Devices local to Cradlepoint not accessible via Tailscale

[bmwagner18]

I have a Cradlepoint is on a remote network with subnet of 192.168.1.0/24. There is another device on the subnet at 192.168.1.140 that I am able to ping at the NetCloud console from the Troubleshooting tab but when I try to access it through Tailscale I am unable to access it.

I've tried enabling the route on the Tailscale web UI and pinging directly at 192.168.1.140 from another device on the Tailnet and I've tried using 4via6. Both result in this showing up on the logs:

Thu Nov 14th 15:01:48 2024	tailscale	ERR	2024/11/14 20:01:48 netcheck: DetectCaptivePortal(found=false)	
Thu Nov 14th 15:01:32 2024	tailscale	ERR	2024/11/14 20:01:32 exec ping of 192.168.1.140 failed in 3.919646ms: exit status 1	
Thu Nov 14th 15:01:27 2024	tailscale	ERR	2024/11/14 20:01:27 exec ping of 192.168.1.140 failed in 5.042896ms: exit status 1	
Thu Nov 14th 15:01:22 2024	tailscale	ERR	2024/11/14 20:01:22 exec ping of 192.168.1.140 failed in 3.623354ms: exit status 1	
Thu Nov 14th 15:01:17 2024	tailscale	ERR	2024/11/14 20:01:17 exec ping of 192.168.1.140 failed in 4.037542ms: exit status 1	
Thu Nov 14th 14:31:49 2024	tailscale	ERR	2024/11/14 19:31:49 exec ping of 192.168.1.140 failed in 3.934125ms: exit status 1	
Thu Nov 14th 14:31:44 2024	tailscale	ERR	2024/11/14 19:31:44 exec ping of 192.168.1.140 failed in 4.030021ms: exit status 1	
Thu Nov 14th 14:31:39 2024	tailscale	ERR	2024/11/14 19:31:39 exec ping of 192.168.1.140 failed in 3.637541ms: exit status 1	
Thu Nov 14th 14:31:34 2024	tailscale	ERR	2024/11/14 19:31:34 exec ping of 192.168.1.140 failed in 3.607541ms: exit status 1	

The Cradlepoint is running OS v7.24.22. Do I need to modify the Network settings on the Cradlepoint to enable the route?

TIA,
Ben

[dapplegatecp]

Hi, sorry for the delay. On the Cradlepoint, did you try enabling a firewall allow explicitly for Router Zone to Lan zone? This should work, the incoming traffic will be sourced from the router IP address

[bmwagner18]

Is this the firewall table you are referring to?

Just to confirm, if I do change the "Default Deny All" on the first line to "Default Allow All" this will not open the LAN to anyone who is privy to my public IP to access the LAN will it?

[bmwagner18]

Was this what you meant by Router zone to LAN zone? I still get the same error showing up in the logs with that rule added.

[beekarthik]

Any updates on this thread as to what the issue was? Running into pretty similar issues

[bmwagner18]

No, sorry. I haven’t had any time (or motivation if I’m being honest) to investigate it more. I set the firewall rules as recommended but had no luck.

…

On Tue, May 13, 2025 at 3:50 PM, Karthik Balakrishnan ***@***.***(mailto:On Tue, May 13, 2025 at 3:50 PM, Karthik Balakrishnan <<a href=)> wrote: beekarthik left a comment [(cradlepoint/sdk-samples#124)](#124 (comment)) Any updates on this thread as to what the issue was? Running into pretty similar issues — Reply to this email directly, [view it on GitHub](#124 (comment)), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/APJCNFJCQPJ6QAVFMTSAF2L26JEHJAVCNFSM6AAAAABRZXV3EKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDQNZXG43TGNJRHA). You are receiving this because you authored the thread.Message ID: ***@***.***>

[mwconceicao]

I have the same ping error, but TCP traffic works fine for me. /cc @beekarthik @bmwagner18

[brentonthomson]

The SDK runs Tailscale in userspace networking mode since SDK's run in userspace and don't have access to /dev/net/tun.
Per this issue on Tailscale's repository, ping doesn't work when using userspace networking mode since ping can't use SOCKS5 or an HTTP proxy.