I think I had a similar problem a couple weeks ago. Make sure they are adding the device to your tailnet, by default it adds the new machine to their own tailnet. I know I hit some kind of issue like that, at least.

Why do they need to be part of your Tailnet? I usually just share a single machine.

I never got that feature of tailscale to work either, sorry. But, it was simple enough to share individual nodes to other users. So try that if it fits your needs.

Firstly, what type of things are you trying to allow your friend to do on your tailnet? I've had trouble in the past trying to get friends to connect to game servers across tailnets, but have been fine connecting friends to things like Jellyfin. Any information on this might be helpful to look over.

Secondly, Have you checked out the ACLs? Access controls to your network can sometimes make things not play nice. Here is the docs on managing your Access control list.

Hey, I guess it depends on how he is trying to reach the machines. Is he using the tailscale IPs (like 100.100.....) or yours (like 192.168....)?