Tailscale 1.86 status returns 'logged out'

[rustycanb]

What is the issue?

After running tailscale regularly up to version 1.84 then upgrading to 1.86 my tailnet will not connect with tailscale status ``showing logged out.
Reverting to 1.84 does not solve the issue on 5 devices.
I can login to web GUI with all devices showing not connected.
sudo tailscale up hangs with no response.
uname -a Linux zBook 6.14.0-24-generic #24-Ubuntu SMP PREEMPT_DYNAMIC Sun Jun 15 11:18:07 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Steps to reproduce

No response

Are there any recent changes that introduced the issue?

No response

OS

No response

OS version

No response

Tailscale version

No response

Other software

No response

Bug report

No response

[hiddenvs]

Common issue and not working on new devices. Any idea ?

Installation complete! Log in to start using Tailscale by running:
sudo tailscale up

After starting tailscale up is finish, nothing shown, doing nothing...

I tried tailscale status

Health check:

- You are logged out. The last login error was: fetch control key: Get "https://controlplane.tailscale.com/key?v=122": dial tcp [2606:b740:49::103]:443: connect: network is unreachable

unexpected state: NoState

Also https://login.tailscale.com is not working anymore what's totally weird.

[jasonodonnell]

Hello, can you provide a trace route for login.tailscale.com? This would be helpful to understand why you can't connect to our services.

There are a subset of ISPs( #16649 ), so far mostly in Australia under NBN, that are blocking the 192.200.0.0/24 addresses and we've sent them a request to investigate the issue.

[jasonodonnell]

Hello again,
We've seen traceroutes from a few users indicating that a few ISPs are not routing these IP addresses correctly. While we're actively reaching out to ISPs on behalf of affected users, it would be extremely helpful if impacted users could also contact their ISPs directly.

These IPs belong to a valid, globally routable IPv4 block registered to Tailscale, as shown here: ARIN WHOIS – NET-192-200-0-0-1.

We suspect the issue may be due to outdated or misconfigured bogon filters causing this traffic to be inadvertently blocked or misrouted.

[rustycanb]

Absolutely an ISP issue! I can connect to Tailscale using my phone's mobile data (Telstra Australia) and ISP discaonnected.
I will investigate with my ISP, Southern Phone, which is owner by the large provider TPG Australia, I think.
Rebooting and reconnecting to Southern Phone and Tailscale is down again.
NBN is the base provider in Australia which sells services to customer-facing ISPs like Southern Phone, so the problem is most likely with NBN...

[rustycanb]

Reported the issue to Southern Phone, my ISP, who said there were other similar complaints about users not being able to connect to tailscale. The problem has been escalated to the senior tech team.

[luckman212]

If we already installed 1.86 on a handful of systems, is it important to roll back or can we leave it?

[rustycanb]

All devices connected again. However, I rolled back to 1.84 because 1.86 does not seem to be in the tailscale repos as yet.

[zhouska]

I have been able to pinpoint the issue to be happening on tailscale running on FreeBSD (pfsense) only, both nodes are set as 'Expiry disabled' in the admin console, but every now and then (usually after pfsense upgrade and reboot), the tailascale client goes belly up:

root@gw:~ # tailscale status
# Health check:
#     - Unable to connect to the Tailscale coordination server to synchronize the state of your tailnet. Peer reachability might degrade over time.
#     - You are logged out. The last login error was: invalid key: API key does not exist

unexpected state: NoState
root@gw:~ # tailscale version
1.86.4
  long version: 1.86.4
  go version: go1.24.6
root@gw:~ # tailscale status
# Health check:
#     - You are logged out. The last login error was: invalid key: API key does not exist

unexpected state: NoState
root@gw:~ # 
root@gw:~ # 
root@gw:~ # tailscale status
unexpected state: NoState

The only way to solve this is to create a new node and paste in the tskey-auth from the install script. No other OS I'm using tailscale on is showing this issue. The issue persist across the version (even earlier than 1.84).

[Jakezxz-1]

Wanted to add +1 for an ISP Issue, Vodafone in the UK, from our experience with 200 devices, seems to be having the same issue. We suddenly lost monitoring to all devices connected to the Vodafone Three UK Network and have been working out what happened. Unfortunately, we do not have the size or weight to get direct ISP support. Would be grateful for Tailscale to support us with connecting with them?

Mon Sep 1st 20:19:39 2025 tailscale ERR 2025/09/01 19:19:39 Received error: fetch control key: Get "https://controlplane.tailscale.com/key?v=106": read tcp 10.52.90.141:50798->192.200.0.106:443: read: connection reset by peer Mon Sep 1st 20:19:39 2025 tailscale ERR 2025/09/01 19:19:39 Received error: fetch control key: Get "https://controlplane.tailscale.com/key?v=106": read tcp 10.52.90.141:50796->192.200.0.106:443: read: connection reset by peer Mon Sep 1st 20:19:39 2025 tailscale ERR 2025/09/01 19:19:39 health(warnable=login-state): error: You are logged out. The last login error was: fetch control key: Get "https://controlplane.tailscale.com/key?v=106": read tcp 10.52.90.141:50796->192.200.0.106:443: read: connection reset by peer Mon Sep 1st 20:19:39 2025 tailscale ERR 2025/09/01 19:19:39 Received error: fetch control key: Get "https://controlplane.tailscale.com/key?v=106": read tcp 10.52.90.141:50794->192.200.0.106:443: read: connection reset by peer Mon Sep 1st 20:19:39 2025 tailscale ERR 2025/09/01 19:19:39 health(warnable=login-state): error: You are logged out. The last login error was: fetch control key: Get "https://controlplane.tailscale.com/key?v=106": read tcp 10.52.90.141:50794->192.200.0.106:443: read: connection reset by peer

[jasonodonnell]

I can reach out to Vodafone. It would be helpful if you could provide me with a traceroute so I can include it in my inquiry.

[eugecm]

I'm seeing the same issues from Vodafone UK since the IP changes to the control plane.

Attaching a traceroute

traceroute to controlplane.tailscale.com (192.200.0.101), 30 hops max, 60 byte packets
 1  _gateway (192.168.1.1)  0.118 ms  0.127 ms  0.110 ms
 2  192.168.2.1 (192.168.2.1)  0.640 ms  0.595 ms  0.579 ms
 3  * * *
 4  192.168.174.2 (192.168.174.2)  36.161 ms  36.147 ms  34.975 ms
 5  * * 192.168.172.94 (192.168.172.94)  37.674 ms
 6  * * *
 7  172.21.251.233 (172.21.251.233)  36.980 ms  38.789 ms  37.776 ms
 8  63.130.172.45 (63.130.172.45)  39.941 ms  14.963 ms  35.697 ms
 9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
14  * * *
15  * * *
16  * * *
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * * *
23  * * *
24  * * *
25  * * *
26  * * *
27  * * *
28  * * *
29  * * *
30  * * *

[jasonodonnell]

Thanks, @eugecm. I’ve reached out to Vodafone to try and get this resolved. I’d also encourage other Vodafone customers to contact their support, as a higher volume of inquiries can help speed up response times.