From c8fea8e80153333d8f467dce06c5c0288dc472a2 Mon Sep 17 00:00:00 2001 From: pipistrello Date: Mon, 12 Oct 2026 13:12:05 +0300 Subject: [PATCH] tailscale-proxy: move ts-vpn (IKEv2 egress) exit node 06-hetzner -> 04-zomro New Tailscale UDP flows from the Kirochnaya WAN to both Hetzner exit nodes are dropped in transit (0 packets arrive; restart for a new port did not help), so IKEv2 clients had no internet. 04-zomro (NL) answers direct from ts-vpn; egress verified as 185.219.83.208, YouTube 200. Host compose already matches (ts-vpn section identical). ts-proxy left on 06-hetzner: its established flow still works. Co-Authored-By: Claude Opus 5.5 --- tailscale-proxy/docker-compose.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tailscale-proxy/docker-compose.yaml b/tailscale-proxy/docker-compose.yaml index 4021f78..3b209bd 100644 --- a/tailscale-proxy/docker-compose.yaml +++ b/tailscale-proxy/docker-compose.yaml @@ -102,7 +102,8 @@ services: TS_STATE_DIR: /var/lib/tailscale TS_USERSPACE: "false" TS_ACCEPT_DNS: "false" - TS_EXTRA_ARGS: "--exit-node=100.106.197.99 --netfilter-mode=off --reset" + # 2026-10-12: 06-hetzner unreachable for new Tailscale flows from Kirochnaya (incident 2026-10-12) -> 04-zomro (NL) + TS_EXTRA_ARGS: "--exit-node=100.122.51.71 --netfilter-mode=off --reset" cap_add: [NET_ADMIN] devices: ["/dev/net/tun:/dev/net/tun"] sysctls: