I recently ran into a weird problem with my Proxmox server.

  • The server lives at 192.168.1.10 on my home LAN.
  • It also runs Tailscale, so I can reach it at proxmox.<your-tailnet>.ts.net (Tailscale IP: <100.x.x.x>).
  • Inside Proxmox, I host a VM that serves my blog through a Cloudflare Tunnel — which worked fine.

But here’s the catch:

👉 When I was away from home (on 4G), I could reach the Proxmox Web UI over Tailscale just fine.
👉 When I was at home on the same LAN, I couldn’t reach the Web UI at all.

Understanding the Problem

This happens because of how routing works when you’re on the same network.

  • On my LAN, Windows prefers the direct route to 192.168.1.10.
  • But Proxmox’s web service (pveproxy) wasn’t listening on that LAN IP — it was listening on its Tailscale IP and loopback.
  • So when my PC tried to connect, it bypassed Tailscale and went straight to the LAN → connection failed.

Classic split-horizon routing issue.

The Fix: Force Windows to Use Tailscale

The simplest way is to tell Windows: “always send traffic for <100.x.x.x> (my Proxmox Tailscale IP) through the Tailscale adapter, not the LAN.”

  1. First, get your Tailscale adapter IP:

    ipconfig

    Look for the Tailscale Tunnel interface.

  2. Then, add a persistent route:

    route -p add <100.x.x.x> mask 255.255.255.255 <YourTailscaleAdapterIP> metric 1

    - Replace <100.x.x.x> with your Proxmox Tailscale IP.
    - Replace <YourTailscaleAdapterIP> with the IP of your own Tailscale adapter (shown in ipconfig).

  3. Verify:

    route print | findstr <100.x.x.x>

    You should see a route forcing traffic through Tailscale.

Now, whether I’m at home or remote, going to:

https://proxmox.<your-tailnet>.ts.net:8006

always works. 🎉

Bonus: Removing the Route

If you ever want to undo this:

route delete <100.x.x.x>

If you used -p, you may need to run it as Administrator.

Alternatives

  • Bind Proxmox to LAN as well
    You could configure Proxmox’s web proxy (pveproxy) to listen on 192.168.1.10 in addition to Tailscale. This would allow LAN access without the route tweak.
  • Stick to Tailscale for everything
    Personally, I like using Tailscale exclusively — it keeps things simple and secure, with one hostname that always works no matter where I am.

Takeaway

If you’re running Proxmox (or any service) behind Tailscale and it mysteriously works remotely but not on your LAN, check your routes. Sometimes the fix is as simple as teaching Windows which path to prefer.