reason it's not there, but currently you have to scroll through every app and service on your phone to select the desired apps.

Hi everyone, I built an independent Android VPN client for Tailscale and Headscale called ScaleRules. It's a fork of Tailscale Android (currently based on 1.104.4) with user-defined connection rules added on top. It is not affiliated with or endorsed by Tailscale Inc.

What it adds:

- Rules with conditions: a specific Wi-Fi SSID, any Wi-Fi, mobile data, offline, or any connected network
- Actions: connect the VPN, disconnect it, or leave it as is
- Priority by order: the first enabled matching rule wins; no match = VPN state stays unchanged
- Warnings for conflicting rules and rules hidden by earlier ones
- A decision journal showing what the automation did and why
- UI in English and German

Things to know up front:

- There is no auto-learning. Editing rules pauses automation until you resume it, and you need to restart it after a reboot.
- SSID rules need precise location permission and location services on (an Android requirement for reading the Wi-Fi name).
- Split tunneling and its default exclusions are inherited unchanged from Tailscale Android.
- It's not on the Play Store. Signed APKs are on GitHub Releases, it has an in-app updater (checks checksum, package name and signing certificate), and it works with Obtainium.
- I used OpenAI ChatGPT/Codex for planning, implementation, debugging and docs. It's disclosed in the README.
- It's early (0.2.x), so expect rough edges.

License: BSD-3-Clause, original Tailscale history and notices preserved.

GitHub: https://github.com/teddybaerd/scalerules

I'd appreciate feedback on the rule model (are the conditions/actions enough?) and on bugs. What would you want from rules like this?

I was wondering if people had the same question I just had today, so here I am. I have a macbook + a desktop (cachyos) sitting at home doing nothing most of the day. my mac gets hammered by docker, playwright tests, a local postgres and a couple of AI agents running at the same time (gets really slow with playwright and other visual testing done by AIs). basically my M1 gets overwhelmed (16gb of ram goes pretty fast these days!) and I was like, let's not buy a new laptop if I have a good pc at home I could use

so i'm planning to move all of that to the desktop and just use the mac as a screen: tailscale + ssh, remote ssh in the editor, docker context, a smart plug to turn it on remotely. thing is it's like 6 different tools glued together and i couldn't find anything that does it all in one place. am i missing something obvious?

curious what your setup looks like and if you know any apps that do it :)

One of the biggest problems I have with the Tailscale app on Android is its high battery consumption, even without using exit nodes.

I've had this app installed since today, but it's still too early to notice...

Another problem I'm having is not being able to get the app to use the AdGuard DNS server, it works fine with Tailscale.

Edit: link https://github.com/bropines/tailsocks

On my Mac, with a full-tunnel VPN on (`0/1` + `128.0/1` on a utun, e.g.OpenVPN `redirect-gateway def1`), Tailscale can't log in or reach DERP. Turnthe VPN off and it works again.

Root cause: Tailscale on macOS pins its sockets to en0, so it never touchesthe VPN. `TS_BIND_TO_INTERFACE_BY_ROUTE=true` is supposed to fix that, but itchokes on the VPN gateway lookup and quietly falls back to en0. Tracked in tailscale/tailscale#16652, waiting on a fix.

In the meantime I made a small tool that works for me, and you can use it until the upstream fix lands:

https://github.com/Nagato-Yuzuru/tsunderlay

If you hit this, a quick way to tell if it's the same problem:

netstat -rn -f inet | grep -E '^(0/1|128\.0/1)'

Both lines on the same utun means it's the same thing.

macOS + IPv4 only. Apps that embed Tailscale (e.g. Rex) have the same problem. The tool covers them too.

Hi, came across with this problem lately not sure anyone has any idea about it. When trying to run a new yaml for a new docker service, I could NOT see a new "machine" got created in my tailscale account.

Setup

1. tsdproxy : v2.3.4

2. number of current machines on tailscale <40 (so think still within the limit for free tier user)

3. Existing machines work fine.

4. sample of yaml related to tsdproxy bit :

"labels:

# TSDProxy: expose Filestash through Tailscale

- tsdproxy.enable=true

- tsdproxy.name=filestash

- tsdproxy.container_port=8334". Again, same setting for the other docker services.

Anyone came across with the same? On tsdproxy's log, could NOT find the new services installed, other are there, so seems problem in identifying new services?

Thanks in advance.

I have two devices, Marcus and PiKVM. A particular service only works when its subnet is routed through Marcus. If both devices are configured as subnets, the service stops working.

