Claude Skill MartBrowse skillsQuick linesLearn by videoTerminal guideWhat is a Skill?
 
← Back to list

Tunnel Doctor (Tailscale × Proxy Conflict Fixer)

A macOS network-debugging skill that isolates and fixes Tailscale conflicts with Shadowrocket/Clash/Surge/OrbStack — route hijacks, proxy env vars, SSH double tunnels, Docker proxy propagation and stalled DNS.

Dev & CodingAdvanced★ 1,323⑂ 212AI score 9/10Last updated: Aug 8, 2026

What it does

  • Maps contradictory symptoms (tailscale ping works but SSH times out; browser gets 503 while curl gets 200; git push dies intermittently) onto five independent conflict layers: route table, HTTP proxy env vars, system proxy, SSH ProxyCommand double tunnel, and VM/container proxy propagation.
  • Gives exact verification commands and fixes: add .ts.net + 100.64.0.0/10 to NO_PROXY (including the Go net/http CIDR caveat), set skip-proxy in Shadowrocket, identify which utun owns the CGNAT route via route -n get and MTU (1280 = Tailscale, 4064 = Shadowrocket), point OrbStack's docker.json at host.internal, or build with --network host.
  • Covers hard failure modes too: 60-second getaddrinfo stalls from a dead supplemental resolver, TUN DNS hijack to 198.18.x.x fake IPs, "TUN DIRECT split-brain" where every DIRECT-routed site fails at once, and a Windows host TUN black-holing WSL and Tailscale.
  • Includes a "measurement contamination" table explaining which probes lie under TUN (nc -z at 0.00s, sub-ms pings, %{remote_ip}) and which to trust (time_appconnect, time_starttransfer).
  • Ships scripts/quick_diagnose.py for an automated sweep of proxy env, system-proxy exceptions, direct-vs-proxy paths and local TLS trust.

Who it's for

  • macOS developers doing remote dev over Tailscale (Mac mini, WSL box, home server) while a proxy/VPN app is always on.
  • Shadowrocket/Clash/Surge users hit by flaky git push or docker pull/build TLS timeouts.
  • Anyone who wants evidence-based layer isolation instead of guessing at the network.

Example uses

  1. "Browser shows 503 for http://100.x.x.x:3010 but curl returns 200" → diagnosed as system-proxy bypass; add the CGNAT range to skip-proxy (not tun-excluded-routes).
  2. "ssh -T git@github.com works but git push fails with failed to begin relaying via HTTP" → double tunnel; drop ProxyCommand connect -H and use ssh.github.com:443.
  3. "RUN apk add in docker build fails with Connection refused in 0.2s" → OrbStack transparent proxy broken by TUN; fix with --network host or a host.internal proxy config.
  4. "nslookup is instant but ssh/curl hang 60s" → per-nameserver bisection pinpoints the dead resolver in scutil --dns.

· · · Install guide · · ·

Try it now, no install

Paste this into Claude to use the skill without installing anything.

Read the instructions in this file and follow them to help me:
https://raw.githubusercontent.com/daymade/claude-code-skills/HEAD/tunnel-doctor/SKILL.md

What I want: (describe your task here)

If Claude can't open the link, open it yourself and paste the contents instead.

↓ If it works for you, download the ZIP below and install it. Then it runs on its own — no pasting each time.

Install in the Claude app (no terminal)
  1. Download the ZIP with the button below.
  2. In Claude, open Settings → Capabilities and turn on 'Code execution and file creation'. (one time)
  3. Go to Customize → Skills → + → 'Upload a skill' and upload the ZIP.
↓ Download ZIP
Install in Claude Code

Let Claude do it — paste this into Claude Code

Install the skill I found on Claude Skill Mart.
Copy the tunnel-doctor folder from the GitHub repo daymade/claude-code-skills into my ~/.claude/skills/tunnel-doctor/.
When it's done, tell me in one line what this skill can do.

Install with a command instead

git clone https://github.com/daymade/claude-code-skills.git && mkdir -p ~/.claude/skills && cp -r claude-code-skills/tunnel-doctor ~/.claude/skills/

⚠ This is a third-party skill. Check the source repository before installing.

  1. Open a terminal.
  2. Clone the repository: git clone https://github.com/daymade/claude-code-skills.git
  3. Create the skills directory if needed: mkdir -p ~/.claude/skills
  4. Copy this skill in: cp -r claude-code-skills/tunnel-doctor ~/.claude/skills/
  5. (Recommended) also copy the base skill it references: cp -r claude-code-skills/debugging-network-issues ~/.claude/skills/ 2>/dev/null
  6. Verify Python 3 exists for the helper script: python3 --version
  7. Restart Claude Code, then describe your symptom (e.g. "tailscale ping works but ssh times out") to trigger the skill.
  8. Because it can edit routes, ~/.zshrc, ~/.ssh/config and proxy-app settings, back those files up and review each suggested command before running it.
View source on GitHub ↗License: MIT