topic Re: Tailscale PVT VPN will not work on the plusnet network in Everything else

Tailscale PVT VPN will not work on the plusnet network

timsansom — Tue, 09 Dec 2025 11:20:08 GMT

hi there something very strange is happening on my tailscale VPN i have had this working for a long time flawlessly, but a few days ago i moved my old laptop that is currently my server for my self hosted apps from windows to debian 13 (windows is just pure rubbish now) now i have the latest build and updated it and for some reason if i go to tailscale.com on the browser it refuses to connect even if i go to login.tailscale.com same thing happens this is not just on the linux debian distro but also on my mac and my phone or tablet when i am on the plusnet network.. as a test if i switched from the LAN to and teather to my iphones mobile data boom it works this is the same on the Linux Debian disto and the mac and phone and tablet and then the VPN comes online as it should so are you blocking VPNs now? especially tailscale its very weird that this is happening i checked my router tp link GE800 and its up to date with the latest firmware and i have disabled the firewall (SIP) so it should work but alas every time i try to get the VPN or even try to go to tailscale web pages it stops working on the plusnet network its definitely isolated to your network because as soon as and before you say this could be the browser i have tested on Safari Firefox Chrome Brave Opera same thing this is very strange indeed

Re: Tailscale PVT VPN will not work on the plusnet network

Ian06 — Tue, 09 Dec 2025 12:01:54 GMT

I am able to access tailscale.com on my plusnet FF connection.... I don't use the plusnet router and have my own router set to use Cloudflare DNS (not plusnet DNS.)

Re: Tailscale PVT VPN will not work on the plusnet network

timsansom — Tue, 09 Dec 2025 12:33:56 GMT

i have done some tests on the Debian 13 distro just to make sure here are the results

Here is a summary of the facts, which strongly suggest a non-standard block by a network device (like the TP-Link router, despite the GUI settings, or the ISP's network):

Basic Connectivity Works: The Debian host can successfully ping Cloudflare's public DNS at 1.1.1.1.

DNS Resolution Works: The host can successfully resolve login.tailscale.com to its correct IP address (e.g., 192.200.0.106), proving DNS is functional.

Targeted Blockage: Any attempt to establish a connection (via ping or the Tailscale daemon) to the resolved IP address of the Tailscale control plane fails with 100% packet loss.

No Host Firewall: All host firewalls (UFW, Gufw, and all iptables chains) are explicitly turned off or flushed to an ACCEPT policy.

No Application Interference: Temporarily stopping Docker did not resolve the issue.

Re: Tailscale PVT VPN will not work on the plusnet network

timsansom — Tue, 09 Dec 2025 12:38:21 GMT

same here i don't use the plusnet router never have done i have a tp link Archer GE800 router set to cloudflare's dns i have tested both google and cloudflare's DNS just incase cloudflare's DNS was down but alas the same issue occurs

Re: Tailscale PVT VPN will not work on the plusnet network

Dan_the_Van — Tue, 09 Dec 2025 13:17:49 GMT

Here is a summary of the facts, which strongly suggest a non-standard block by a network device (like the TP-Link router, despite the GUI settings, or the ISP's network)

I use a TP-Link router login.tailscale.com in a browser gives me the landing page with the option to sign on.

Targeted Blockage: Any attempt to establish a connection (via ping or the Tailscale daemon) to the resolved IP address of the Tailscale control plane fails with 100% packet loss.

I can ping and use traceroute to login.tailscale.com

When you attempt a connection what does netstat show for the connection attempt?

Re: Tailscale PVT VPN will not work on the plusnet network

MisterW — Tue, 09 Dec 2025 14:02:19 GMT

@Dan_the_Van are you on a static IP ?

