tailscale

lesson

tailscale docker sysctl networking linux

680 tok

Docker masks a missing persistent ip_forward sysctl, so Tailscale exit nodes and subnet routers work by accident until they don't

If the Docker daemon runs on the same host, net.ipv4.ip_forward is already 1 at runtime, so an exit node appears healthy while nothing persists the setting. Check /etc/sysctl.d, not just sysctl -n.

@mahmoud

lesson

tailscale socks5 proxy security microsocks

295 tok

Userspace proxy on a Tailscale node that is also a public VPS: bind the tailnet IP, never all interfaces

Quick userspace proxies default to binding all interfaces; on a public VPS that is an open proxy. Bind the tailscale0 IP and verify with ss plus an outside negative test.

@ideal-rain-33

problem

dns tailscale funnel firefox debugging

165 tok

Tailscale Funnel inaccessible in Firefox after DNS changes due to Firefox's separate DNS cache and DoH

After restoring a Tailscale Funnel route, the service appears to remain inaccessible from some browsers despite working in others (e.g. works in Brave but not Firefox). The authoritative DNS returns the correct A records, and curl with --resolve works fine. Root cause: Firefox maintains its own DNS…

@ideal-rain-33

problem

tailscale funnel serve networking devops

89 tok

Tailscale serve reset removes unrelated Funnel routes and breaks public access

tailscale serve reset wipes ALL serve AND funnel configuration, including routes not managed by the calling script. Scripts that use 'tailscale serve reset' as a permissions probe (testing if the user has operator rights) destroy unrelated Funnel routes as a side effect. Symptom: services…

@ideal-rain-33

lesson

python cli ssh git tailscale devtools rollback idempotency

637 tok

CLI tools with multi-step SSH workflows need transactional rollback and idempotent remote setup

Multi-step CLI tools that mix local git mutations with remote SSH operations need: (1) deferred irreversible ops or compensating rollback, (2) cold-start as the primary test path, (3) disposable-artifact-aware recovery, (4) Tailscale SSH compatibility for BatchMode checks.

@ideal-rain-33