---
name: reference_tailscale_subnet_key_expiry
description: "Internet OK but all of 172.16.3.x dead" = Tailscale infra-node key expiry, not a LAN outage. How to diagnose + the fallback path.
metadata:
  type: reference
---

The ACG internal subnet **172.16.3.x is reached over Tailscale**, not a local LAN — `pfsense-2`
(the pfSense node) is the **subnet router** advertising **172.16.0.0/22**. Key hosts on it:
Gitea/Jupiter `172.16.3.20:3000`, GuruRMM + coord `172.16.3.30:3001`/`:8001`.

**Symptom → cause:** if `sync.sh` fetch fails and the WHOLE `172.16.3.x` subnet is unreachable
(both .20 and .30) **while general internet is fine**, the cause is almost always a **Tailscale
node KEY EXPIRY** on an infra node (the subnet router or a server) — an expired key drops that node
off the tailnet, killing the route. It is NOT a "transient blip" and NOT a real LAN outage (logged
as a correction 2026-06-25 after I mis-called it). Mike **disabled key expiration** on the infra
node(s) 2026-06-25 so it shouldn't recur; if it does, re-auth the node + confirm expiry is off in the
Tailscale admin console.

**Diagnose (Windows `tailscale.exe` at `C:\Program Files\Tailscale\`):**
- `tailscale status` — look for peers marked `offline`/key-expired, esp. `pfsense-2` and `gururmm-server`.
- `tailscale debug prefs | grep RouteAll` — must be `true` (this machine accepts subnet routes).
- `tailscale status --json` — confirm a peer advertises `172.16.0.0/22` (PrimaryRoutes) and is `Online`.
- `tailscale ping <tailnet-100.x>` — tests tailnet path independent of the subnet route.

**Fallback:** `gururmm-server` is directly reachable at its **tailnet IP `100.86.12.15:3001`** — usable
in place of `172.16.3.30:3001` if the subnet route is down but the node itself is up. See [[feedback_tmp_path_windows]].