Tailscale PVT VPN will not work on the plusnet network

[#1]

@timsansom 

Its as though your router (or linux device) doesnt think that the tailscale IP (192.200.0.109) is outside its LAN subnet and therefore isnt routing via the default gateway.

What is the LAN subnet mask showing on both the router and linux box ? it would normally be /24

[#2]

it would normally be /24

or 255.255.255.0 

if you've got a mask somewhere showing 255.0.0.0 then that will prevent routing to the tailscale IP

[#3]

It could be that it shouldn't be > /24.

However. It could be > /24. (192.168.0.0 -> 192.168.255.255)

It can also be < /24.

[#4]

yes its a class C address /24

[#5]

With traceroute providing strange result.

are you using a virtual machine for this, if so NAT or bridged network interface?

have you setup any routes or just using the devices default gateway?

what does netstat -r (routering table) show?

If you have a Hub two, do you see the same issue?

[#6]

no this is not a VM its a baremetal installation on to a working laptop like i say everything else works a dream just some reason can not get online to tailscale domains and i can figure out why no firewalls etc are on  every other website or domain is absolutely fine but tailscale is a big no no on this debian 13 fresh install  so in theory it should just work out of the box as they say but alas its not its got me scratching my head thats for sure here is the routing table you asked for 

:~$ ip route show
default via 192.168.0.1 dev enp1s0 proto static metric 100
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1
172.18.0.0/16 dev br-f624346eb129 proto kernel scope link src 172.18.0.1
172.19.0.0/16 dev br-b97223c4a5d0 proto kernel scope link src 172.19.0.1 linkdown
172.20.0.0/24 dev br-9fd5de9c5765 proto kernel scope link src 172.20.0.1

192.168.0.0/24 dev enp1s0 proto kernel scope link src 192.168.0.3 metric 100

i am using the TP Link Archer GE800 built in DG  192.x.x.1 and as for having a Plusnet router i refuse to have ISP routers they are that bad its not the router or my set up as this was working fine a few weeks ago so i know its not my set up and nothing has changed except this laptop which had windows 11 on it and after issues with MS and their [-Censored-] software i decided to move it over to debian 13 Linux for stability reasons and not having to deal with MS update issues all the time i am using this laptop as a server for my selfhosting journey  

[#7]

On my TP-Link router found in >Advanced >System >Diagnostics 

Here I can ping and traceroute IP Address/Domain Name

PING login.tailscale.com (192.200.0.116): 64 data bytes
Reply from 192.200.0.116:  bytes=64  ttl=58  seq=1  time=20.702 ms
Reply from 192.200.0.116:  bytes=64  ttl=58  seq=2  time=19.195 ms
Reply from 192.200.0.116:  bytes=64  ttl=58  seq=3  time=20.008 ms
Reply from 192.200.0.116:  bytes=64  ttl=58  seq=4  time=20.015 ms

--- Ping Statistic "login.tailscale.com" ---
Packets: Sent=4, Received=4, Lost=0 (0.00% loss)
Round-trip min/avg/max = 19.195/19.980/20.702 ms
ping is stopped. 

Be interesting if you see the same result?

[#8]

ok i did i ping form the router's diagnostic page these results prove that its host specific but what on earth would be stopping it ? on a brand new clean installation? 

login.tailscale.com

PING login.tailscale.com (192.200.0.102): 64 data bytes
Reply from 192.200.0.102: bytes=64 ttl=56 seq=1 time=30.679 ms
Reply from 192.200.0.102: bytes=64 ttl=56 seq=2 time=30.781 ms
Reply from 192.200.0.102: bytes=64 ttl=56 seq=3 time=33.262 ms
Reply from 192.200.0.102: bytes=64 ttl=56 seq=4 time=31.445 ms

--- Ping Statistic "login.tailscale.com" ---
Packets: Sent=4, Received=4, Lost=0 (0.00% loss)
Round-trip min/avg/max = 30.679/31.542/33.262 ms
ping is stopped.

tailscale.com

PING tailscale.com (76.76.21.21): 64 data bytes
Reply from 76.76.21.21: bytes=64 ttl=243 seq=1 time=20.063 ms
Reply from 76.76.21.21: bytes=64 ttl=243 seq=2 time=20.016 ms
Reply from 76.76.21.21: bytes=64 ttl=243 seq=3 time=19.729 ms
Reply from 76.76.21.21: bytes=64 ttl=243 seq=4 time=19.795 ms

--- Ping Statistic "tailscale.com" ---
Packets: Sent=4, Received=4, Lost=0 (0.00% loss)
Round-trip min/avg/max = 19.729/19.901/20.063 ms
ping is stopped.

i also tested on my mac simular thing on the mac with the login.tailscale.com but tailscale.com succeeds Very confused.com right now 

tim@Merlin ~ % ping login.tailscale.com

PING login.tailscale.com (192.200.0.101): 56 data bytes

Request timeout for icmp_seq 0

Request timeout for icmp_seq 1

Request timeout for icmp_seq 2

Request timeout for icmp_seq 3

Request timeout for icmp_seq 4

Request timeout for icmp_seq 5

Request timeout for icmp_seq 6

Request timeout for icmp_seq 7

Request timeout for icmp_seq 8

Request timeout for icmp_seq 9

Request timeout for icmp_seq 10

Request timeout for icmp_seq 11

Request timeout for icmp_seq 12

^C

--- login.tailscale.com ping statistics ---

14 packets transmitted, 0 packets received, 100.0% packet loss

tim@Merlin ~ % ping tailscale.com

PING tailscale.com (76.76.21.21): 56 data bytes

64 bytes from 76.76.21.21: icmp_seq=0 ttl=242 time=20.992 ms

64 bytes from 76.76.21.21: icmp_seq=1 ttl=242 time=20.564 ms

64 bytes from 76.76.21.21: icmp_seq=2 ttl=242 time=20.658 ms

64 bytes from 76.76.21.21: icmp_seq=3 ttl=242 time=20.668 ms

64 bytes from 76.76.21.21: icmp_seq=4 ttl=242 time=20.208 ms

64 bytes from 76.76.21.21: icmp_seq=5 ttl=242 time=20.787 ms

64 bytes from 76.76.21.21: icmp_seq=6 ttl=242 time=20.831 ms

^C

--- tailscale.com ping statistics ---

7 packets transmitted, 7 packets received, 0.0% packet loss

round-trip min/avg/max/stddev = 20.208/20.673/20.992/0.229 ms

tim@Merlin ~ %

[#9]

Something somewhere thinks that 192.200.x.x doesnt need to be routed outside the local lan.

The fact that two devices exhibit the same problem would point at the router, but the fact that the router itself will ping 192.200.0.102 seems to contradict that ?

Not knowing much about the GE800 router, its difficult to know exactly what context it runs the ping diagnostic.

[#10]

Have you added any routing to your router? Port forward or trigger rules?

My only suggestion is to fire up wireshark to see if that comes up with an answer.

EDIT: it would be handy to test using a different router.

[#11]

right i did a capture on both the mac and the debian but they are to big to post DAM!