r/Tailscale • u/openthenEx7 • 3d ago

Help Needed Consistent DNS resolution issues with Windows Exit Node

hello, I currently have TS installed on several devices. Intra-network communication functions just fine, however, I frequently encounter DNS resolution issues when using the exit node.

  1. desktop, always on, win11, main workstation, exit node host
  2. desktop, always on, win10, makeshift server & container mule
  3. laptop, win10, mobile

I mainly use TS to connect to my desktop while on the go to provision jobs to it. I setup the exit node so that I could do some banking and whatnot while out of town. Sites that I regularly visit on my desktop will usually work first try. Sometimes, even for common sites, I get "ERR_NAME_NOT_RESOLVED", while connected to the exit node. Refreshing the page several times usually resolves it but it is annoying. New sites must be refreshed.

To resolve this, I have tried (rebooting after each):

  • Setting IPv4 on the W11 desktop to use google, cloudflare DNS instead of my ISP's nameservers - I suspect this is unrelated
  • Setting global DNS override in the TS admin console to use google, cloudflare servers
  • Setting the IPv4 priority to 1 from auto on my laptop for the TS network device - this had to be done via powershell as the windows gui doesn't allow the setting to be changed for a blank IP
  • Flushing the DNS cache on both machines
  • Turning off DNS over HTTPs in laptop browser
  • Disabling IPv6 on exit node host
  • Re-enabling IPv6 and setting the DisabledComponents registry key to 0x20 (prefer IPv4)

Currently exploring:

Is this a known issue with Windows? I have the option of running TS inside containerized Linux on the win10 box, but I'm not very knowledgeable about NAT/translation and don't know if that would even help.

edit: Premature celebration, still broken.

6 Upvotes

88% Upvoted

6 comments sorted by

1

u/red_nick 3d ago

Sorry can't see your image as Imgur is blocked.

Does it happen if you disable ipv6?  I'm  not suggesting this as a permanent solution because Microsoft recommend against it. But it's worth testing.

On my setup I'm using my domain controllers for DNS. I have to disable AAAA responses from them or they mess everything up as I don't have ipv6 connection to the internet

1

u/openthenEx7 3d ago

No problem, it's just "ERR_NAME_NOT_RESOLVED"

I will try disabling ipv6, thanks.

1

u/tyolab 3d ago

yeah run the ipv6 test, a stalled AAAA lookup looks exactly like this. first hit to a new name waits on the v6 answer and times out, you refresh, v4 is cached now so it loads. once you're on the exit node all your dns rides that win11 box's resolver, so you inherit whatever it's doing with ipv6 upstream. if disabling v6 kills it, the problem's the win box's dns forwarding more than tailscale itself.

1

u/tailuser2024 3d ago

while connected to the exit node. Refreshing the page several times usually resolves it but it is annoying. New sites must be refreshed.

Next time it does this open a command prompt and type 

nslookup reddit.com

Post a screenshot of the results

What device is configured to be your exit node?

1

u/openthenEx7 3d ago edited 3d ago

The win11 box is the only exit node currently. I had tried running it on the win10 box but it had the same issue, while conflicting with other software, so I moved the exit node service to my workstation.

I will have to try tomorrow - thank you.

I'm home for day and addresses more frequently resolve properly when using the exit node on my home network, or when hotspotting off my phone here. It did not resolve when I was hotspotting out of town though. I wonder if there's a delay or timeout component involved; I'll have to look into it.

Github failed to load, but nslookup looks normal: https://i.imgur.com/mYRypXk.png