Tailscale

Quick-copy commands for diagnosing connectivity over the tailnet.

Tailscale is the typical out-of-band path for accessing bare-metal nodes behind NAT (BMC, hypervisor host, jump boxes). When something on the tailnet stops responding the cause is usually one of: expired node key, DERP-relay-only path due to firewall, advertised route not accepted, or tailscaled crashed.

The commands below are the first ones to reach for. Run them on the host that is misbehaving (or on a healthy peer that is trying to reach it).

Status

tailscale status --peers=false

Quick check of the local node: backend state, derp region, advertised routes.

Why is a peer unreachable?

tailscale ping <peer-name>

Sends a tailscale-level ping. Reports DERP relay vs direct UDP path. Direct = good, DERP-only = NAT/firewall in the way.

Tailscaled log (file)

tail -f /var/log/tailscaled.log

Tailscaled log (systemd)

journalctl -u tailscaled -n 200 -f

Show advertised + accepted routes

tailscale status --json | jq '.Self | {AdvertisedRoutes,PrimaryRoutes}'

Re-register / fix expired key

sudo tailscale up --auth-key <tskey-...>

When a node's key expires it falls off the tailnet but tailscaled keeps running. Logs in journalctl will show "key expired".

Become a subnet router

sudo tailscale up --advertise-routes=10.0.0.0/24,10.1.0.0/24 --accept-routes

Required for bare-metal hosts that proxy a private subnet (e.g. management LAN, BMC network) into the tailnet.

Check NAT type / connectivity

tailscale netcheck

Reports your DERP latency map, IPv4/IPv6 addressability, UPnP/PMP/PCP, and whether you have a "hard" NAT.

Disable / re-enable

sudo tailscale down
sudo tailscale up

List peers and addresses

tailscale status | awk '$1!="#"{print $1, $2, $3}'