tailscale: fails to start on boot: "add route failures; first was: network is down"

Package Name

tailscale

Maintainer

@mochaaP, sandro.jaeckel@gmail.com

OpenWrt Version

25.12.5

OpenWrt Target/Subtarget

x86/64

Steps to Reproduce

1. install tailscale, per the doc https://openwrt.org/docs/guide-user/services/vpn/tailscale/start
2. apparent precondition: have an upstream WAN interface that is slow to come up (e.g. slow DHCP)
3. install and configure tailscale
4. reboot

Actual Behaviour

Post reboot, observe that tailscale isn't running; tailscale status reports: "Health check: - 11 add route failures; first was: network is down"

Shortly after boot (via serial console):

~# tailscale status
      (tailscale peers show up ok)
# Health check:
#     - 11 add route failures; first was: network is down

~# ip route show table 52
~# 

Restarting tailscale (I have ts logs disabled via uci set tailscale.settings.log_stderr=0):

~# service tailscale restart
2026/07/07 13:21:25 You have disabled logging. Tailscale will not be able to provide support.
logtail started
Program starting: v1.98.3-1 (OpenWrt), Go 1.26.4: []string{"/usr/sbin/tailscaled", "--cleanup"}
LogID: 8dfa6da0ef0690689f13ea1f428d51c8a1a52f2ce93d51db211f9e0d96d50242
logpolicy: using system state directory "/var/lib/tailscale"
dns: [rc=resolvconf resolvconf=no ret=direct]
dns: using "direct" mode
dns: using *dns.directManager
linuxfw: clear iptables: exec: "iptables": executable file not found in $PATH
linuxfw: clear ip6tables: exec: "ip6tables": executable file not found in $PATH
dns: inotify: NewDirWatcher: context canceled
cleanup: delete and flush chain ts-input: %!s(<nil>)
cleanup: delete and flush chain ts-forward: %!s(<nil>)
cleanup: delete and flush chain ts-postrouting: %!s(<nil>)
cleanup: delete and flush chain ts-input: %!s(<nil>)
cleanup: delete and flush chain ts-forward: %!s(<nil>)
[RATELIMIT] format("cleanup: delete and flush chain %s: %s")
flushing log.
logger closing down
2026/07/07 13:21:26 You have disabled logging. Tailscale will not be able to provide support.
logtail started
Program starting: v1.98.3-1 (OpenWrt), Go 1.26.4: []string{"/usr/sbin/tailscaled", "--cleanup"}
LogID: 8dfa6da0ef0690689f13ea1f428d51c8a1a52f2ce93d51db211f9e0d96d50242
logpolicy: using system state directory "/var/lib/tailscale"
dns: [rc=unknown ret=direct]
dns: using "direct" mode
dns: using *dns.directManager
linuxfw: clear iptables: exec: "iptables": executable file not found in $PATH
linuxfw: clear ip6tables: exec: "ip6tables": executable file not found in $PATH
dns: inotify: NewDirWatcher: context canceled
flushing log.
logger closing down
~# ip route show table 52
~#    # (pause here a few seconds)
~# ip route show table 52
100.75.95.9 dev tailscale0 
100.94.151.34 dev tailscale0 
100.98.139.96 dev tailscale0 
100.100.100.100 dev tailscale0 
100.102.2.26 dev tailscale0 
100.112.87.25 dev tailscale0 
100.117.33.128 dev tailscale0 

There does seem to be a delay after the tailscale restart and the routes being added, but once they're there it's a-ok.

Workaround: add service tailscale restart to /etc/rc.local.

Confirmation Checklist

• The package is maintained in this repository.
• I understand that issues related to the base OpenWrt repository or LuCI repository will be closed.
• I am reporting an issue for OpenWrt, not an unsupported fork.

Start with the OpenWrt tailscale service invoked by service tailscale and compare its boot behavior with the slow-DHCP reproduction described. Check whether tailscaled starts before the WAN interface is ready, then reboot and inspect ip route show table 52. Done means Tailscale starts successfully on boot and its routes appear without adding a restart to /etc/rc.local.