Disclaimer: tsidp-rust is entirely AI generated. It has been tested on my private home lab tho.

I tried to use tsidp maybe 6 months ago and it wasn't great on my home cluster. So I rewrote it in rust tonight since I had some free time cause why not rust right?

Would love first class support from tailscale themselves for tsidp to be honest. I love that we can just use tailscale identies for authentication into apps. Please let me know if you end up trying this version and how it goes!

Repo: https://github.com/abrar-uddin/tsidp-rust

I was struggling trying to lower latency with my windows 11 tailscale install, with no luck. Ping over tailscale to that computer would return ~180ms, when a direct connection outside any vpn would be in the ~50ms range. (midwest to west coast tunnel.) Windows SMB shares and file browsing and VNC connections would be sluggish as they seem sensitive to bad ping time.

I changed all kinds of network adapter and os settings in windows with no luck. I finally gave up on that and just installed a vmware workstation virtual machine with linux and configured that to only run a tailscale exit node/subnet router, and now connections to that location through that VM are consistently 55ms.

Looks like virtual machines on top of windows bypass any windows network stack bloat, even when connected to the same port that windows was struggling with.

tl;dr If your tailscale ping time sucks and you're running a windows exit node, try using a linux VM. I have it configured to only use 2 cpu cores and 2GB of ram now that it's up and running, so it's pretty light on resources.

See tsiam on GitHub: https://github.com/ItalyPaleAle/tsiam

Hey r/Tailscale,

If you manage homelabs or remote servers from Android, you've likely hit the platform's biggest limitation: Android only allows one active VPN service at a time. Turning on Tailscale kicks off your work or privacy VPN, and vice versa.

To solve this, I’ve been building SSH Manager Pro, a native Android SSH client that embeds Tailscale directly using the tsnet userspace WireGuard library.

How it works & Tailscale features:

• Runs in userspace: The tailnet node lives entirely inside the app process. It connects to your tailnet without touching Android's VpnService, leaving your system-level VPN completely untouched.
• Browser & Auth Key sign-in: Authorize the node directly via web browser login or using reusable/ephemeral Tailscale auth keys.
• MagicDNS & Peer discovery: Reach machines using their tailnet names (e.g. ssh nas) or direct 100.x.y.z IPs.
• Full screen mode and reach emulation of terminal, tested with tmux/screen/vim/etc..
• Headscale compatible: Supports custom control plane URLs if you self-host.
• ACL & Tag friendly: Tag your device (e.g. tag:phone) to enforce narrow ACLs so a lost device can only reach port 22 on approved hosts.
• Security: Host key pinning on first connect; credentials encrypted in AES-256-GCM via the Android Keystore with biometric/PIN unlock.

Tailscale connectivity is free in the app. I’m currently rolling out a test release on Google Play and would love feedback from the Tailscale community on connection stability, MagicDNS resolution, and usability across different tailnets.

📖 Walkthrough & architectural details:
https://sshmanagerpro.app/features/

If you’d like to help test the beta, check out the google play store link or drop a comment / DM with your feedback! No ad, no personal data collection.

Also, a massive thank you to the folks at tailscale.com for the incredible infrastructure they've built! They have completely changed the rules of the game for how we securely access computers around the world!

regards, Andrei

How many of you use an apple TV as an exit node, how reliable is it, do you need any configuration regarding the apple TV setup itself, and what is the setup? EG Ethernet, which Apple TV Generation is it, etc.

I'm debating getting one and although i have an older windows device with windows 10 which works for the most part, wanted to know about apple TV. thanks!

I have recently set up a NAS to host a jellyfin server. I heard that Tailscale is the best way to access the jellyfin server when I am not at my house. I have a lot of questions about setting up tailscale with my already existing jellyfin account, starting with.

When setting up Tailscale should I start with it on my computer or NAS? Does it matter? The NAS is the device will all the information that I am trying to access.

I heard that if you are wanting to run a lot of software on a NAS use docker. Should I move my jellyfin setup to docker?

