I can't connect

Narrow the problem down from the symptom: the command fails, the device isn't in the panel, or you're connected but can't reach anything.

For:MemberAdminOwnerUpdated September 16, 2026

The fastest way to narrow a problem down is to identify which step you're stuck on. Pick your symptom:

Symptom	Section
The connection command fails	The command fails
The command ran but the device isn't in the panel	The device isn't in the panel
The device is connected but I can't reach another device	Connected but can't reach anything
It used to work and stopped	It worked, then stopped

The command fails

Command not found?
tailscale: command not found (or "not recognized" on Windows) means the client isn't installed or the command-line tool isn't enabled: Install Tailscale. On Windows, close a terminal that was open before the installation and open a new one.
Is the key rejected?
A key works once and is valid for 24 hours. If you already ran the command, create a new key in the panel.
Does it say "requires mentioning all non-default flags"?
The device was connected before with different settings. Add --reset to the command.
Getting a permission error?
On Linux, put sudo in front of the command.
Does the connection time out?
Your network may be blocking access to the control server: Firewalls and corporate networks.

Refresh the list
The device list doesn't refresh on its own: click Refresh.
Check the status on the device
If tailscale status says "Logged out.", the connection never completed; try again with a new key.
Are you looking at the right network?
With several networks, you may be looking at a different one in the panel. Check the active profile on the device with tailscale switch --list: Use more than one network.

This is the most common case: access is closed by default and a rule is needed.

Can you see the target device?
If the target isn't in tailscale status, no rule grants you access to it. Ask your network admin for a rule.
Does the rule cover the right person? (admin)
The person must be in the group used as the rule's source, and must have an unlabeled (personal) device. If they show no device while editing the group, they have no device. If the group covers nothing, the rule list shows covers no devices.
Does the destination have the right label? (admin)
If the rule's destination is a label, the target machine must carry it. An unlabeled device matches no rule.
Are the protocol and port right? (admin)
A rule only opens the protocol and ports you chose. ping additionally needs ICMP. Rules are one-way: access in both directions needs two rules.
Are you targeting a local network?
Reaching a network behind a gateway requires that network to be approved in the panel and the gateway to be labeled: Share a local network. Linux clients also need --accept-routes.

Symptom	Likely cause
The device shows as Access revoked in the panel	The device's session key has expired: usually because you were removed from the network or organization (then you have to be added again); a key can also expire on its own, in which case sign in again with `tailscale up`
The whole network became unreachable at once	The network or organization may be suspended; check the warning on the organization page
Only one server became unreachable	A rule may have been deleted, or the destination's label changed
A server's address changed	Deleting and enrolling the device again may have changed it; use the device name instead of the address
The connection got slow	A direct connection may not be possible; if `tailscale status` says `relay`, check your firewall settings

For the exact meaning of a panel message, see Panel messages. For the full command list, see Command list.