Opkg update fails when Tailscale is running (Subnet Router)

Aisfkhan · June 15, 2026, 11:37am

Hi everyone,

I'm running OpenWrt 24.10.7 on a MediaTek Filogic device with Tailscale configured as a subnet router.

The issue is that opkg update fails only when Tailscale is running. If I stop Tailscale, opkg update works immediately.

Error:

SSL error: NET - Sending information through the socket failed
*** Failed to download the package list

What I have checked:

Internet connectivity is working (ping 8.8.8.8 succeeds).
DNS resolution is working (ping downloads.openwrt.org succeeds).
opkg update works normally when tailscaled is stopped.

oot@Sohaib:~# cat /etc/config/firewall

config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'

config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'

config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
list network 'trm_wwan'
list network 'trm_wwan6'

config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'

config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'

config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'

config zone
option name 'tailscale'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option masq '1'
option mtu_fix '1'
list network 'tailscale'

config forwarding
option src 'tailscale'
option dest 'lan'

config forwarding
option src 'lan'
option dest 'tailscale'

root@Sohaib:~# cat /etc/config/network

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fd96:c6fa:6791::/48'
option packet_steering '1'

config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '10.0.0.1'
option netmask '255.255.255.0'
option ip6assign '60'
list dns '1.1.1.1'

config interface 'wan'
option device 'wan'
option proto 'dhcp'

config interface 'wan6'
option device 'wan'
option proto 'dhcpv6'

config interface 'tailscale'
option proto 'none'
option device 'tailscale0'

config interface 'trm_wwan'
option proto 'dhcp'
option metric '100'

config interface 'trm_wwan6'
option device '@trm_wwan'
option proto 'dhcpv6'

root@Sohaib:~#

quietlotte4878 · June 15, 2026, 11:50am

If it only breaks with up, I’d first check whether Tailscale is changing the route/MTU rather than opkg itself. From the router, compare with tailscaled stopped/started. If it is accepting routes or DNS, try as a test. A too-high MTU can also show up as odd TLS/socket errors, so lowering the Tailscale MTU is worth testing too.

Aisfkhan · June 15, 2026, 12:01pm

see it may helps find the root cause

BusyBox v1.36.1 (2026-06-10 09:36:30 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 24.10.7, r29197-ab4c7d6af7
 -----------------------------------------------------
root@Sohaib:~# tailscale down
root@Sohaib:~# ip route
default via 192.168.137.1 dev phy0-sta0 proto static src 192.168.137.161 metric 100 
10.0.0.0/24 dev br-lan proto kernel scope link src 10.0.0.1 
192.168.137.0/24 dev phy0-sta0 proto static scope link metric 100 
root@Sohaib:~# ip rule
0:      from all lookup local
5210:   from all fwmark 0x80000/0xff0000 lookup main
5230:   from all fwmark 0x80000/0xff0000 lookup default
5250:   from all fwmark 0x80000/0xff0000 unreachable
5270:   from all lookup 52
32766:  from all lookup main
32767:  from all lookup default
root@Sohaib:~# tailscale up
Some peers are advertising routes but --accept-routes is false
root@Sohaib:~# ip route
default via 192.168.137.1 dev phy0-sta0 proto static src 192.168.137.161 metric 100 
10.0.0.0/24 dev br-lan proto kernel scope link src 10.0.0.1 
192.168.137.0/24 dev phy0-sta0 proto static scope link metric 100 
root@Sohaib:~# ip rule
0:      from all lookup local
5210:   from all fwmark 0x80000/0xff0000 lookup main
5230:   from all fwmark 0x80000/0xff0000 lookup default
5250:   from all fwmark 0x80000/0xff0000 unreachable
5270:   from all lookup 52
32766:  from all lookup main
32767:  from all lookup default
root@Sohaib:~# ip route show table 52
default dev tailscale0 
throw 10.0.0.0/24 
100.96.219.46 dev tailscale0 
100.100.100.100 dev tailscale0 
100.102.59.65 dev tailscale0 
100.107.179.54 dev tailscale0 
throw 127.0.0.0/8 
throw 192.168.137.0/24 
root@Sohaib:~#

edited:
The Exit Node is a router on my home network. The router is also running VPN and policy-based routing (PBR). HTTPS downloads fail with SSL socket errors, but DNS and ping work. I'm starting to suspect the issue may be related to VPN/PBR interaction on the Exit Node.