Tailscale PVT VPN will not work on the plusnet network

[#1]

@Dan_the_Van 

maybe I'm having a bad morning, but I'm unsure what this is for if it's on the router

No , you're not. I'd seen that but since its 192.168.200.0/24 it shouldnt have any effect for a 192.200... address, unless of course there's a typo somewhere and its really 192.200 !

I'm really not familiar with how docker works, I use Proxmox VE myself. 

As you say, why the need for any static route ?

[#2]

i think i may have found the issue here when i had this this all set up before it was on windows 11 and i created a mac bind on the router to the host address 192.x.x.3 i have just removed that and created a new MAC ADDRESS on the debian that kind of worked for a short while then i rebooted and now i can get  tailsacle.com but not login.tailscale.com progression  i'm thinking it might be the tailsacle daemon on the debian host now pings are still failing to login.tailsacle.com watch this space.. i will let you know the outcome is as soon as i get there i'm on a mission. to fix this 

[#3]

@MisterW 

As you say, why the need for any static route ? 

Well it appears I am having a bad morning, my word blindness has caused me to miss read stuff 

[#4]

right after playing around with it for a long time i can confirm this is not a network issue as my mac works fine now just the debian host i uninstalled and reinstalled again i managed to be able to ping 8.8.8.8 & 1.1.1.1 and a few others like bbc.co.uk theregister.co.uk microsoft,com so the connection is working i got tailcale.com to work but alas not login.tailscale.com reinstalled the client again and still the same thing mmm i connected by my mobile tethered connection and BOOM it works again switch back to LAN and OH GOD its gone again so i have submitted a possible bug report to tailscale support  in the hopes they can identify whats going on here i am bemused to say the least ill keep you all posted on the  update that i get from tailscale themselves i am sure this is just a bug in the debian version of the client it doesn't make sense why it works on the mobile and not the LAN very confused.com  and yes i checked everything on the router so its not that i had this woking like a dream when it was windows then swigched to debian and i got these issues 

[#5]

Hi,

I use Tailscale at home on my Debian hosts and I dont have any issues. I've had a quick read through and see you've tried an ip route command, but don't see ip route get 192.200.0.101

What do you get from the following?

ip route get 192.200.0.101

[#6]

i got tailcale.com to work but alas not login.tailscale.com

That's because they resolve to completely different iP addresses and subnets. 

tailscale.com is 76.76.21.21 whereas login.tailscale.com is 192.200.x.x.

connected by my mobile tethered connection and BOOM it works again switch back to LAN and OH GOD its gone again

That's because when tethered, your system will have a completely different private IP and routing.

BTW you're not the only report of similar problems , try googling 'tailscale 192.200'

Hers's one for instance https://www.reddit.com/r/Tailscale/comments/1m6nfng/trouble_with_home_network_since_new_ip_ranges/

[#7]

this is what i get : ~$ ip route get 192.200.0.101
192.200.0.101 via 192.168.0.1 dev enp1s0 src 192.168.0.3 uid 1000
cache 

[#8 · Accepted solution]

Right i told you i would fix this and i did one determined [-Censored-]! me lol here is the FIX i hope this helps anyone else going through this....

Fix: Tailscale SSL Errors on Debian 13 (Trixie)

If you have recently moved to Debian 13 (Trixie) and are experiencing "Secure Connection Failed" or SSL_ERROR_NO_CYPHER_OVERLAP when trying to log into Tailscale, or if your Pi-hole v6 container is stuck in a health: starting crash loop, here is the community-verified fix.
Problem 1: Tailscale "No Common Encryption Algorithm" (IPv6 Ghosting)

Debian 13’s network stack often prioritizes IPv6 handshakes that can fail on certain UK routers (like the TP-Link GE800 or Sky/Plusnet hubs), causing Tailscale logins to fail in the browser with "No Common Cipher" errors.

The Fix: Force the system to prioritize IPv4 and perform a clean "native" install instead of using Docker.

Prioritize IPv4: Edit /etc/gai.conf and uncomment the line precedence ::ffff:0:0/96 100 to ensure the OS prefers IPv4 for security handshakes.

Native Tailscale Install: Don't run Tailscale in Docker on Trixie if you're hitting these errors. Use the native curl script: curl -fsSL https://tailscale.com/install.sh | sh

Clean Login: If you have stale states, reset and log in with this specific command to enable subnet routing and exit node status: sudo tailscale up --reset --advertise-exit-node --advertise-routes=192.168.0.0/24 --accept-dns=false

Moderator's note by Mike (Mav): Avoidance of swear filter edited as per Forum rules.