tunnel-doctor

Diagnoses macOS networking conflicts between Tailscale and proxy/VPN tools.

Updated Apr 21, 2026
One-click install
npx skills add https://github.com/HuuBar/skill-routing-experiment --skill tunnel-doctor
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: tunnel-doctor
Source: https://github.com/HuuBar/skill-routing-experiment/tree/main/unified_skills/daymade/tunnel-doctor
Command: npx skills add https://github.com/HuuBar/skill-routing-experiment --skill tunnel-doctor

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Diagnoses and fixes conflicts that prevent Tailscale from coexisting with proxy/VPN tools on macOS, covering five conflict layers including route hijacking, HTTP proxy environment variables, system proxy bypass, SSH ProxyCommand double tunneling, and VM/container proxy propagation.

Core Features & Use Cases

  • Diagnostic workflow for common conflict scenarios across macOS when Tailscale traffic is misrouted.
  • Prescribed fixes for route hijack, proxy envs, system proxy bypass, and SSH/git proxy pitfalls to restore reliable connectivity.
  • Real-world use cases include SSH access to remote Macs, Git operations through proxies, and Docker/VM networking with Shadowrocket/Clash/Surge active.
  • Example: diagnose why browser shows 503 while curl succeeds and apply a DIRECT rule + NO_PROXY tweaks.

Quick Start

Run the Tunnel Doctor quick diagnose to identify the active proxy conflict layer and apply the recommended fixes.

Frequently Asked Questions about tunnel-doctor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
Why does Tailscale ping work but SSH times out on macOS?

Tailscale ping succeeding while SSH times out indicates a macOS proxy conflict or SSH ProxyCommand double tunneling. Traffic is misrouted by active VPN tools, requiring route checks and proxy config validation to restore connectivity.

How do I fix Git operations failing through an SSH proxy with Tailscale active?

To fix Git operations failing through an SSH proxy with Tailscale active, diagnose the SSH config for double tunneling and adjust NO_PROXY environment variables. This resolves HTTP tunnel issues and restores reliable Git connectivity.

Why does my browser return a 503 error while curl succeeds when using Tailscale?

A browser returning 503 while curl succeeds happens when system proxy bypass rules misroute Tailscale traffic. Applying a DIRECT proxy rule alongside NO_PROXY environment tweaks ensures the browser routes traffic correctly.

Does Tunnel Doctor diagnose macOS networking conflicts with Shadowrocket and Clash?

Tunnel Doctor diagnoses macOS networking conflicts between Tailscale and proxy tools like Shadowrocket, Clash, and Surge. It validates VM and container proxy propagation to ensure reliable end-to-end connectivity across active VPN environments.

What is the best way to manage NO_PROXY environment variables for Tailscale on macOS?

The best way to manage NO_PROXY variables for Tailscale is running a prescribed diagnostic workflow to identify active proxy conflict layers. This applies targeted fixes to route hijacking and system proxy bypass configurations.