Unable to ssh between Macs via Tailscale network

[davraamides]

What is the issue?

I've installed Tailscale 1.28.0 on two different Macs on my home network. I've signed in and verified that both machines are active on the Tailscale network. I can ping between them but when I try to connect via ssh, it times out. I've verified that Tailscale is the only VPN client on both machines and that I do not have any anti-malware or network firewall software running on either machine.

Steps to reproduce

I'm trying to connect from my laptop, air to my desktop, imac. The laptop can see imac as active and can ping it.

david@air MacOS % ./Tailscale status   
100.115.243.15  air                  david.avraamides@ macOS   -
100.101.214.11  davids-iphone-11-pro david.avraamides@ iOS     offline
100.124.224.54  imac                 david.avraamides@ macOS   active; direct 192.168.1.203:41641, tx 4356 rx 3932
100.74.142.36   spac                 david.avraamides@ linux   -
100.98.21.101   studio               david.avraamides@ macOS   -

david@air MacOS % ./Tailscale ping imac
pong from imac (100.124.224.54) via 192.168.1.203:41641 in 7ms

When trying to use Tailscale ssh it times out.

david@air MacOS % ./Tailscale ssh imac 
ssh: connect to host imac.david-avraamides.gmail.com.beta.tailscale.net. port 22: Operation timed out

I read that this is sometimes an issue but the built-in ssh should work. Yet, when I try the built-in ssh it also times out.

david@air MacOS % ssh imac
ssh: connect to host imac port 22: Operation timed out

However, I can ssh successfully on my local network fine.

david@air MacOS % ping imac.local
PING imac.local (192.168.1.203): 56 data bytes
64 bytes from 192.168.1.203: icmp_seq=0 ttl=64 time=7.518 ms
64 bytes from 192.168.1.203: icmp_seq=1 ttl=64 time=5.178 ms
^C
--- imac.local ping statistics ---
2 packets transmitted, 2 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 5.178/6.348/7.518/1.170 ms

david@air MacOS % ssh imac.local
Last login: Thu Aug 18 07:24:55 2022

Are there any recent changes that introduced the issue?

This was working a couple of weeks ago and I haven't installed anything new, but there has been at least one auto-update to macOS in that period.

OS

macOS

OS version

Monterey 12.5

Tailscale version

1.28.0

Bug report

BUG-8c4fe2d5c9a9447074c5cd64ac3781cc1b8e4dfa4f83a19e4117e624b2387c15-20220818145243Z-e1d8e54700682798

[DentonGentry]

Though the error message could be better I guess, SSH support doesn't work in the macOS version of the client: #4518

The Network Extension runs within a sandbox with enough restrictions that I don't expect to be able to add SSH support.

[davraamides]

Right, but according to #4628, just plain ssh should work and as you can see from above, that also times out (when I use the Tailscale host name or the Tailscale IP address) but ssh works when I use <host>.local to route through the local network.

[davraamides]

I dug into this some more and noticed that the Console was showing these errors:

open-conn-track: flow TCP 100.124.224.54:56468 > 100.113.180.70:22 rejected due to acl
...

I had not set up any Access Controls but it looked like the default was being applied? So I edited it to give me access and it's working now.