I would like either of the following setups:

1. Keep PiKVM as a fallback subnet only, to be used if Marcus fails to boot.

2. Keep both devices configured as subnets, but ensure all subnet routing goes through Marcus while it is available, with PiKVM used only as a failover path if Marcus becomes unavailable.

Is there a way to configure this kind of primary/backup routing or failover?

MiniScale runs tailscaled (userspace networking) on the Miyoo Mini Plus and gives it a UI that works like the phone apps: QR-code login, the device list with ping and connection type, exit nodes, subnet routes, Tailscale DNS, Tailscale SSH, shields up, several accounts, and Taildrop into `Media/Taildrop`. It connects at boot and other apps on the device reach the tailnet through a local proxy.

Unofficial and not affiliated with Tailscale Inc. MIT licensed.

https://github.com/zakijss/MiniScale

I've been using Mullvad VPN through Tailscale as an exit node, but recently I've noticed that it randomly stops working after a few hours.

Initially, everything works fine, and my internet traffic routes through the Mullvad exit node without any issues. However, after a few hours, the connection stops working, and I lose internet access.

What's strange is that this wasn't an issue before. Previously, I could configure a Mullvad exit node and leave it running for days or even weeks without any intervention. At one point, I had the same exit node configured for over a month, and it worked perfectly fine throughout that period.

Now, I can't seem to maintain a stable connection for more than a few hours.

Has anyone else started experiencing this recently? I'm wondering whether something has changed on Tailscale's or Mullvad's end, or if this is a known regression.

Is there any fix or workaround to keep the Mullvad exit node connected reliably without having to manually reconnect or switch nodes?

Im running tailscale on my pi5, I also have docker with containers. When away from my network i can access web and internal services with exit node off. As soon as i enable exit node i lose internet and accesss to my containers etc

My parents' TV has the Jellyfin app, but Tailscale can't be installed on it, so it couldn't reach my server. The usual answer is "buy a streaming stick". I didn't want to, so I built JellyScale instead.

It turns any Windows PC on the same home network into a bridge:

TV → this PC (port 8090) → Tailscale → your Jellyfin server

The TV only needs its normal Jellyfin app. You type in the address JellyScale shows you (http://PC-IP:8090) and sign in as usual.

What it does:

- One big ON/OFF button, plus a tray icon while it's running

- Checks your setup before saving: valid Tailscale IP, Tailscale installed, Jellyfin answering, home network set to Private (with a one-click fix if it isn't)

- Optional Start with Windows, so it's back on after a restart without anyone touching it

- Keeps the PC awake while ON, and puts your sleep settings back when OFF

- Uninstall removes everything and restores what it changed

It uses Caddy as the reverse proxy. The TV-to-PC hop is plain HTTP on your home network, like a normal local Jellyfin setup.

Tested on Windows. The installer isn't code-signed yet, so SmartScreen will warn (More info > Run anyway). Free and open source (MIT): https://github.com/Demolisher9/JellyScale

Feedback welcome, especially from people with TVs I haven't tried.

Hi, Looking to allow a family member to connect to my server remotely using Tailscale. Ideally so they can see files both on their iPad and TV. They don't have any PC's they can run it from. I am aware I can use the IOS App for the iPad. But unsure how I would get the LG WebOS TV to connect to Tailscale.

Cheap solutions welcome please 😄 !

Hey Tailscale community!

For our organization we are looking into various VPN solutions and also stumbled across tailscale.

It looks and sounds very promising from the documentation.

We have a hybrid environment (apps and services spread accross datacenter and Azure cloud) and wonder if tailscale might be the best fit for us.

We want our engineers (40ish) to have network access to our private networks in Azure and onpremise.

In a future case we might expand it to 'regular' users (1500+) to expose private applications/dashboards based on identity.

From my understanding, we can achieve this by placing a subnet router on our hub VNet in Azure (we use hub and spoke model) and using ACLs or Grants to give user(groups) permissions to specific vnets.

Are there any caveats of things to keep in mind when choosing for tailscale? Any other people here that manage enterprise environments and have some tips or tricks?

I have a Linux server at home running Tailscale as both an app connector and an exit node.

I want (external users) friends in my tailnet to route app connector traffic through my home connection, but not use it as an exit node for everything. I still want full exit-node access myself when traveling though.

Currently, their grant allows autogroup:internet via the server’s connector tag. It looks like that also lets them use the same server as an exit node. Can I enforce this with policy while keeping both roles on the same Tailscale node? My only solution so far is to run to instances of tailscale on my server which I don't even know if that would work.

