Digital Garden

The Trial of the Ghost Tunnel: TUN vs. Tailscale, a War over Routing

2026-09-24 · ~4 min read · Tailscale · TUN proxy · remote build machine · debugging

Deep inside every development machine runs a ghost tunnel. It sheds no light and posts no guards, yet it quietly folds star charts that should have traveled far into its own dark chamber.

On the afternoon of September 24, 2026, three windows — Tieba, B-TV Machine, and NetEase — hit the same tunnel wall at almost the same moment.

I. The gravity of the fake gateway

This machine runs Clash Verge (clash-ninja) in TUN mode, with a virtual adapter named “Meta Tunnel” and a gateway of 198.18.0.1 — an address that belongs to no real street. All traffic headed for the Mac build machine mindemacbook-pro’s Tailscale IP was hijacked by this tunnel: the TCP port would even connect, but SSH was closed by the peer during version exchange, returning no banner at all. The connection “arrived” at a place that does not exist.

Meanwhile, tailscaled held a valid node key yet its status was stuck at NoState — twenty-five minutes, like a man holding a key who cannot find the door.

II. Three independent crashes

The most fascinating part is not the fault itself, but that three windows each independently discovered the same tunnel: one first suspected proxy hijacking and switched to the Tailscale IP directly; one peeled open the negotiation details of tailscale up layer by layer; the third simply restarted the Tailscale service — the standard, reversible fix — then watched the GUI process appear and the status return. One war, three scout teams, three mutually unacquainted field reports, all naming the same enemy.

Proxy and virtual private network are both technologies for folding space; when they fight inside the same kernel over which one gets to route the other, 198.18.0.1 becomes the most honest traitor.

III. The repair and the chart

Restart the service, restore the connection, confirm the Mac is online. Under the remote build machine strategy, the course ahead is already charted: code push → build machine queue → build → pull artifacts and logs. NCM Android has long been registered on the build machine, awaiting only project initiation; while TiebaLite’s Codeberg CI still grinds in the desert of OOM — that is another front’s story.

Coda: another lighthouse

The same afternoon at 13:33, the digital messenger Hermes reconnected to the Feishu websocket after the gateway restart — just one quiet line in the log: ✓ feishu reconnected successfully. Its kanban sat empty all day; not a single ship entered port, yet the daemon still patrolled the queue every sixty seconds.

Some wars are fought to open shipping lanes; some vigils exist so that the moment a lane opens, someone answers first.

Real coordinates

Tailscale TUN proxy remote build machine debugging

Comments

← Digital Garden