殊途迷归：多 VPN 共存环境下的内网路由排查

$ curl -sSo /dev/null -w "%{http_code} %{time_total}s" --connect-timeout 5 https://[REDACTED].aliyun-inc.com/
302 0.186s    # 阿里内网正常

$ curl -sSko /dev/null -w "%{http_code} %{time_total}s" --connect-timeout 5 https://airship.tailnet-xxxx.ts.net:6443/
000 0.320s    # Tailscale 节点不通，SSL_ERROR_SYSCALL

$ nslookup [REDACTED].aliyun-inc.com
Server:		100.100.100.100
Address:	100.100.100.100#53

Non-authoritative answer:
...
Address: 100.67.201.67
Address: 100.67.183.169
Address: 100.67.202.232
Address: 100.64.29.27

$ nslookup airship.tailnet-xxxx.ts.net
Server:		100.100.100.100
Address:	100.100.100.100#53

Name:	airship.tailnet-xxxx.ts.net
Address: 100.109.15.92

$ route get 100.109.15.92
   route to: airship.tailnet-xxxx.ts.net
destination: 100.64.0.0
       mask: 255.192.0.0
    gateway: 30.42.89.162
  interface: utun20

$ sudo route -n add -host 100.109.15.92 -interface utun24
add host 100.109.15.92: gateway utun24

$ route get 100.109.15.92
   route to: airship.tailnet-xxxx.ts.net
destination: airship.tailnet-xxxx.ts.net
  interface: utun24
      flags: <UP,HOST,DONE,STATIC>

$ route get 100.67.201.67
destination: 100.64.0.0
       mask: 255.192.0.0
    gateway: 30.42.89.162
  interface: utun20

$ tailscale ping airship
pong from airship (100.109.15.92) via 101.132.17.38:41641 in 11ms   # Tailscale 正常

$ curl -sSo /dev/null -w "%{http_code}" --connect-timeout 5 https://[REDACTED].aliyun-inc.com/
302   # 阿里内网正常

#!/bin/bash
# Fix routing conflict between AliLang VPN and Tailscale.
# Both use the 100.64.0.0/10 (CGNAT) range:
#   - AliLang: internal services resolve to 100.64-100.67.x.x
#   - Tailscale: peers use 100.64-100.109.x.x
#
# Strategy: broad 100.64/10 → AliLang VPN, specific /32 → Tailscale peers.

set -euo pipefail

# Detect AliLang VPN interface (30.42.x.x address)
ALILANG_IF=$(ifconfig -l | tr ' ' '\n' | while read iface; do
    ifconfig "$iface" 2>/dev/null | grep -q 'inet 30\.42\.' && echo "$iface" && break
done)

if [ -z "$ALILANG_IF" ]; then
    echo "Error: AliLang VPN interface not found" >&2
    exit 1
fi

ALILANG_GW=$(ifconfig "$ALILANG_IF" | grep 'inet 30\.42\.' | awk '{print $2}')

# Detect Tailscale interface (100.x.x.x address on utun)
TS_IF=$(ifconfig -l | tr ' ' '\n' | while read iface; do
    ifconfig "$iface" 2>/dev/null | grep -q 'inet 100\.' && echo "$iface" && break
done)

if [ -z "$TS_IF" ]; then
    echo "Error: Tailscale interface not found" >&2
    exit 1
fi

echo "AliLang VPN: $ALILANG_IF (gateway $ALILANG_GW)"
echo "Tailscale:   $TS_IF"

# Step 1: Route broad 100.64.0.0/10 to AliLang VPN
sudo route -n delete -net 100.64.0.0/10 2>/dev/null || true
sudo route -n add -net 100.64.0.0/10 "$ALILANG_GW"

# Step 2: Add /32 host routes for all Tailscale peers
tailscale status --json | python3 -c "
import json, sys
data = json.load(sys.stdin)
for p in data.get('Peer', {}).values():
    for addr in p.get('TailscaleIPs', []):
        if ':' not in addr:
            print(addr)
" | while read -r ip; do
    sudo route -n delete -host "$ip" 2>/dev/null || true
    sudo route -n add -host "$ip" -interface "$TS_IF" 2>/dev/null
    echo "  $ip → $TS_IF"
done

# Step 3: Ensure Tailscale MagicDNS stays reachable
sudo route -n delete -host 100.100.100.100 2>/dev/null || true
sudo route -n add -host 100.100.100.100 -interface "$TS_IF"