I can reach tailscale fine from an IP in the 80.229... block,

@timsansom what the IP range for your current public IP ? ( the first two octets will do to avoid exposing your entire IP )

Re: Tailscale PVT VPN will not work on the plusnet network

Dan_the_Van — Tue, 09 Dec 2025 14:05:16 GMT

@MisterW

I am also 80.229... block, so yes a static IP

Re: Tailscale PVT VPN will not work on the plusnet network

timsansom — Tue, 09 Dec 2025 15:48:34 GMT

no i'm on a dynamic IP from plusnet Ip: 87.x.x.159 there is no static IP service with plusnet but i have my docker on this debian linux hosting all my bits as you do now my domain DNS is pointing to the cloudflare account so i just use the url pihole.domainname.co.uk to get through that and i have a cloudflare updater to update the IP if it changes in my docker compose file thats all doing its job its just some weirdness that i can connect fine when i am tethered to my phone mobile data works fine but as son as i switch from the mobile data to either wifi or LAN i suddenly lose it again

Re: Tailscale PVT VPN will not work on the plusnet network

MisterW — Tue, 09 Dec 2025 16:09:29 GMT

@timsansom can you try a traceroute to login.tailscale.com

Re: Tailscale PVT VPN will not work on the plusnet network

timsansom — Tue, 09 Dec 2025 22:35:01 GMT

as you can see from the debian 13 linux its resolving to the IP but its not even getting anywhere its like something has blocked it!

~$ traceroute login.tailscale.com
traceroute to login.tailscale.com (192.200.0.101), 30 hops max, 60 byte packets
1 * * *
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
23 * * *
24 * * *
25 * * *
26 * * *

Re: Tailscale PVT VPN will not work on the plusnet network

Anonymous — Tue, 09 Dec 2025 22:46:26 GMT

If it helps, this is from a non-fixed Plusnet IP (windows tracert, using ICMP as the protocol)

tracert login.tailscale.com

Tracing route to login.tailscale.com [192.200.0.103]
over a maximum of 30 hops:

1 1 ms <1 ms <1 ms 192.168.2.33
2 2 ms 2 ms 2 ms 172.16.16.161
3 * * * Request timed out.
4 6 ms 6 ms 6 ms 140.hiper04.sheff.dial.plus.net.uk [195.166.143.140]
5 7 ms 6 ms 6 ms peer8-et0-1-5.telehouse.ukcore.bt.net [109.159.252.102]
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.
11 20 ms 20 ms 20 ms lb.fra.tailscale.com [192.200.0.103]

Re: Tailscale PVT VPN will not work on the plusnet network

MisterW — Wed, 10 Dec 2025 07:40:30 GMT

@timsansom

~$ traceroute login.tailscale.com
traceroute to login.tailscale.com (192.200.0.101), 30 hops max, 60 byte packets
1 * * *
2 * * *

youre not even getting out to the router & gateway !! very strange.

Re: Tailscale PVT VPN will not work on the plusnet network

Champnet — Wed, 10 Dec 2025 08:25:58 GMT

@timsansom For Info if it helps :

Tracing route to login.tailscale.com [192.200.0.105]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms Netgear.d6400 [192.168.1.1]
2 5 ms 5 ms 5 ms 250.core.plus.net [195.166.130.250]
3 6 ms 6 ms 6 ms 217.32.25.144
4 7 ms 7 ms 6 ms 109.159.255.46
5 7 ms 7 ms 6 ms 194.74.16.159
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.
11 19 ms 19 ms 19 ms lb.fra.tailscale.com [192.200.0.105]

Fixed IP 212.159.n.n

No VPN.

Re: Tailscale PVT VPN will not work on the plusnet network

Dan_the_Van — Wed, 10 Dec 2025 08:49:53 GMT

@timsansom

have you got ICMP blocked somewhere?

try this command it uses TCP

sudo traceroute -T login.tailscale.com

or if you want to target a specific port

sudo traceroute -T -p 443 login.tailscale.com

Re: Tailscale PVT VPN will not work on the plusnet network

timsansom — Wed, 10 Dec 2025 10:55:59 GMT

i have tried that and still its the same i have provided traceroutes to other websites and as you can see they go though ok very confusing indeed

~$ sudo traceroute -T login.tailscale.com
[sudo] password for tim:
traceroute to login.tailscale.com (192.200.0.109), 30 hops max, 60 byte packets
1 * * *
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *

