Problem category
Remote Access
Reach your devices from anywhere.
Cloudflare Tunnel Is Connected but the Public Hostname Returns 502: Unable to Reach Origin Service
Confirm the tunnel is connected and the visitor sees the tunnel-specific 502 Unable to reach the origin service, then match the exact cloudflared log signature to a stopped origin, a wrong ingress scheme, a wrong ingress port, or an untrusted origin certificate.
Nginx Proxy Manager 502 Bad Gateway: Diagnose the Upstream
NPM opens and the proxy host exists, but requests through it return 502 Bad Gateway. Compare upstream reachability from the NPM network context and match the forward address and the proxy error log against a stopped upstream, a wrong port, a localhost or name-resolution mismatch, or a TLS scheme failure.
Nginx Proxy Manager Let’s Encrypt Certificate Renewal Fails
Separate HTTP-01 reachability from DNS-01 credential or plugin failures on Nginx Proxy Manager 2.15.x, then respect exact ACME errors and rate limits instead of deleting certificates or data.
Synology Hyper Backup Destination Offline over Tailscale
Separate the Tailscale path from the Hyper Backup Vault service when a remote Synology destination over Tailscale cannot connect. Test from the source NAS, then the exact address, service port, and DSM 7 outbound access.
Synology Tailscale Connected but NAS Is Unreachable
Separate tailnet connectivity, name resolution, the tailnet access policy, DSM firewall rules, and the exact Synology service port before changing the NAS.
Synology Tailscale Subnet Router: LAN Device Unreachable
NAS access works, but a LAN service behind it does not. Separate subnet advertisement, CIDR, approval, access policy, client routing and target-side evidence.
Tailscale Connection Stuck on DERP Relay
The connection works, but DERP persists during poor performance. Compare both peers and network observations before requesting a scoped network-owner investigation.
Tailscale Exit Node Is Connected but There Is No Internet
Separate exit-node approval and policy, Linux forwarding, the exit node's own upstream connectivity, client numeric-IP reachability, firewall/NAT evidence, and DNS, for Tailscale releases with exit-node support.
Tailscale MagicDNS Name Fails While the Tailscale IP Works
Prove the Tailscale IP path first, then separate tailnet MagicDNS state, client DNS acceptance, and documented split-DNS or nameserver conflicts before changing any DNS setting.
WireGuard Handshake Succeeds but Traffic Does Not Pass
Confirm the handshake is recent, separate a universal WireGuard configuration issue (AllowedIPs and routes) from a platform-specific Ubuntu Server gateway forwarding or NAT issue, then apply a bounded configuration or gateway change with console recovery and rollback.