tailscale ping works, but regular ping does not work

[skeptrunedev]

What is the issue?

Problem

tailscale ping successfully reaches peer nodes, but regular ICMP ping fails with 100% packet loss.

Environment

• Tailscale version: 1.88.1 (commit 032962f4bc)
• OS: Pop!_OS 22.04, Kernel 6.12.10-76061203-generic
• Target node: 100.88.39.117 (skeptrune-thelio)

What works

• tailscale ping 100.88.39.117 - successful (7-65ms latency)

What doesn't work

• ping 100.88.39.117 - 100% packet loss

Configuration tried

• Both machines have --shields-up=false enabled
• --accept-routes enabled
• Routes exist in routing table 52 for the target IP
• Attempted userspace networking mode

Expected behavior

Regular ICMP ping should work when tailscale ping works.

Steps to reproduce

1. Set up two Linux machines on the same Tailscale network

   • Machine A (source): Pop!_OS 22.04, Tailscale 1.88.1
   • Machine B (target): 100.88.39.117 (skeptrune-thelio)

2. On both machines, configure Tailscale with:
   tailscale up --shields-up=false --accept-routes --ssh

3. Verify connectivity with Tailscale's ping:
   tailscale ping 100.88.39.117
   Expected: Success with response time (e.g., "pong from skeptrune-thelio via 10.103.0.231:41641 in
   7ms")

4. Attempt regular ICMP ping:
   ping 100.88.39.117
   Expected: Should work
   Actual: 100% packet loss

5. Verify routes exist:
   ip route show table all | grep 100.88.39.117
   Shows: 100.88.39.117 dev tailscale0 table 52

6. Note that Machine A is using an exit node (100.104.188.67)

Result

• tailscale ping consistently works
• Regular ping consistently fails with 100% packet loss

Are there any recent changes that introduced the issue?

No response

OS

Linux

OS version

Pop!_OS 22.04, Kernel 6.12.10-76061203-generic

Tailscale version

1.88.1-t032962f4b-gc5ad3b22f

Other software

None that I am aware of. This was working on headscale.

Bug report

BUG-a41543ba6f0b01d6568fa46a4977f2f083edfb2f46235c2400263ddb330ec9f9-20251008014936Z-0cf3c9aefcff94d8

[bradfitz]

That usually means you have an OS firewall blocking things.

[elliottkopp]

I also have this same issue. The only fix is to tailscale down and tailscale up on the source machine.
Can confirm that the ip route command does not show a route to machine B in this example. After doing a tailscale up/down, the route table entries exist and regular ICMP ping works.