Operate and choose
Troubleshoot by layer
Diagnose identity, device state, name resolution, policy, route selection, and application behavior in a repeatable order.
8 minute lesson
“Tailscale is down” is not a useful diagnosis. The failure can live at several independent layers.
Confirm both devices are connected, then test the Tailscale IP, MagicDNS name, policy, subnet or exit route, destination port, and application. tailscale status shows peers, tailscale ping explains the path, and tailscale netcheck reports local network conditions.
tailscale status
tailscale ping lab-server
tailscale netcheckBreak one layer at a time—name, grant, listener, or route—and record which command identifies the failure without changing unrelated settings.
Test names, reachability, and the Tailscale path separately:
tailscale status
tailscale ping server-name
ping -c 3 server-name
tailscale netchecktailscale ping tells you whether the peers can establish a Tailscale path and whether it is direct or relayed. Ordinary ping also depends on the destination operating system and firewall. If the name fails, retry with the Tailscale IP before changing ACLs or routes.
Lesson completed