Monitoring and Health

Monitoring and Health

Devices & Recovery → Layered connectivity checks watches the path layer by layer. All checks start off with blank targets; enabling a check without a target makes no network request. There is no mandatory cloud service, public ping, log upload or automatic reboot.

Evidence	What it means	What it does not prove
Wi-Fi associated	The radio is associated	DHCP, Internet or tunnel health
Uplink address	The uplink has an IPv4 address	Router or Internet reachable
Control connected	Connection to the control server	Port grants or data-plane success
Policy authority ready	A complete, current policy snapshot	Permission for every peer/service
Gateway TCP	A chosen port on the router answers	A closed port is not a router failure
DNS lookup	A chosen name resolved	Answers can be cached
Internet target TCP	One configured public IPv4/port answers	The whole Internet or TLS identity
Tailnet service TCP	One tailnet IPv4/peer and port answers	Every peer, route approval, app health

One check runs per configured interval (30–3600 s), round-robin across up to four roles, with a failure threshold of 1–5 and back-off. States are explicit: disabled, not configured, operational, degraded, down, inconclusive, resource-deferred or stale.

Results appear in the Web UI and, if enabled, in MQTT/Home Assistant, ntfy and read-only SNMP (private tree 1.3.6.1.4.1.99999.2.N.0). Sanitized exports omit IP addresses, host names and device names.

Related: the Service Gateway shows its own per-rule evidence (Service Gateway); Status → Guided setup → Connectivity troubleshooting walks the layers for you (Troubleshooting).

Full guide: NETWORK-HEALTH.md.