Tailscale has some quirks that wasted me almost an hour!! Once a machine is tagged it has very strict ACLs - tailscale treats that machine as owned by that tag, not a human any more. It is then by default forbidden to access other devices in the tailnet, unless explicitly allowed by an ACL.
So yeah, my main docker machine, which is tagged, suddenly lost internet access because it couldn't reach the pi for DNS 😅
I didn't know this until I forced tailscale reauthorizing (because the machine can ping the pi on local IP, but not tailscale IP) and it worked. However it did because reauthorizing removes the tag. Once I added the tag back, it stopped working again. 😅 Then I realized the strict default ACLs applied to tagged machines...
#Tailscale #network #homelab
Corgi Dad
npub1je…ef73j
2026-02-17 03:28:49 UTC
in reply to nevent1q…a0yg
Author Public Key
npub1jexnpdmdqtxa07pya9sczf0qjyu26n9tw44j9alyjpf4usq8flvspef73jSeen on
wss://relay.momostr.pinkPublished at
2026-02-17 03:28:49 UTCEvent JSON
{
"id": "c4c142f38ed95de67d41757862d9365192bef1f498ef0d12936ef4acd29188c8",
"pubkey": "964d30b76d02cdd7f824e9618125e09138ad4cab756b22f7e490535e40074fd9",
"created_at": 1771298929,
"kind": 1,
"tags": [
[
"t",
"tailscale"
],
[
"t",
"network"
],
[
"t",
"homelab"
],
[
"e",
"16fd570b60ff9e35cdb61b1ba288ad695e110b6443f62db1a73d1bb87968490a",
"",
"root",
"964d30b76d02cdd7f824e9618125e09138ad4cab756b22f7e490535e40074fd9"
],
[
"p",
"964d30b76d02cdd7f824e9618125e09138ad4cab756b22f7e490535e40074fd9"
],
[
"proxy",
"https://c7.io/@corgidad/116083846639380288",
"web"
],
[
"proxy",
"https://c7.io/users/corgidad/statuses/116083846639380288",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://c7.io/users/corgidad/statuses/116083846639380288",
"pink.momostr"
],
[
"-"
]
],
"content": "Tailscale has some quirks that wasted me almost an hour!! Once a machine is tagged it has very strict ACLs - tailscale treats that machine as owned by that tag, not a human any more. It is then by default forbidden to access other devices in the tailnet, unless explicitly allowed by an ACL. \n\nSo yeah, my main docker machine, which is tagged, suddenly lost internet access because it couldn't reach the pi for DNS 😅\n\nI didn't know this until I forced tailscale reauthorizing (because the machine can ping the pi on local IP, but not tailscale IP) and it worked. However it did because reauthorizing removes the tag. Once I added the tag back, it stopped working again. 😅 Then I realized the strict default ACLs applied to tagged machines... \n\n#Tailscale #network #homelab",
"sig": "f303a0e26ad3d03a62acbfcdaa5b978b8d9d58406558d4fccd7336ac61624f85024c0e0011c0513817cc3034fa11e779dc008d2bd64f3450f60d8428c5fb9fc1"
}