VPN, proxy and filters

Tailscale on Mac: check the VPN and fix connection problems

When Tailscale connects but a site does not load, check the VPN status, route and app settings before changing them.

Applies to: macOS and the current app version; managed Macs can have organization policies.Checked: 2 November 2026

Symptoms

  • Tailscale says it is connected, but a site or app does not load.
  • The Mac has no internet after the VPN changes state.

Likely causes

  • Routing and kill switch. Without an exit node, Tailscale normally routes tailnet traffic only. Tailscale documents mandatory exit nodes through management policies; this is not a general consumer kill-switch setting.
  • DNS. Tailscale normally uses the exit node as DNS resolver when one is selected. Tailnet administrators can override this for selected nameservers.
  • IPv6. Tailscale says exit nodes support IPv6. It does not describe a separate macOS IPv6 leak-protection control in its exit-node guide.
  • Other possible causes. A Wi-Fi sign-in page, DNS failure, another filter or an unavailable service can also interrupt a connection.

How to check

  1. Open Tailscale and check its connection state and any warning.

  2. Check whether another website works. On public Wi-Fi, complete any required network sign-in.

  3. On a managed Mac, ask your administrator before changing VPN or security settings.

How to fix it

  1. In the Tailscale menu, choose Exit Nodes and select an available node if you want to use one. Ask your administrator if none is available.

  2. If the connection still fails, follow the provider support guide linked below.

With Kilobat

  1. Health > Where traffic leaves shows whether the default route uses a VPN. A split route does not mean every destination uses it.

  2. With the VPN connected, choose Check for Leaks in Health > Where traffic leaves or Settings > Network.

  3. The test checks DNS resolver paths, IPv6 routing and UDP using STUN. A skipped check is not a pass.

  4. It contacts external services, which see your address. It cannot run a browser WebRTC test or prove every app is private.

  5. Run the same test in Terminal.

    kilobat vpn leaks

Questions

Does Tailscale send all internet traffic through the tailnet by default?

No. Tailscale says each device must opt in to an exit node for public internet traffic.

Does a VPN status prove all apps are private?

No. A route or leak test describes the paths checked at that moment. It does not establish privacy for every app.

Sources

Checked on 2 November 2026.