Tailscale PVT VPN will not work on the plusnet network

[#1]

hi there something very strange is happening on my tailscale VPN i have had this working for a long time flawlessly, but a few days ago i moved my old laptop that is currently my server for my self hosted apps from windows to debian 13 (windows is just pure rubbish now) now i have the latest build and updated it and for some reason if i go to tailscale.com on the browser it refuses to connect even if i go to login.tailscale.com same thing happens this is not just on the  linux debian distro but also on my mac and my phone or tablet when i am on the plusnet network.. as a test if i switched from the LAN to and teather to my iphones mobile data boom it works this is the same on the Linux Debian disto and the mac and phone and tablet and then the VPN comes online as it should so are you blocking VPNs now? especially tailscale its very weird that this is happening i checked my router tp link GE800 and its up to date with the latest firmware and i have disabled the firewall (SIP) so it should work  but alas every time i try to get the VPN or even try to go to tailscale web pages it stops working on the plusnet network its definitely isolated to your network because as soon as and before you say this could be the browser i have tested on Safari Firefox Chrome Brave Opera same thing this is very strange indeed 

[#2]

I am able to access tailscale.com on my plusnet FF connection....   I don't use the plusnet router and have my own router set to use Cloudflare DNS (not plusnet DNS.)

[#3]

i have done some tests on the Debian 13 distro just to make sure here are the results 

Here is a summary of the facts, which strongly suggest a non-standard block by a network device (like the TP-Link router, despite the GUI settings, or the ISP's network):

Basic Connectivity Works: The Debian host can successfully ping Cloudflare's public DNS at 1.1.1.1.

DNS Resolution Works: The host can successfully resolve login.tailscale.com to its correct IP address (e.g., 192.200.0.106), proving DNS is functional.

Targeted Blockage: Any attempt to establish a connection (via ping or the Tailscale daemon) to the resolved IP address of the Tailscale control plane fails with 100% packet loss.

No Host Firewall: All host firewalls (UFW, Gufw, and all iptables chains) are explicitly turned off or flushed to an ACCEPT policy.

No Application Interference: Temporarily stopping Docker did not resolve the issue.

[#4]

same here i don't use the plusnet router never have done i have a tp link Archer GE800 router set to cloudflare's dns i have tested both google and cloudflare's DNS just incase cloudflare's DNS was down but alas the same issue occurs 

[#5]

Here is a summary of the facts, which strongly suggest a non-standard block by a network device (like the TP-Link router, despite the GUI settings, or the ISP's network)

I use a TP-Link router login.tailscale.com in a browser gives me the landing page with the option to sign on.

Targeted Blockage: Any attempt to establish a connection (via ping or the Tailscale daemon) to the resolved IP address of the Tailscale control plane fails with 100% packet loss.

I can ping and use traceroute to login.tailscale.com

When you attempt a connection what does netstat show for the connection attempt?

[#6]

@Dan_the_Van are you on a static IP ? 

I can reach tailscale fine from an IP in the 80.229... block,

@timsansom what the IP range for your current public IP ? ( the first two octets will do to avoid exposing your entire IP ) 

[#7]

@MisterW 

I am also 80.229... block, so yes a static IP

[#8]

no i'm on a dynamic IP from plusnet Ip: 87.x.x.159 there is no static IP service with plusnet but i have my docker on this debian linux hosting all my bits as you do now my domain DNS is pointing to the cloudflare account so i just use the url pihole.domainname.co.uk to get through that and i have a cloudflare updater to update the IP if it changes in my docker compose file thats all doing its job its just some weirdness that i can connect fine when i am tethered to my phone mobile data works fine but as son as i switch from the mobile data to either wifi or LAN i suddenly lose it again

[#9]

@timsansom can you try a traceroute to login.tailscale.com

[#10]

as you can see from the debian 13 linux its resolving to the IP  but its not even getting anywhere its like something has blocked it!