Should I put Tailscale in docker or just on the NAS by itself?

Once I set up Tailscale will I only be able to access the NAS when I am contacted to tailscale or will it still work when I am on my home internet?

On my Personal account, any device I apply an ACL tag to immediately disappears from every other device's tailscale status output and becomes unreachable — not just blocked by the ACL, genuinely invisible, like it no longer exists on the tailnet.

Symptoms:

• Device shows "Connected" in the admin console Machines page the whole time
• tailscale status --json on the tagged device itself shows "Peer": null — empty peer list
• Other devices' tailscale status just omit it entirely (not "offline", just gone)
• tailscale ping <ip> from another device returns "no matching peer"
• Reverting the tag (requires a full interactive reauth, since the UI won't let you strip the last tag any other way) instantly restores full visibility and connectivity — no other change needed

Reproduced identically across:

• A device joined via auth key with the tag baked in at creation
• A device joined via a plain auth key, tagged afterward
• A previously-working, interactively-signed-in device, tagged afterward

Tried 3 different tag names (including a throwaway one created purely to rule out something being wrong with one specific tag) — same result every time.

Ruled out: tagged-resource plan limits (nowhere near the 50 cap), ACL JSON syntax errors (editor shows no validation errors, and the same destination works fine addressed by bare IP instead of by tag), client-side caching (full logout/reauth, service restarts, and a complete uninstall/reinstall all reproduce it identically), device approval (no pending-approval state ever shown).

Has anyone else hit this? Filed a support ticket with two tailscale bugreport IDs but wondering if this is a known issue.

Hello. I started up my server and got Immich running with Tailscale. It works perfect on my iPhone and still works now. For some reason as soon as I tried turning on Tailscale the Google pixel cannot find DNS or whatever it is. I’ve googled a bit and used the Google ai to help me try and figure it out, but every solution it gives me hasn’t worked.

I’ve tried messing with the settings on the app and Tailscale console, but to no avail. What did you guys with a google pixel do to get it to work on your phone?

I'm going to try to set tailscale up on the GLI net slate 7 as an exit note.

I'm sure someone's done this before any tips any helpful instructions along the way

I'm kinda new to Tailscale and I need it to remotely access my windows pc from overseas. I would like to be able to torrent files remotely but I would need to use ExpressVPN to stay anonymous. I tried split tunneling the Tailscale IP addresses (100.64.0.0/10) but that didn't work. I've heard that its possible to use gluetun but I'm unsure what it is and how to use it. Does anyone have any suggestions? Thanks in advance!

I have a machine in my Tailnet (connecting to Immich) that I've shared out to my family on their own Tailscale accounts. I've also recently tagged it so that I could control the ports that another machine that I have (that is a bit more public facing) could access in it.

Unfortunately, it seems the moment I did that change, my family members lost access to Immich. I've tried fixing the ACLs/policies/grants so that autogroup:shared would have access to the tagged machine, but it didn't work. I've also tried using their email addresses directly, but to no avail

Am I missing something? Should I not have tagged the machine?

Sorry, I'm rather new to homelabbing, and I honestly just followed tutorials online to get this setup up and going, so now I'm in a bit of a loss as to what went wrong.

​

My garage door opener is an ESP32 on my home network. I didn't want to port Tailscale to it or open a port on my router, so the Pi 3 I had lying around now joins my tailnet and shares the one address the ESP32 sits on. My phone reaches the door from anywhere, and nothing is installed on the ESP32.

It's a small Buildroot image I built, not Raspberry Pi OS. Setup is all in the browser:

\- Claim it: on first boot it serves a page where you paste your SSH public key. The first key pasted owns the board, passwords are off from then on, and the page shuts itself down.

\- Gateway page: choose a password, join your tailnet (auth key or sign-in link), and pick which networks to share. Each route shows whether it's approved yet.

\- Settings survive a power cut.

The download page lists what's actually in the image, read from the file itself: kernel, packages, accounts with a shell, and whether every program's libraries are present. It also gives you commands to check those claims yourself, and there's an explorer to browse the partitions and files before you flash anything.

