Tailscale Field Guide

Case studies

Drills: work the ticket.

Each drill is a realistic escalation worked end to end: the ticket as it arrives, the evidence, a hypothesis tree, an investigation where every step rules something out, the root cause, and the handoff package an engineering team could act on without follow up questions. Read them actively: decide your next command before reading the next step.

The investigation loop every drill follows symptom evidence hypotheses test root cause test kills a branch: loop every ruled out branch is progress; the last branch standing is the root cause
Which failure areas the drills cover connectivity 3 drills identity 3 drills policy 2 drills dns 2 drills routing 3 drills platform 2 drills bar length is the count, not a difficulty or importance score

connectivity

  1. Everything works but everything is slow, every path is on DERP "Tailscale works fine from the office but transfers are painfully slow, and every single peer shows relay in status." ●○○
  2. Two nodes stuck on the relay and never going direct "Both machines show active; relay in tailscale status and file sync between our offices crawls. It has never once said direct." ●●○
  3. Transfers stall for 30 to 60 seconds every time the laptop roams "Big copies to our build server freeze for about a minute whenever I leave the office wifi, and sometimes the session just dies." ●●●

identity

  1. Two servers drop off the tailnet at exactly 180 days "Both boxes dropped off at the same minute. That has to be an attack or a Tailscale outage, right?" ●○○
  2. The CI runner that vanished between pipeline stages "Tailscale randomly kicks our runner off mid pipeline. It joined fine an hour ago. This is flaky." ●●○
  3. Tagging a server kills Tailscale SSH to it "I tagged the machine and SSH died the same second. Ping works, status says active. Tailscale SSH is broken." ●●○

policy

  1. Ping works one way, so the Customer says routing is broken "Ping works from node-a to node-b but not the other way, so routing is broken between the sites." ●●○
  2. The service name that died in the grants migration "Since the ACL migration, https://billing.velvet-lizard.ts.net times out for the finance team, but the old server URL still works." ●●●

dns

  1. ts.net names die whenever the corporate VPN connects "Whenever I connect the corp VPN on my Mac, nothing .ts.net resolves. The moment I disconnect it, everything comes back. IPs always work." ●●○
  2. Internal names suddenly resolve to public IPs "Every laptop resolves gitlab.corp.example.com to a public address since this morning. It worked yesterday." ●●●

routing

  1. The subnet router works, the subnet does not "The new subnet router is up and connected, but nothing behind 10.20.0.0/16 answers from any client." ●○○
  2. Everything through the exit node crawls at 2 Mbps "The exit node makes my internet unusable, but Tailscale transfers to my other machines run at full speed. The exit node box must be broken." ●●○
  3. Two sites advertise 192.168.1.0/24 and clients land on the wrong one "Sometimes ssh to 192.168.1.10 gets the office NAS, sometimes it gets a machine at the other site, and ssh screams about changed host keys." ●●●

platform

  1. The Docker node registers as a brand new machine on every restart "Our admin console has 14 copies of the same container node, and this morning the auth key stopped working and the service went down." ●○○
  2. The macOS tunnel dies 150 seconds after every tailscale up "Every time I bring Tailscale up on my Mac it works for about two and a half minutes, then the menu bar says Not Connected. I have reconnected nine times today." ●●●