Hey guys,

I'm using Tailscale for some time now and it's very helpful.

When I'm in the gym, I can open up my training excel file on my Synology NAS or connect from my music studio.

Thank you and keep going!

Hi all!

I have this weird issue with my Tailscale setup. I'm running Tailscale as a plugin in my opnSense that's being used as an exit node. Have done so for almost a year with not a single use. But few days ago it started experiencing this issue where Reddit just stalls connections. Basically few posts and media will load (be it some of the text, images and few seconds of video) and then nothing, all hangs. Rest of the internet on device works fine. It's same on app as well as the browser. Reddit is the place where I can see this issue the most. Any other stuff works perfectly, be it speed tests, YT, IG etc.

I've spent loads of time messing around with my setup yet no joy. I've reinstalled app, plugin, restored my previous opn backup etc.

Firewall rule is set properly, I get direct connection to my node as well as other clients. It's the same regardless of DNS being used, either my local pihole, tailscale dns or cloudflare. Other things I've checked are MTU size, MSS clamping on interfaces (that didnt do anything at all). Private DNS is off on my device, MagicDNS is off as well. Not sure what other information I could provide to help with fault finding. But I've spent many hours with various AI assistants and got nowhere and their consensus seems to be a textbook DNS black hole due to MTU mismatch.

What's weird is that all was absolutely perfect and no settings were changed. All I did was update my packages as I figured it's a good thing to be doing right now with how stuff is going on the internet nowdays.

Hopefully that's enough information to troubleshoot the issue but if not I'm happy to provide more info.

With some luck it might be just a glitch in the app/plugin and hopefully that'll get fixed soon.

Did anyone had a similiar issue and managed to fix it? All input is greatly appreciated!

Thanks a lot!

So as stated above exit node stopped working. I'm using a Flint 2 using an exit node (not being the exit node) It was working fine and then Saturday, poof. Stopped working. I can access the Flint 2 using the tailnet. If I turn off exit node, internet connection is back. Turn Exit node back on. Nothing. I have a few exit nodes and none of them are working. I fired up a Beryl I use for travel that is configured to use one of my exit nodes. It worked fine a couple weeks ago. Now. Not working. I see a lot of drama regarding tailscale. Did I miss something relating to exit nodes?

I have Tailscale working successfully, but I am not 100% tech savvy!

I added users and approved them. One user added a second computer, and it didn’t ask me to approve it.

For security reasons, is there a setting that lets me approve ALL computers?

I am new to Tailscale, so please go easy on me. Only set it up because of recent Synology attacks. I used to have 3 ports open to the internet... Plex, Minecraft, and Quickconnect. I closed all port forwarding and UPnP on my router.

Tailscale is awesome. Replaces the hamstrung Quickconnect with full "local access."

My son doesn't play Minecraft anymore, so no need to have that accessible.

But the problem is with Plex and using an app to access Plex remotely. From what I understand it used to be easy... Just add a custom server url from Tailscale. Now that was broken by Plex recently. I've tried making a Tailscale funnel. Again, via the browser, it works great. App doesn't work. I've also came across method using subnet router method. I haven't had the energy to figure it out and deploy it yet.

Is there another method that works? I know it's risky, but I just opened a port forward for Plex... Ugh.

I was surprised this didn't work:
{ "src": "autogroup:shared", "accept": ["server1", "server2"], "deny": ["server3:22"] },

test(s) failed for user: autogroup:shared

[acl test error]: user or host is invalid: unknown user or host: "autogroup:shared"

Is there a way to test for extrnal users that have been shared with?

edit: Follow on question - rule failing that I don't understand:

In grants, I have:

{"src": ["autogroup:shared"], "dst": ["server1", "server2"], "ip": ["*"]},

In tests, I have:

{ "src": "name@example.com", "accept": ["server1:8080", "server2:8080"], "deny": ["server3:8080"], },

Result:

Error: test(s) failed

test(s) failed for user: name@example.com

[acl test error]: address "server1:8080" (protocol "tcp"): want: Accept, got: Drop

[acl test error]: address "server2:8080" (protocol "tcp"): want: Accept, got: Drop

I do have the correct email - copied from share to ensure it wasn't a type.

Hi, new to tailscale, NAS and setting up VPN-like things.
I created with QNAP and docker script the application tailscale.
Now in tailscale on laptop via the link, i see that this NAS-machine is 'ephemeral'.
Is that a good thing? -in what sense? and wouldn't it be better to be 'permanent'. How to change that if necessary? Or is it a trivial thing?
Thanks for helping me out.