coilyco-flight-deck/infrastructure

Watch

Tailscale Android: per-app routing to Termux cycles up/down on ~10-min interval #105

New issue

Closed

opened 2026-05-24 18:47:51 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-05-24 18:47:51 +00:00

Owner

Symptom

From Kai's Pixel 9 (100.77.253.100, tailnet name pixel-9), Termux loses ability to reach the tailnet on a ~5-10 minute interval, then self-recovers ~5-10 minutes later, then drops again. Chrome on the same phone stays reachable throughout (loads http://api/ and https://forgejo.coilysiren.me continuously). No phone-side intervention triggers recovery - it just comes back on Tailscale's timescale.

Started: within the last few weeks per Kai. Tailscale Android shipped recent changes to per-app VPN routing.

Diagnostic evidence gathered today

ping -c 3 100.69.164.66 from Termux: 100% packet loss during 'down' window
ssh -4 -v kai@100.69.164.66 from Termux: hangs at Connecting to ... port 22; SYN never reaches kai-server (no entry in auth.log for the attempt)
mosh kai@100.69.164.66 from Termux: connects fine during 'up' windows; survives the 'down' windows because mosh's UDP transport tolerates the gap
Tailscale split-tunnel: exclude-list, Termux NOT excluded (so it should be tunneled)
Always-on VPN: enabled
Battery optimization: Unrestricted for both Tailscale and Termux
Tailscale app health: occasional 'San Francisco relay unavailable' warning, otherwise healthy

Workaround

Use mosh exclusively from Termux instead of ssh. Mosh's session-resumption is purpose-built for this failure mode. ssh from Termux is currently unusable.

Server-side: nothing to do

kai-server's sshd, mosh-server, and ufw are all healthy. Packets simply aren't arriving. This is an upstream Tailscale Android client bug.

Next steps when there's time

Reproduce with Tailscale Android debug logs (tailscale bugreport from the phone) and file upstream at github.com/tailscale/tailscale
Pin Tailscale Android version that worked (check Play Store update history)
Consider whether downgrading Tailscale Android is worth it

Related

Tracking doc: coilysiren/mobile-ssh-debug.md on Kai's workstation
infrastructure#102, #103, #104 - server-side hygiene surfaced during the same session

Filed by Claude.

**Symptom** From Kai's Pixel 9 (`100.77.253.100`, tailnet name `pixel-9`), Termux loses ability to reach the tailnet on a ~5-10 minute interval, then self-recovers ~5-10 minutes later, then drops again. Chrome on the same phone stays reachable throughout (loads `http://api/` and `https://forgejo.coilysiren.me` continuously). No phone-side intervention triggers recovery - it just comes back on Tailscale's timescale. **Started:** within the last few weeks per Kai. Tailscale Android shipped recent changes to per-app VPN routing. **Diagnostic evidence gathered today** - `ping -c 3 100.69.164.66` from Termux: 100% packet loss during 'down' window - `ssh -4 -v kai@100.69.164.66` from Termux: hangs at `Connecting to ... port 22`; SYN never reaches kai-server (no entry in `auth.log` for the attempt) - `mosh kai@100.69.164.66` from Termux: connects fine during 'up' windows; survives the 'down' windows because mosh's UDP transport tolerates the gap - Tailscale split-tunnel: exclude-list, Termux NOT excluded (so it should be tunneled) - Always-on VPN: enabled - Battery optimization: Unrestricted for both Tailscale and Termux - Tailscale app health: occasional 'San Francisco relay unavailable' warning, otherwise healthy **Workaround** Use `mosh` exclusively from Termux instead of `ssh`. Mosh's session-resumption is purpose-built for this failure mode. ssh from Termux is currently unusable. **Server-side: nothing to do** kai-server's sshd, mosh-server, and ufw are all healthy. Packets simply aren't arriving. This is an upstream Tailscale Android client bug. **Next steps when there's time** - Reproduce with Tailscale Android debug logs (`tailscale bugreport` from the phone) and file upstream at github.com/tailscale/tailscale - Pin Tailscale Android version that worked (check Play Store update history) - Consider whether downgrading Tailscale Android is worth it **Related** - Tracking doc: `coilysiren/mobile-ssh-debug.md` on Kai's workstation - [infrastructure#102](https://forgejo.coilysiren.me/coilysiren/infrastructure/issues/102), [#103](https://forgejo.coilysiren.me/coilysiren/infrastructure/issues/103), [#104](https://forgejo.coilysiren.me/coilysiren/infrastructure/issues/104) - server-side hygiene surfaced during the same session **Filed by Claude.**

coilysiren referenced this issue

2026-05-24 18:52:31 +00:00

Home 5GHz WiFi: Tailscale tunnel cycles up/down on ~2-5 min intervals from this network only #106

coilysiren referenced this issue

2026-05-24 20:00:26 +00:00

Home 5GHz WiFi: Tailscale tunnel cycles up/down on ~2-5 min intervals from this network only #106

coilysiren added the

priority

label

2026-06-04 08:16:54 +00:00

coilysiren commented

2026-06-17 08:22:43 +00:00

Author

Owner

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: burndown-2026-06.

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: `burndown-2026-06`.

coilysiren

2026-06-17 08:22:43 +00:00

closed this issue
added the
burndown-2026-06
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/infrastructure#105

No description provided.

Rows
Columns