~$ traceroute login.tailscale.com
traceroute to login.tailscale.com (192.200.0.101), 30 hops max, 60 byte packets
1 * * *
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
23 * * *
24 * * *
25 * * *
26 * * *

[#11]

If it helps, this is from a non-fixed Plusnet IP (windows tracert, using ICMP as the protocol)

tracert login.tailscale.com

Tracing route to login.tailscale.com [192.200.0.103]
over a maximum of 30 hops:

1 1 ms <1 ms <1 ms 192.168.2.33
2 2 ms 2 ms 2 ms 172.16.16.161
3 * * * Request timed out.
4 6 ms 6 ms 6 ms 140.hiper04.sheff.dial.plus.net.uk [195.166.143.140]
5 7 ms 6 ms 6 ms peer8-et0-1-5.telehouse.ukcore.bt.net [109.159.252.102]
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.
11 20 ms 20 ms 20 ms lb.fra.tailscale.com [192.200.0.103]

[#12]

@timsansom

~$ traceroute login.tailscale.com
traceroute to login.tailscale.com (192.200.0.101), 30 hops max, 60 byte packets
1 * * *
2 * * *

youre not even getting out to the router & gateway !! very strange.

[#13]

@timsansom  For Info if it helps :

Tracing route to login.tailscale.com [192.200.0.105]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms Netgear.d6400 [192.168.1.1]
2 5 ms 5 ms 5 ms 250.core.plus.net [195.166.130.250]
3 6 ms 6 ms 6 ms 217.32.25.144
4 7 ms 7 ms 6 ms 109.159.255.46
5 7 ms 7 ms 6 ms 194.74.16.159
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.
11 19 ms 19 ms 19 ms lb.fra.tailscale.com [192.200.0.105]

Fixed IP 212.159.n.n

No VPN.

[#14]

@timsansom 

have you got ICMP blocked somewhere?

try this command it uses TCP

sudo traceroute -T login.tailscale.com

or if you want to target a specific port

sudo traceroute -T -p 443 login.tailscale.com

[#15]

i have tried that  and still its the same i have provided traceroutes to other websites and as you can see they go though ok very confusing indeed 

~$ sudo traceroute -T login.tailscale.com
[sudo] password for tim:
traceroute to login.tailscale.com (192.200.0.109), 30 hops max, 60 byte packets
1 * * *
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *

$ traceroute google.com
traceroute to google.com (142.251.29.101), 30 hops max, 60 byte packets
1 192.168.0.1 (192.168.0.1) 0.442 ms * *
2 * * *
3 * * *
4 132.hiper04.sheff.dial.plus.net.uk (195.166.143.132) 19.920 ms 20.263 ms 20.264 ms
5 109.159.255.8 (109.159.255.8) 19.932 ms 109.159.255.10 (109.159.255.10) 19.868 ms core1-hu0-10-0-1.colindale.ukcore.bt.net (195.99.127.20) 20.795 ms
6 core2-pos5-1.manchester.ukcore.bt.net (194.74.16.177) 20.767 ms 194.74.16.201 (194.74.16.201) 19.884 ms 194.74.16.189 (194.74.16.189) 19.634 ms
7 109.159.253.189 (109.159.253.189) 19.602 ms 195.99.126.247 (195.99.126.247) 19.634 ms 109.159.253.187 (109.159.253.187) 20.183 ms
8 * * 192.178.97.189 (192.178.97.189) 19.484 ms
9 108.170.234.230 (108.170.234.230) 21.624 ms 192.178.46.84 (192.178.46.84) 20.420 ms 209.85.252.180 (209.85.252.180) 22.053 ms
10 209.85.142.123 (209.85.142.123) 20.523 ms 192.178.97.96 (192.178.97.96) 20.976 ms 192.178.97.54 (192.178.97.54) 20.479 ms
11 172.253.51.109 (172.253.51.109) 20.855 ms 142.251.194.164 (142.251.194.164) 21.163 ms 192.178.245.19 (192.178.245.19) 20.863 ms
12 142.251.194.164 (142.251.194.164) 20.462 ms 142.251.197.136 (142.251.197.136) 20.683 ms 172.253.65.168 (172.253.65.168) 20.615 ms

$ traceroute bbc.co.uk
traceroute to bbc.co.uk (151.101.0.81), 30 hops max, 60 byte packets
1 * * *
2 * * *
3 * * *
4 132.hiper04.sheff.dial.plus.net.uk (195.166.143.132) 20.506 ms 20.481 ms 20.410 ms
5 109.159.255.8 (109.159.255.8) 21.444 ms core1-hu0-10-0-1.colindale.ukcore.bt.net (195.99.127.20) 20.624 ms core4-hu0-0-0-1.colindale.ukcore.bt.net (62.6.204.239) 20.633 ms
6 194.74.16.207 (194.74.16.207) 38.615 ms peer3-et3-1-4.redbus.ukcore.bt.net (194.72.16.186) 19.678 ms 194.74.16.247 (194.74.16.247) 20.204 ms
7 * * *
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *