I guess the first thing to check is /Library/LaunchDaemons/com.tailscale.tailscaled.plist: is it owned by root? Does “launchctl load /Library/LaunchDaemons/com.tailscale.tailscaled.plist” return any errors?
The next thing I’d suggest is to reboot the system, leave it sit for a couple minutes, then log in. You can run /Applications/Utilities/Console.app and search for “tailscale” to see if it even tried to run prior to logging in, and what happened when it did.
Open console app and search tailscale (by simply putting “tailscale” into the search box). I tried each Device / Report section and did not see any logs related tailscale. Note I did not enable streaming and I’m assuming that if there were any tailscale related logs they’d come up. I’m not super familiar with console app so if I’m not searching properly please let me know.
I opened a terminal and ran "sudo log show --start “2022-04-10 13:19:00”, grepping for tailscale returned me some entries related to “mDNSResponder” (DNSServiceQueryRecord entries) and “symptomsd” (recording an analytics entry).
I configured launchctl to output logs from tailscaled via:
in the launchctl file. When I look at the std err output I see logs relating to bootstrap DNS / log.tailscale.io and connection failures (no route to host, network unreachable). These logs seem to be in a retry loop of some kind. Then around the time of login I see:
2022/04/11 16:16:34 LinkChange: major, rebinding. New state: interfaces.State{defaultRoute= REDACTED
2022/04/11 16:16:37 LinkChange: major, rebinding. New state: interfaces.State{defaultRoute=en1 REDACTED
2022/04/11 16:16:37 Rebind; defIf="en1", REDACTED
2022/04/11 16:16:37 magicsock: 0 active derp conns
2022/04/11 16:16:37 Rebind; defIf="en1",REDACTED
2022/04/11 16:16:37 magicsock: 0 active derp conns
2022/04/11 16:16:37 control: control server key REDACTED
2022/04/11 16:16:37 control: RegisterReq:REDACTED
2022/04/11 16:16:38 control: RegisterReq: REDACTED
2022/04/11 16:16:38 active login: ci
2022/04/11 16:16:38 Switching ipn state NoState -> Starting (WantRunning=true, nm=true)
2022/04/11 16:16:38 magicsock: SetPrivateKey called (init)
Out of an abundance of caution I redacted all but what seemed to be the basic message of the log entry - happy to provide more detail.
Seems like the link isn’t actually being activated until the user logs in. Could this be a permissions issue with the network being accessible by the tailscaled process? I’ve read MacOS can be quite strict with network permissions in launchctl daemons pre login.
I’m using MacOS 12.1 and I do have another piece of software (Screens Connect - this is what I’d like to replace with tailscale) that runs before login and enables remote inbound connections, so I know that the network is available and the machine is able to receive connections.
I’m not familiar with ScreensConnect, but it does change the network settings, I’m wondering if that might be interfering with tailscale establishing a connection.
Is it running as a System Extension? systemextensionsctl list will tell you.
I performed a few restarts after disabling screens connect and I was able to connect. I’ve just tried again and was unable to connect, not sure what happened in the few retries after uninstalling screens connect!
Hey @Jay, we’ve given this some time to run without screens connect and though sometimes we’re able to remotely connect, the majority of the time it requires a login.
We’ve got a basic M1 MacOS Big Sur installation and other than screens connect nothing else installed on the server and we’ve installed Tailscale via homebrew. This is a supported configuration, right? Want to check its not something simple before digging into debugging more :).