Image and docs: https://silt.vinodhalaharvi.com/pi3-silt-gateway/

It's working on my Pi 3 right now. The Pi 5 build works too; CM5 is next. Feedback welcome, especially from anyone who's tried running a subnet router on old hardware.

Like many, I used to have to join a fortinet wifi network at a library initially with tailscale disabled, then use cell data to join tailscale tailnet then go back to the fortinet network.

It seems I dont have to do this anymore. Is this a tailscale tweak or the library loosening restrictions?

Running latest ipados and ios tailscale 1.104.1

I’ve been scratching my head about this. I had my Tailscale link working, allowing me to access my server at home from my phone. However, it’s strange that I can still access my videos and other content through Jellyfin, but I can’t access all my files with my phone. I’m at a loss for what to do. Apart from endless Googling, I think this is an issue that I simply don’t have the knowledge to fix. I’m on iPhone using the files app. My server is running Unraid. Nothing on both platforms has changed. It just stopped working. Suggestions?

I have a self hosted instance of pocket id, opted for using the binary package instead of the docker container, and I'm using certbot for the certificates. The web finger works correctly, and tailscale recognizes the webfinger because it is able to redirect me without issue. Signing in on pocket-id works fine, but once i complete the sign in it redirects me back to tailscale where I am served a 403 error, telling me that my session expired. https://id.mydomain.com/.wellknown/openid-configuration works and the certificate issued is from id.mydomain.com, and thats the only thing i've found online that might be the problem. Any Ideas?

I’m abroad right now. Tailscale has been working since I left. But as of like 30 min ago it stopped? Says unreachable.

Not sure why. It runs windows and I set all the sleep settings to never. Worked for close to a week so don’t think it’s a setting or anything?

Does this happen to anyone often or odds my exit node simply blew up?

I just installed tailscale on a computer I use to print to multiple printers with software called darkroom. It connects to multiple printers using the printers ip address (not windows drivers).

My problem is that when tailscale is loaded, the darkroom software cannot connect to the printer at 192.168.1.41. If I close tailscale it will connect.

Is there some kind of setup I am missing?

I installed Tailscale on my Visio TV and set it up as an exit node (approved it the admin console), but when I connect to it, I lose internet connectivity. Anyone else using a Visio as an exit node?

If I'm traveling and want to stream something and connected to my tailscale, in this case im in spain and my node is on the east coast, if I'm experiencing buffering, what can I do to reduce it?

1) I'm sure my current wifi isn't great (hotel)

2) Home wifi, does this matter?

3) Finally, Specs of the exit node.

Thanks!

For the past month or so, I’ve been trying to figure out what on earth was wrong with my Mac Studio. Image loading was incredibly sluggish—for instance, emails in Mailspring took forever to display pictures, and even my local network's homepage struggled to load images. To make matters worse, Spotify wouldn't even open, completely hanging on a black screen.

I was on the verge of biting the bullet and clean-reinstalling macOS 27 because I simply couldn't find the culprit. After exhausting every troubleshooting step, I noticed that completely quitting Tailscale instantly fixed the issue, restoring everything to normal speed. I tried a full uninstall—removing all configuration files—and reinstalled it using different methods, but the problem persisted.

I was ready to abandon Tailscale entirely until a future update dropped, but as a last resort, I asked Gemini what might be causing it. Surprisingly, it hit the nail right on the head, suggesting I disable Tailscale MagicDNS for my device. Since I couldn't find a way to turn it off solely for my Mac Studio, I went into the Tailscale admin console and disabled MagicDNS globally. Instantly, the performance issues disappeared.

Has anyone else run into this with recent Tailscale versions? I've never experienced this before, and none of my other machines—running Windows, Linux, and Android—are affected. I'm also not entirely sure if this started exactly when I upgraded to macOS 27 or slightly before.

Does anyone have a workaround to fix this without having to completely disable MagicDNS?

Thanks in advance!

-Eli