Github inaccessible on tailscale RaspAP hotspot

[r4nchy]

Hey I have setup my Raspberrypi in such a way that the raspap hostspot shares the tailscale's tailnet in the wifi access point.

So all the devices connected to the Raspap access point don't need to have tailscale installed in them.

And on such devices that are connected to RaspAP access ping, nearly all websites are working fine except for github.com
For some reason I can ping and nslookup the github.com but can't access it on browser and even on curl command curl -v https://github.com it hangs.

I have checked the pihole, RaspAP ad blocking etc and none of them has github.com in them. I can successfully run the curl -v https://github.com in the raspap's terminal.

I have tried accessing github.com on other devices connected to Raspap hostspot/access point and all have this same issue.

C:\Users\alexd>ping github.com

Pinging github.com [20.207.73.82] with 32 bytes of data:
Reply from 20.207.73.82: bytes=32 time=170ms TTL=115
Reply from 20.207.73.82: bytes=32 time=172ms TTL=115
Reply from 20.207.73.82: bytes=32 time=149ms TTL=115
Reply from 20.207.73.82: bytes=32 time=137ms TTL=115

Ping statistics for 20.207.73.82:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 137ms, Maximum = 172ms, Average = 157ms

C:\Users\alexd>nslookup github.com
Server:  pi.hole
Address:  192.168.0.101

Non-authoritative answer:
Name:    github.com
Address:  20.207.73.82


C:\Users\alexd>curl -v https://github.com
* Host github.com:443 was resolved.
* IPv6: (none)
* IPv4: 20.207.73.82
*   Trying 20.207.73.82:443...
* schannel: disabled automatic use of client certificate
* ALPN: curl offers http/1.1
^C
C:\Users\alexd>

[billz]

That's a weird one. Both RaspAP's Ad block and Pi-hole use DNS blacklisting (there's no real advantage to using both). Try disabling them, repeat your tests and compare the results.

[r4nchy]

So I have disabled the RaspAP's adblocking and still get exactly the same result.

This time I also check the stripe.com and got the same issue, I can't access stripe.com and github.com. However something like reddit.com is accessible.

Below is the ping, nslookup, curl and tracert test on each of the 3 domain

PING TEST

C:\Users\alexd>ping github.com

Pinging github.com [20.207.73.82] with 32 bytes of data:
Reply from 20.207.73.82: bytes=32 time=220ms TTL=115
Reply from 20.207.73.82: bytes=32 time=225ms TTL=115
Reply from 20.207.73.82: bytes=32 time=251ms TTL=115
Reply from 20.207.73.82: bytes=32 time=194ms TTL=115

Ping statistics for 20.207.73.82:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 194ms, Maximum = 251ms, Average = 222ms
----------------------
C:\Users\alexd>ping stripe.com

Pinging stripe.com [3.1.98.10] with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 3.1.98.10:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

----------------------
C:\Users\alexd>ping reddit.com

Pinging reddit.com [151.101.1.140] with 32 bytes of data:
Reply from 151.101.1.140: bytes=32 time=197ms TTL=56
Reply from 151.101.1.140: bytes=32 time=199ms TTL=56
Reply from 151.101.1.140: bytes=32 time=288ms TTL=56
Reply from 151.101.1.140: bytes=32 time=349ms TTL=56

Ping statistics for 151.101.1.140:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 197ms, Maximum = 349ms, Average = 258ms

NSLOOKUP

C:\Users\alexd>nslookup github.com
Server:  pi.hole
Address:  192.168.0.101

Non-authoritative answer:
Name:    github.com
Address:  20.207.73.82

----------------------
C:\Users\alexd>nslookup stripe.com
Server:  pi.hole
Address:  192.168.0.101

Non-authoritative answer:
Name:    stripe.com
Addresses:  18.140.144.179
          3.1.98.10
          54.179.176.233

----------------------
C:\Users\alexd>nslookup reddit.com
Server:  pi.hole
Address:  192.168.0.101

Non-authoritative answer:
Name:    reddit.com
Addresses:  2a04:4e42:600::396
          2a04:4e42::396
          2a04:4e42:200::396
          2a04:4e42:400::396
          151.101.1.140
          151.101.65.140
          151.101.129.140
          151.101.193.140

CURL TEST

you can see for both github and stripe the curl command just get stuck at ALPN: curl offers http/1.1

C:\Users\alexd>curl -v https://github.com
* Host github.com:443 was resolved.
* IPv6: (none)
* IPv4: 20.207.73.82
*   Trying 20.207.73.82:443...
* schannel: disabled automatic use of client certificate
* ALPN: curl offers http/1.1
^C
----------------------

C:\Users\alexd>curl -v https://stripe.com
* Host stripe.com:443 was resolved.
* IPv6: (none)
* IPv4: 13.250.226.27, 52.76.2.220, 13.228.68.255
*   Trying 13.250.226.27:443...
* schannel: disabled automatic use of client certificate
* ALPN: curl offers http/1.1
^C
----------------------

C:\Users\alexd>curl -v https://reddit.com
* Host reddit.com:443 was resolved.
* IPv6: (none)
* IPv4: 151.101.1.140, 151.101.65.140, 151.101.129.140, 151.101.193.140
*   Trying 151.101.1.140:443...
* schannel: disabled automatic use of client certificate
* ALPN: curl offers http/1.1
* ALPN: server accepted http/1.1
* Connected to reddit.com (151.101.1.140) port 443
* using HTTP/1.x
.
.
.

