Metrics collection over tailnet requires web interface and ACL configuration

To collect metrics remotely over the tailnet, the web interface must be enabled on each client and monitoring servers must have access to port 5252 in the tailnet policy file. Missing either configuration prevents remote metric collection.

Enable web interface on each device by running 'tailscale set --webclient'. Grant monitoring server access to port 5252 in the tailnet policy file. Verify metrics are accessible at the device's Tailscale IP on port 5252 at /metrics endpoint.