# When a machine will not open

> The card said it did not answer, and pressing try again did not help. What that is, in the order it usually is.

Press **Try again** first. Most of these are a machine that had gone to sleep or
a minute of bad network, and the second attempt simply works. This page is for
when it does not.

Work down it in order. The first three cover nearly everything.

## Chrome on a Mac, and Safari can open it

Chrome does not use Tailscale's DNS. «Use secure DNS» sends `*.ts.net` to
Google or Cloudflare, who have never heard of your machine, so the request
dies as a dead host and Chrome never asks for Local network access.

1. Open `chrome://settings/security`.
2. Turn **Use secure DNS** off.
3. Reload the panel, press **Try again**.
4. If Chrome then asks to look for devices on your local network, press
   **Allow**.

Safari on the same Mac already uses the system resolver, which is why it can
open the same machine.

## Safari on an iPhone, and Chrome on the same phone can open it

The mirror image of the one above, and it catches people out because nothing
about the phone looks wrong: Tailscale says connected, the machine is awake,
and the machine opens in Chrome seconds later.

iCloud Private Relay carries Safari's browsing and this device's DNS through
Apple, and a Tailscale address is answered by Tailscale and by nobody else —
`*.ts.net` is in no public DNS at all. Chrome on iOS is not routed that way,
which is the whole of the difference.

1. Open **Settings → your name → iCloud → Private Relay**.
2. Turn it off, or use **Turn Off for This Network** to leave it on elsewhere.
3. Reload the panel and press **Try again**.

## Private Relay was already on, and it worked yesterday

It usually was, and it usually did. Private Relay is not a switch that breaks
Tailscale names while it is on — if it were, the machine would never have
opened on this phone at all. It is a race, and these are the three things that
tip it.

**Whether Tailscale answered the question.** A `*.ts.net` name only resolves if
the lookup reaches Tailscale's own resolver, which the app registers with iOS
for your tailnet's domain. Ask while the network extension is still coming
up — waking from a screen lock, handing over from wifi to cellular, the first
minutes after an iOS or Tailscale update re-registers it — and the lookup falls
through to Private Relay instead, which has never heard of the name.

**Then Safari remembers the no.** That failed lookup is cached, so every retry
after it fails the same way without anybody asking Tailscale again. This is
what makes a passing race look permanent, and it is why reconnecting Tailscale
does not help: the connection was never the broken part. Turning Private Relay
off works because it changes the path the question takes.

**And it is set per network.** Home wifi and cellular are different networks
with different state, so a machine that opens all day at your desk can stop
opening on the train with nothing changed.

One more thing worth clearing up while you are in Tailscale's console: if your
machine has **two entries** there — an old one and a `-2`, `-6` suffix — the
name can move between them, and a name your phone has never resolved before is
exactly the fresh lookup this race is waiting for. Delete the dead one.

If Private Relay is already off, the same names are broken by a DNS profile, a
Safari content blocker, or a second VPN — all three are Safari's business on
iOS and none of them touches Chrome.

## Are all your machines quiet, or just this one?

**All of them at once is your phone, not your machines.** Tailscale has dropped
off on the device you are holding — open the Tailscale app and check it says
connected, and that it is signed in to the tailnet your machines are on. A
second account, a work profile, or a phone that has been asleep on mobile data
all look like this.

**One machine quiet is that machine.** Carry on down the page.

## Is the machine awake?

A laptop that closed its lid, a VPS that was stopped, a box that lost its power
or its internet. Nothing on our side can tell those apart from a machine that is
fine — the address simply does not answer.

If you can reach it another way, ask it:

```sh
beafk doctor
```

That prints what beafk itself thinks is wrong, including whether it is running
and whether its address is published.

## Are you in the right workspace?

This is the one people lose the most time to: nothing about it looks like a
mistake.

A machine belongs to **exactly one workspace**. If you are signed in to a
different one than the machine was connected to, the machine is not in your
fleet at all, and the panel says *this workspace has no such machine on your
fleet*.

- **Switch workspace** from the switcher that names it, at the head of beafk
  cloud's rail, and look at the list of machines again. See
  [workspaces](https://beafk.app/docs/workspaces.md).
- **Ask the machine which one it answers to.** On the machine:

```sh
beafk cloud status
```

  The first line is the workspace name. If it is not the one you are signed in
  to, that is the whole of the problem.

