Written 6 Sep 2026. This is a how-to, not a product card.

When Tailscale won't connect

SSH to the Tailscale address fails, or the laptop never shows Connected. Check both ends online on the same account, the 100.x address, captive portal, then house SSH — before you forward port 22.

Haven't set Tailscale up yet? Start with SSH from away. This note is the failure case: you already tried that path, and either the client never says Connected or ssh you@100.x.y.z hangs from away. Don't open port 22 on the router to "just test."

Skip until house SSH still works

Prove couch SSH first. From a laptop on house Wi-Fi:

ssh you@192.168.x.x

If that fails, Tailscale will not fix a dead box, a wrong password, or OpenSSH that never started. Use when SSH won't connect. If the computer may be asleep or powered down, check is it still on? before you chase VPN settings.

What this is

Tailscale only helps when both ends are on the same account, both show Online, and you SSH to the Tailscale 100.x.y.z address — not the house 192.168… — when you are away. Most "it won't connect" nights are a wrong account, a client still Disconnected, a captive portal, or a firewall that only allows SSH on the house subnet. The walk below is house SSH, then same account, then status and IP, then the client, then away-only traps.

Step 1: same Tailscale account on both ends

The old PC, your laptop, and any phone you use for SSH must share one Tailscale login. A work Google account on the laptop and a personal GitHub login on the computer put them on different tailnets. They will never see each other. Open Machines in a browser already signed into the account you used on the computer. Confirm the laptop (and phone) appear there too. If a device is missing, sign that client out and sign in with the same account.

Step 2: status and the 100.x address on the computer

SSH in from the house network (the address that still works). On the computer:

tailscale status

tailscale ip -4

You want the computer listed as online (or active), and a stable 100.x.y.z on the second command. Write that number down again. In Machines admin, both the computer and the laptop should show Online. Offline means the daemon is down, the device logged out, or the machine has no working internet — not a reason to forward SSH.

Step 3: SSH to 100.x, not the house IP, when away

From the laptop, once Tailscale shows Connected:

ssh you@100.x.y.z

Use the Tailscale address from Step 2. The house 192.168… number only works on the house network. Away from home it will hang or time out even when Tailscale is fine. MagicDNS names are optional later. Get the raw 100.x login working once first.

Step 4: laptop and phone must show Connected

On the laptop client, wait until the status is Connected, not Starting or Disconnected. Quit and reopen the app if it sits halfway. On a phone, turn the Tailscale VPN toggle on before you open Termius or another SSH app. A phone with Tailscale installed but the VPN off is still on coffee-shop Wi-Fi alone — it cannot reach the computer's 100.x address. Phone SSH habits still match SSH from a phone; only the address changes.

Step 5: away-only fails — captive portal and rude networks

If house Tailscale SSH works and away fails, fix the cafe network first. Many captive portals block traffic until you accept terms in a browser. Open a plain HTTP site, sign in, then retry Tailscale until Connected returns. Some networks are rude to UDP; Tailscale can fall back through a relay, but that may take a minute. Wait, then try SSH again. Cellular hotspot is often calmer than locked-down guest Wi-Fi when you just need a proof.

Step 6: ufw locked to the house subnet

If you earlier allowed OpenSSH only from 192.168.0.0/16 (or one house subnet), SSH from a Tailscale IP will look like connection refused or time out even when both ends are Online. Prefer allowing SSH on Tailscale's interface, or allow the Tailscale CGNAT range the same careful way you already allow OpenSSH. The calm ufw walk is turn on a simple firewall without locking yourself out. Don't disable ufw forever to "fix" this.

Step 7: restart Tailscale on the computer after logout or power loss

Still on house SSH if you can reach it. Check the daemon:

systemctl status tailscaled

If it is inactive or failed, start it and bring the node up again:

sudo systemctl start tailscaled

sudo tailscale up

Open the login URL if it asks. After a power outage, reboot once the wall power is stable, then confirm tailscale status and tailscale ip -4 again. A longer post-outage checklist is after the power comes back.

Step 8: match what you see

Match the symptom before you buy anything:

What this is not

This is not forwarding port 22 on the router. It is not an exit node or a subnet router on day one. It is not a paid Tailscale plan for one PC and one laptop. It is not WireGuard you hand-configure tonight. Stay on the free personal plan and the setup note until away SSH is boring.

What next

When 100.x SSH works again, keep the setup page bookmarked: SSH from away. Prefer keys over typing the password every trip: log in with a key, not the password every time. Keep SSH off the public internet on purpose: keep it on the house network. House SSH still broken? When SSH won't connect. Phone on house Wi-Fi without Tailscale is still SSH from a phone.

Skip

• Skip this until house SSH already works once.
• Skip forwarding port 22 on the router to "debug" Tailscale.
• Skip exit nodes and subnet routers on day one.
• Skip a paid Tailscale plan for one PC and one laptop.
• Skip WireGuard configs by hand tonight.
• Skip this if you never leave the house and couch SSH is enough.