I'm trying to use a Raspberry Pi as a Tailscale subnet router to access my Reolink NVR remotely.

Hardware

• Raspberry Pi (Debian 13 / Trixie)
• TP-Link Archer MR400 (LTE router)
• Mobile provider: Telemach Croatia (formerly Tele2)
• Reolink RLN8-410 NVR

Goal

Phone → Tailscale → Raspberry Pi (subnet router) → Reolink NVR

What works

• Raspberry Pi is connected via Ethernet directly to the Archer MR400.
• Raspberry Pi has Internet connectivity.
• DNS resolution works.
• Ping to google.com works.
• Ping to controlplane.tailscale.com works.
• System time is correct (NTP synchronized).
• MTU test (1500 bytes) passes.
• Reolink NVR is fully reachable on the local network.
• HTTP to the NVR returns HTTP 200 OK.
• TCP port 9000 on the NVR is reachable.
• Tailscale subnet route (192.168.1.0/24) is advertised and approved in the admin console.

What does NOT work

Tailscale always reports:

Unable to connect to the Tailscale coordination server

Every HTTPS connection from the Raspberry hangs during the TLS handshake.

Example:

curl -4 -Iv https://google.com

Output stops at:

• Trying xxx.xxx.xxx.xxx:443...
• TLSv1.3 (OUT), TLS handshake, Client hello (1):

and never continues.

Exactly the same happens with:

curl -4 -Iv https://controlplane.tailscale.com

and also with:

openssl s_client -connect google.com:443

Output:

CONNECTED

After that it hangs forever.

Tests already performed

• DNS works
• ICMP works
• MTU test succeeds
• OpenSSL 3.5.6
• curl 8.14.1
• CA certificates are present
• Correct system time
• curl forced to IPv4 (-4)
• Raspberry and Reolink communicate perfectly on the LAN

Additional information

The Reolink NVR was originally at 192.168.1.107 but later received 192.168.1.100 via DHCP. After correcting the IP everything works locally again.

The only remaining issue is that HTTPS/TLS connections from the Raspberry never complete, which causes Tailscale to stay offline.

My suspicion

Since DNS, ICMP, routing, MTU and local networking all work, but every TLS handshake hangs immediately after sending the ClientHello, I suspect either:

• TP-Link Archer MR400 firmware
• Mobile network (Telemach Croatia / former Tele2)
• Some TLS-related networking issue between the router and the Raspberry Pi

Has anyone seen this before or knows what could cause TLS handshakes to hang immediately after the ClientHello while everything else works?