3.1 KiB
3.1 KiB
Tailscale Mesh Connectivity Test
Last tested: 2026-03-31
Test Method
Full tailscale ping from each SSH-accessible host to all other online Headscale nodes. This tests WireGuard tunnel establishment and reports whether the connection is direct (peer-to-peer) or relayed via DERP.
Results
All 10 online hosts can reach all other online hosts. No failures.
Connection Type Matrix
D = direct, R = DERP relay, — = self
| From \ To | Atlantis | Calypso | Pi-5 | Homelab | Matrix-Ubuntu | Setillo | NUC | Guava | Seattle | PVE |
|---|---|---|---|---|---|---|---|---|---|---|
| Atlantis | — | D | D | D | D | D | D | D | D | D |
| Calypso | D | — | D | D | D | R | D | D | D | D |
| Pi-5 | D | D | — | D | D | D | D | D | D | D |
| Homelab-VM | D | D | D | — | D | R | D | D | D | D |
| Matrix-Ubuntu | (tested inbound) | — | ||||||||
| Setillo | D | D | D | R | R | — | ||||
| NUC | D | D | D | D | R | D | — | R | D | R |
| Guava | (no CLI) | — | ||||||||
| Seattle | D | D | D | D | D | D | R | D | — | D |
| PVE | D | D | D | D | D | D | D | D | D | — |
Notes
- Atlantis/Calypso: Tailscale binary at
/var/packages/Tailscale/target/bin/tailscale(Synology package) - Setillo: Tailscale binary at
/usr/local/bin/tailscale - Guava: Tailscale runs via TrueNAS built-in management; no
tailscaleCLI in PATH. Confirmed reachable via inbound pings from all other hosts. - Matrix-Ubuntu: SSH via LAN IP (192.168.0.154) was unreliable during testing due to table 52 LAN interception (since fixed). Confirmed reachable via Tailscale IP and inbound pings.
- DERP relays (NUC ↔ some peers, Setillo ↔ homelab/matrix-ubuntu): Normal for nodes behind different NATs. Adds 15-60ms latency but does not affect reliability. Connections may upgrade to direct over time.
ICMP Ping Notes
Standard ICMP ping from the OS (not tailscale ping) fails for Atlantis, Calypso, and Setillo because those hosts have ICMP blocked at the firewall level. This does not indicate a connectivity problem — tailscale ping and SSH both work.
Tailscale Health Warnings
After fixes applied on 2026-03-31:
| Host | Health |
|---|---|
| Homelab-VM | none |
| Pi-5 | none |
| NUC | none |
| Seattle | none |
| PVE | none (was --accept-routes is false, fixed) |
| Matrix-Ubuntu | none (was --accept-routes is false, fixed) |
Fixes Applied (2026-03-31)
- Pi-5: Enabled
--accept-routes, added LAN routing rule (priority 5200), persistent via dispatcher script + cron - Matrix-Ubuntu: Enabled
--accept-routes, added LAN routing rule (priority 5200), persistent via dispatcher script + cron - PVE: Enabled
--accept-routes, added LAN routing rule (priority 5200), persistent via cron @reboot - Kuma monitors: Added LAN-based monitors for Rustdesk (ID:124) and Rackula (ID:125) on
192.168.0.250to replace flapping Tailscale IP monitors. Fixed corruptedaccepted_statuscodes_jsonfield in Kuma DB.
See LAN Routing Fix for full details on the table 52 issue.