- **A machine cannot be in two.** Connecting one that already belongs elsewhere
  is refused — *this machine already belongs to …* — rather than moved. Moving
  it takes two steps: `sudo beafk cloud forget` on the machine, then a fresh
  code from the workspace you want it in. See [workspaces](https://beafk.app/docs/workspaces.md).

There is a second version of this, further along: the machine **is** in your
fleet, but it says it *would not accept the certificate this workspace signed*.
The machine has since been connected somewhere else, or forgotten this
workspace. `beafk cloud status` again, and the same fix.

## Have you been given this machine?

Seeing a machine in the list is not the same as being allowed to open it. If the
panel refuses you by name rather than going quiet, an admin of your workspace
grants it in one press — see [who may open what](https://beafk.app/docs/who-may-open-what.md).

## The other things that do it

Rarer, and each has a tell.

**A captive portal.** Hotel, café and some office wifi will hold every
connection until somebody accepts a sign-in page. Open any ordinary website; if
you get the portal, accept it and try again.

**A firewall or a DNS filter.** Corporate networks, some VPNs, and a few
mobile-data filters block the tunnel outright. The test is another network — a
phone hotspot is the fastest one.

**Two VPNs at once.** Another VPN on the same device will often take the routes
Tailscale needs. Turn the other one off.

**A rule in Tailscale, not in beafk.** Your device can be on the right tailnet
and still not be allowed to reach that machine, if the tailnet's own access
rules say so. That is a setting in the Tailscale admin console, and beafk cannot
see it or change it. See [how your phone reaches
it](https://beafk.app/docs/reaching-your-machine.md).

**beafk is not running, though the machine is.** The address is published by the
machine, so it can stay resolvable for a while after beafk itself has stopped.
`beafk doctor`, or restart it.

**The machine has no address yet.** If the panel says so in as many words, it
never finished publishing one. On the machine: `sudo beafk net tailscale` on
Linux, `beafk net tailscale` on a Mac.

**Tailscale is switched off.** The app (or the daemon) is there and still holds
this machine's place on the tailnet; somebody turned it off. On a Mac, click
the menu-bar icon and turn the switch on so it says Connected, then
`beafk net tailscale`. On Linux, `sudo tailscale up`, then
`sudo beafk net tailscale`. beafk will not switch a connection back on that
you switched off.

**Its certificate is still being issued.** The machine is published. Tailscale
is fetching the first HTTPS certificate — usually under a minute. Nothing to
run. A card that offers `beafk net tailscale` here is the old reading; wait.

## The sentences that mean something other than "quiet"

A card that gives you directions instead of opening is telling you which of
these it is, and none of them is fixed by trying again.

Two look alike, so the card says which:

**No addresses.** The machine has never told us where it lives — it finished
connecting but never published one. On Linux, `sudo beafk net tailscale`. On
a Mac, `beafk net tailscale`.

**The addresses could not be decrypted.** A fault at our end rather than at
yours. Nothing on your machine will fix it, so write to us.

The rest are about the machine being up but refusing:

**Refused to talk to this origin.** The machine is up and running. It only
accepts the addresses it was paired at — open the panel from that address, or
add this one on the machine and let the service pick it up.

**Answered with this machine's fingerprint and then could not sign for it.**
Something is pretending to be your machine. Nothing was sent to it. Do not use
that address again until you know why it did that.

**A different machine than the one this workspace has on file.** The address we
have now points somewhere else — a reused hostname, or a rebuilt box.

**The machine is too old.** Update it:
[keeping machines updated](https://beafk.app/docs/keeping-machines-updated.md).

One more is money rather than plumbing: if the card offers a billing page, the
subscription is what is in the way. See
[when a subscription lapses](https://beafk.app/docs/when-a-subscription-lapses.md).

## Still stuck

If none of the above is it, the machine is probably fine and something else is
wrong: [when something is wrong](https://beafk.app/docs/when-something-is-wrong.md) is the rest of
the list, and it ends with how to reach us.

---

beafk documentation · Reference · https://beafk.app/docs/a-machine-will-not-open

In this section:
- When something is wrong — https://beafk.app/docs/when-something-is-wrong.md
- When a machine will not open — https://beafk.app/docs/a-machine-will-not-open.md (this page)
- Glossary — https://beafk.app/docs/glossary.md
- The command line — https://beafk.app/docs/every-command.md
- Legal — https://beafk.app/docs/legal.md
- The licence — https://beafk.app/docs/license.md

Every page, one line each: https://beafk.app/docs/llms.txt
All of it in one file: https://beafk.app/docs/llms-full.txt