TRACE ROUTE TEST

C:\Users\alexd>tracert github.com

Tracing route to github.com [20.207.73.82]
over a maximum of 30 hops:

  1    28 ms     2 ms     2 ms  ha.raspap.example.xyz [10.3.141.1]
  2   158 ms   161 ms   196 ms  pi.hole [100.108.171.11]
  3   160 ms   149 ms   169 ms  192.168.0.1
  4   447 ms   257 ms   217 ms  192.168.1.1
  5   160 ms   160 ms   150 ms  10.240.9.212
  6   179 ms   189 ms   179 ms  172.31.0.146
  7   163 ms   165 ms   130 ms  182.78.194.21
  8   210 ms     *      230 ms  116.119.49.101
  9     *        *        *     Request timed out.
 10   215 ms   194 ms   209 ms  ae29-0.rwa04.pnq20.ntwk.msn.net [104.44.230.159]
 11     *        *        *     Request timed out.
 12     *        *        *     Request timed out.
 13     *        *        *     Request timed out.
 14     *        *        *     Request timed out.
 15   276 ms     *      229 ms  20.207.73.82

Trace complete.

----------------------

C:\Users\alexd>tracert stripe.com

Tracing route to stripe.com [13.228.68.255]
over a maximum of 30 hops:

  1     4 ms     2 ms     1 ms  ha.raspap.example.xyz [10.3.141.1]
  2   153 ms   155 ms   202 ms  pi.hole [100.108.171.11]
  3   204 ms   203 ms   194 ms  192.168.0.1
  4   192 ms   163 ms   154 ms  192.168.1.1
  5   182 ms   183 ms   169 ms  10.240.9.212
  6   168 ms     *      279 ms  172.31.0.131
  7   214 ms   186 ms   207 ms  125.18.1.1
  8   255 ms   296 ms   454 ms  116.119.57.156
  9     *        *        *     Request timed out.
 10     *        *        *     Request timed out.
 11     *        *        *     Request timed out.
 12     *        *        *     Request timed out.
 13     *        *        *     Request timed out.
 14     *        *        *     Request timed out.
 15     *        *        *     Request timed out.
 16     *        *        *     Request timed out.
 17     *        *        *     Request timed out.
 18     *        *        *     Request timed out.
 19     *        *        *     Request timed out.
 20     *        *        *     Request timed out.
 21     *        *        *     Request timed out.
 22     *        *        *     Request timed out.
 23     *        *        *     Request timed out.
 24     *        *        *     Request timed out.
 25     *        *        *     Request timed out.
 26     *        *        *     Request timed out.
 27     *        *        *     Request timed out.
 28     *        *        *     Request timed out.
 29     *        *        *     Request timed out.
 30     *        *        *     Request timed out.

Trace complete.

----------------------

C:\Users\alexd>tracert reddit.com

Tracing route to reddit.com [151.101.1.140]
over a maximum of 30 hops:

  1     5 ms     2 ms     1 ms  ha.raspap.example.xyz [10.3.141.1]
  2   171 ms   194 ms   212 ms  pi.hole [100.108.171.11]
  3   156 ms     *      190 ms  192.168.0.1
  4   308 ms   243 ms     *     192.168.1.1
  5   388 ms   208 ms   199 ms  10.240.9.212
  6   204 ms   234 ms   212 ms  172.31.0.147
  7   185 ms   203 ms   182 ms  125.18.1.1
  8   215 ms   206 ms   201 ms  116.119.36.180
  9   202 ms   189 ms   176 ms  167.82.128.6
 10   175 ms   218 ms   199 ms  151.101.1.140

Trace complete.

[billz]

The ping failure suggests selective blocking. Given that pi.hole is the server used for nslookup, I suspect Pi-Hole is intervening rather than something related to Tailscale. If you still suspect Tailscale (or RaspAP), there are a few other tests you can do.

Use curl without ALPN negotiation, bypass it entirely, then bypass DNS:

curl -v --http1.1 https://github.com
curl -v --http1.1 https://stripe.com
curl -v --no-alpn https://github.com
curl -v --no-alpn https://stripe.com
curl -v --resolve github.com:443:20.207.73.82 https://github.com
curl -v --resolve stripe.com:443:18.140.144.179 https://stripe.com

Use curl without the exit node (or stop Tailscale entirely):

tailscale up --exit-node=none
curl -v https://github.com

[r4nchy]

I tried the above curl commands even with the pihole disabled but it didn't work

then I tried to disable exitnode on tailscale

ok so previously I was using the following tailscale set of commands

sudo tailscale up --accept-dns=false --advertise-routes=10.3.141.0/24,192.168.1.0/24 --exit-node-allow-lan-access --exit-node=100.108.171.11 --ssh

now as you said to run without exitnode (I also had to remove the --exit-node-allow-lan-access as required ) then I ran the following

sudo tailscale up --exit-node= --accept-dns=false --accept-routes --advertise-routes=10.3.141.0/24,192.168.1.0/24 --ssh --reset

and sure the github and stripe are accessible now along with all other stuff

[billz]

problem solved?

[r4nchy]

yes problem is solved with the above command :)
thanks for pointing me in the correct direction.

However, I will have to troubleshoot why the exitnode way wasn't working.

anyways thanks

[billz]

glad you found a solution. I've started work on a Tailscale plugin. would you be interested in testing it?

[r4nchy]

I am still new to the vpn and tailscale thing