Problem category
Networking
DNS, routing, and connectivity.
Cloudflare Tunnel Is Connected but the Public Hostname Returns 502: Unable to Reach Origin Service
Confirm the tunnel is connected and the visitor sees the tunnel-specific 502 Unable to reach the origin service, then match the exact cloudflared log signature to a stopped origin, a wrong ingress scheme, a wrong ingress port, or an untrusted origin certificate.
Docker Container DNS Not Working: Separate IP Path from Name Resolution
Confirm the IP path first, then separate default-bridge and user-defined-bridge resolver behavior when a container reaches external IPs but hostname resolution fails.
Docker Container Has No Internet: Diagnose the Outbound Bridge Path
Separate container state, network mode, addressing, gateway, external IP reachability, and DNS when a running container on rootful Docker Engine bridge networking cannot reach external networks.
Docker Published Port Works Locally but Is Unreachable from the LAN
Compare the working local endpoint with the failing LAN endpoint before investigating publication, application listening context or filtering.
Mosquitto Rejects the MQTT Client Connection
Prove TCP reachability to the broker first, then read the MQTT CONNACK refusal code and match the listener-specific authentication on Mosquitto 2.1.x before changing any broker configuration.
OPNsense VLAN Client Gets an IP Address but Has No Internet
Use the expected DHCP lease only as a scope gate, then separate gateway reachability, DNS-only failure, firewall blocking, Source NAT coverage, and WAN routing on OPNsense 26.7.3.
Pi-hole Installed but Clients Get No DNS Response
Separate clients bypassing Pi-hole from Pi-hole answering nothing by checking FTL state, a direct query, the upstream path, port 53 ownership, and the effective client resolver before any upstream or DHCP change.
Proxmox LXC Container Has No Internet: Diagnose Bridge, Gateway and Firewall
Separate container addressing, bridge attachment, gateway reachability, firewall scope, and upstream path when a running Proxmox LXC container cannot reach the external network.
Proxmox VE Host Has No Network After an 8-to-9 Upgrade
From a physical or independent console, compare enumerated links, bridge membership, addresses, and parsed configuration against the known pre-upgrade design after a Proxmox VE 8.4 to 9 upgrade, and stop before any change without recovery access.
Proxmox VM Reaches Its Gateway but Cannot Reach the Internet
Separate guest addressing, resolution, bridge/segment evidence, outbound policy and upstream reachability after confirming the intended gateway responds.
Synology Tailscale Connected but NAS Is Unreachable
Separate tailnet connectivity, name resolution, the tailnet access policy, DSM firewall rules, and the exact Synology service port before changing the NAS.
Synology Tailscale Subnet Router: LAN Device Unreachable
NAS access works, but a LAN service behind it does not. Separate subnet advertisement, CIDR, approval, access policy, client routing and target-side evidence.
Tailscale Connection Stuck on DERP Relay
The connection works, but DERP persists during poor performance. Compare both peers and network observations before requesting a scoped network-owner investigation.
Tailscale Exit Node Is Connected but There Is No Internet
Separate exit-node approval and policy, Linux forwarding, the exit node's own upstream connectivity, client numeric-IP reachability, firewall/NAT evidence, and DNS, for Tailscale releases with exit-node support.
Tailscale MagicDNS Name Fails While the Tailscale IP Works
Prove the Tailscale IP path first, then separate tailnet MagicDNS state, client DNS acceptance, and documented split-DNS or nameserver conflicts before changing any DNS setting.
WireGuard Handshake Succeeds but Traffic Does Not Pass
Confirm the handshake is recent, separate a universal WireGuard configuration issue (AllowedIPs and routes) from a platform-specific Ubuntu Server gateway forwarding or NAT issue, then apply a bounded configuration or gateway change with console recovery and rollback.