Troubleshoot remote access to a home server or NAS by connection path. Start by deciding whether the failing path is private administrative SSH or a public website, then follow the relevant checks.
Start with the remote-access symptom
- Administrative SSH reports policy denied: separate Tailscale SSH port 22 grants, OS users, and check rules. Check support boundaries between conventional NAS OpenSSH and the Tailscale SSH server.
- A public website returns 5xx: follow Cloudflare edge/origin comparisons and a real 504 investigation. The failed request time and its logs matter more than the notification’s arrival time.
- You plan to upgrade the router: inspect OpenWrt Keep Settings preservation and compatibility first, and prepare backups and a recovery access path.
- Connectivity works but the NAS sync path disappeared: check Syncthing’s actual volume and folder marker. Network success does not establish storage health.
Record before changing anything
Save the source, destination, address, port, failure time and timezone, exact error, and last change. Follow the failing path before changing SSH policy, web responses, and storage together. Continue storage and WordPress work in the WordPress and NAS guide.
All networking and TLS articles
Nginx DNS Changes: Literal, Variable and Upstream Resolve
Compare version-dependent DNS resolution and proxy_pass URI handling before changing a WebSocket upstream.
Cloudflare DKIM TXT: Split Strings or Multiple Records?
Separate the DKIM selector, DNS response status and TXT record boundaries before treating split strings as a damaged key.
Nginx WebSockets: Diagnose Before and After HTTP 101
A loopback mock compares Upgrade forwarding and separates handshake failures from disconnects after HTTP 101.
TLS Certificate Errors: Trust, Hostname and Expiry
A temporary certificate separates trust, hostname and expiry failures without disabling certificate verification.
Nginx Long Requests: Separating 414, 400 and 502
An isolated Nginx 1.24.0 test separates request-line, request-header and upstream-response-header limits.
OpenWrt Passwall IPv6 Bypass: Separate DNS from TProxy
Separate Passwall IPv6 DNS filtering from IPv6 TProxy, then inspect AAAA answers, fw4/nftables rules, and the real IPv6 path without flushing the firewall.
Cloudflare 5xx: Trace 504 Errors from Edge to Origin
Compare an observed Nginx 504, Search Console notification time, and a later crawl. Use Cf-Ray and origin responses while keeping unproven causes separate.
Keep API 401 Responses with oauth2-proxy and Nginx
Keep machine-facing API failures as 401 responses while preserving browser sign-in redirects by separating Nginx auth_request locations.
Tailscale Cannot Find iptables: Verify Firewall and Netfilter Modes
Use tailscaled logs to distinguish firewall implementation, a missing binary, nftables fallback, and netfilter management on Linux or OpenWrt.
MagicDNS Resolves but the LAN Is Unreachable: Check Route Injection
Separate MagicDNS lookup from subnet-route advertisement, approval, client acceptance, and policy when a private LAN service remains unreachable.
Tailscale Funnel Is Unreachable: Separate Backend and Public State
Trace an unreachable Tailscale Funnel through its local backend, Funnel state, MagicDNS, HTTPS requirements, and supported public ports.
Tailscale SSH Policy Denied: Node vs User Rules
Distinguish Tailscale SSH node-policy and user-policy denial. Check the matching SSH rule, OS user, port 22 access, and check-mode reauthentication.