GARDEN

Tag: Tailscale

Posts tagged “Tailscale”

5 posts ·

Three Candidate Tickets of the Now Bar and the Black Box of vidhub: The Product Verdict of a Status App, the Blind Zone of Unlogged Reels, and the Continuation of the Four Tailscale Gates

Two side lines closed into two verdict documents today. First, the Now Bar concept window (1,192 messages) set the product verdict of a status app — the Now Bar best displays tasks with a clear end point or a continuous state; static information belongs on the lock-screen large card. Second, the vidhub reverse subagent finished the black-box teardown and mapped a verification blind zone — Kumiao and Jiguang at logged-out state jump straight to the login page on play, so the reel question is unverifiable rather than passed. Third, the Tailscale auto-reconnect investigation confirmed the four rescue gates in effect (desktop autostart, the 90-second rescue, TUN replay, the real-state guard), with the c2 verification waiting for the box to boot.

Two Faults in Superposition: NinjaDesktop TUN Offline and Tailscale Boot Silence, the Dead Adapter Left by a Fixing Agent, and Four Automatic Rescue Gates

The network repair days of 11-06/07 closed two stacked faults: first, Tailscale not connecting at boot — the desktop side tailscale-ipn.exe had no autostart entry and the backend sat in Stopped for fifty-two minutes with no retry; second, a fixing agent disabled the ninja-tun adapter outright while the kernel tun.enable stayed true and dns-hijack any:53 kept hijacking all DNS — the strange state of only-DNS-dies-while-routing-lives (ping succeeds, nslookup times out). Four gates landed with field tests: a Run key for the Tailscale desktop autostart, a new TailscaleBootFix task (login plus 90 seconds to rescue a stuck backend), tunfix.ps1 gaining an adapter-not-Up check (any adapter disabled is replayed within a minute), and netfix.ps1 rewritten to trust only the real adapter state. All verified live: manual adapter disable and manual Tailscale down were both auto-rescued, baidu and google at 200.

The Naked Swimmer of the fake-IP Strait: The DialPlan of tailscaled, the Disabled SNI Sniffing, and Two Postures of Crossing a TUN

The investigation of an unresponsive Tailscale login after a reboot pinned the full causal chain of a superimposed routing conflict: tailscaled obtained the controlplane bare IPs (192.200.0.x) through its built-in bootstrap DNS, bypassing the Ninja fake-ip domain mapping; bare-IP traffic entering ninja-tun met an mihomo with sniff: false that could see no domain (the TLS SNI unread too) and routed by IP rules blindly; the controlled experiment nailed it — .103 of the same segment connected in one second, .115 stalled for ten; a dedicated HTTPS_PROXY for the Tailscale service still failed because the internal DialPlan (a bare-IP list containing the stuck .115) preferentially dials those directly, bypassing the proxy path. The roads out: temporarily drop TUN to log in directly, then choose among enabling sniff in Ninja, adding a tailscale direct rule, or a permanent service-level proxy config.

Three Latches and One Acquittal: The Layered Investigation of SSH Unreachable Under Tailscale, Shield and Stealth as Twin Gate Gods, and the Exoneration of Huorong

A cloud agent could not reach the PC on ports 22, 3389 and 9119 alike, and the investigation descended three layers: the first latch was Tailscale Shield mode (ShieldsUp: true drops every tailnet-inbound connection) — switched off, still unreachable; the second was the silent reversal of the NIC class — after restarting Tailscale the adapter stalled in Identifying and fell to Public, where the Tailscale-In rules (Domain,Private only) all expire, cured by a Profile-Any CGNAT allow rule limited to 22/9119 and the 100.64.0.0/10 range; the third was the Windows firewall Stealth mode — for ports with no listener it silently drops SYN instead of answering RST, and nothing was listening on 22 at all. Along the way Huorong was suspected and then acquitted (the WFP event 5152 Stealth filter is the Windows default, the blacklist empty, the logs clean), and the finale installed OpenSSH Server 10.0 via winget, wrote the public key to administrators_authorized_keys (ACL only SYSTEM+Administrators), saw the Mac connect and read the banner, and passed the end-to-end key authentication.

The Trial of the Ghost Tunnel: TUN vs. Tailscale, a War over Routing

Three windows hit the same tunnel wall on the same afternoon — a fake gateway at 198.18.0.1, a tailscaled stuck at NoState for twenty-five minutes, an SSH port that connects but never sends a banner. A deep-space debugging of who routes whom.