$ traceroute google.com
traceroute to google.com (142.251.29.101), 30 hops max, 60 byte packets
1 192.168.0.1 (192.168.0.1) 0.442 ms * *
2 * * *
3 * * *
4 132.hiper04.sheff.dial.plus.net.uk (195.166.143.132) 19.920 ms 20.263 ms 20.264 ms
5 109.159.255.8 (109.159.255.8) 19.932 ms 109.159.255.10 (109.159.255.10) 19.868 ms core1-hu0-10-0-1.colindale.ukcore.bt.net (195.99.127.20) 20.795 ms
6 core2-pos5-1.manchester.ukcore.bt.net (194.74.16.177) 20.767 ms 194.74.16.201 (194.74.16.201) 19.884 ms 194.74.16.189 (194.74.16.189) 19.634 ms
7 109.159.253.189 (109.159.253.189) 19.602 ms 195.99.126.247 (195.99.126.247) 19.634 ms 109.159.253.187 (109.159.253.187) 20.183 ms
8 * * 192.178.97.189 (192.178.97.189) 19.484 ms
9 108.170.234.230 (108.170.234.230) 21.624 ms 192.178.46.84 (192.178.46.84) 20.420 ms 209.85.252.180 (209.85.252.180) 22.053 ms
10 209.85.142.123 (209.85.142.123) 20.523 ms 192.178.97.96 (192.178.97.96) 20.976 ms 192.178.97.54 (192.178.97.54) 20.479 ms
11 172.253.51.109 (172.253.51.109) 20.855 ms 142.251.194.164 (142.251.194.164) 21.163 ms 192.178.245.19 (192.178.245.19) 20.863 ms
12 142.251.194.164 (142.251.194.164) 20.462 ms 142.251.197.136 (142.251.197.136) 20.683 ms 172.253.65.168 (172.253.65.168) 20.615 ms

$ traceroute bbc.co.uk
traceroute to bbc.co.uk (151.101.0.81), 30 hops max, 60 byte packets
1 * * *
2 * * *
3 * * *
4 132.hiper04.sheff.dial.plus.net.uk (195.166.143.132) 20.506 ms 20.481 ms 20.410 ms
5 109.159.255.8 (109.159.255.8) 21.444 ms core1-hu0-10-0-1.colindale.ukcore.bt.net (195.99.127.20) 20.624 ms core4-hu0-0-0-1.colindale.ukcore.bt.net (62.6.204.239) 20.633 ms
6 194.74.16.207 (194.74.16.207) 38.615 ms peer3-et3-1-4.redbus.ukcore.bt.net (194.72.16.186) 19.678 ms 194.74.16.247 (194.74.16.247) 20.204 ms
7 * * *
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *

Re: Tailscale PVT VPN will not work on the plusnet network

MisterW — Wed, 10 Dec 2025 11:10:46 GMT

@timsansom

Its as though your router (or linux device) doesnt think that the tailscale IP (192.200.0.109) is outside its LAN subnet and therefore isnt routing via the default gateway.

What is the LAN subnet mask showing on both the router and linux box ? it would normally be /24

Re: Tailscale PVT VPN will not work on the plusnet network

MisterW — Wed, 10 Dec 2025 11:38:37 GMT

it would normally be /24

or 255.255.255.0

if you've got a mask somewhere showing 255.0.0.0 then that will prevent routing to the tailscale IP

Re: Tailscale PVT VPN will not work on the plusnet network

Anonymous — Thu, 11 Dec 2025 03:13:09 GMT

It could be that it shouldn't be > /24.

However. It could be > /24. (192.168.0.0 -> 192.168.255.255)

It can also be < /24.

Re: Tailscale PVT VPN will not work on the plusnet network

timsansom — Thu, 11 Dec 2025 07:50:09 GMT

yes its a class C address /24

Re: Tailscale PVT VPN will not work on the plusnet network

Dan_the_Van — Thu, 11 Dec 2025 09:20:30 GMT

With traceroute providing strange result.

are you using a virtual machine for this, if so NAT or bridged network interface?

have you setup any routes or just using the devices default gateway?

what does netstat -r (routering table) show?

If you have a Hub two, do you see the same issue?