Your connection

1. × Device 100.64.0.1

   This request disagrees. This request came from 100.64.0.1, a tailnet address no device in the tailnet reading has.

   Press Read now on the tailnet connection. If the address stays unknown, it belongs to a device the connection cannot see, such as one shared in from another tailnet.

   Not read: Tailnet device, because no device in the tailnet reading holds 100.64.0.1

   1. 100.64.0.1 judged Your address, as HQ sees it.

   1. × Device identity The tailnet knows this device

      No device on the tailnet has this address.

      Verified by

      The tailnet device list

   2. ? Identity correlation The device's owner is the person signed in No device owner reported

      The tailnet reports no owner for this device, so HQ cannot compare it with the person signed in.

      Verified by

      The session and the tailnet device owner

2. ✓ HQ Severino HQ

   Confirmed by this request. This request reached HQ at testserver.

   1. testserver Host The name this request asked for. HQ answers only for names on its list.
   2. http Scheme Whether this request arrived encrypted.

   1. ✓ Exposure The name is not in public DNS testserver

      No public DNS record exists for this name in any domain HQ reads.

      Verified by

      Public DNS records

   2. ? Reverse proxy edge The proxy lets in tailnet addresses only Not read

      HQ has no reading of an access list for this name.

      Verified by

      The proxy's access list

   3. ✓ Network The address is on the tailnet 100.64.0.1

      This request came from an address only Tailscale issues, so it came over the tailnet.

      Verified by

      The tailnet address range

   4. ? Network Arrived on the tailnet interface Not read

      HQ has no firewall reading for this machine, so it cannot say which interface this request had to arrive on.

      Verified by

      The firewall rule

   5. ? Zero trust policy The tailnet policy allows this device port 80 · your device not found

      HQ could not find your device on the tailnet, so it cannot check the policy for this step.

      Verified by

      The tailnet policy

   6. ? Transport attestation HQ's own machine measured this link Measured by app-host · HQ's machine not found

      HQ could not tell which tailnet machine it runs on, so it cannot say these measurements are its own.

      Verified by

      Tailscale on the machine that read the tailnet

   7. ✓ Application edge Other networks are refused Enforced

      HQ refuses any address outside its private ranges before sign-in.

      Verified by

      HQ's trusted-network setting

   8. × Human identity Sign-in is single sign-on only Password sign-in installed

      Password sign-in is installed.

      Verified by

      HQ's sign-in settings

   9. × Session Session cookie is locked to this site Secure=off · HttpOnly=on · SameSite=Lax · sessionid

      The session cookie is missing a protection. Check Secure, HttpOnly, SameSite and the __Host- prefix.

      Verified by

      HQ's cookie settings

   10. ✓ Transport The connection is encrypted WireGuard only

       WireGuard encrypts this request. There is no TLS inside it.

       Verified by

       WireGuard and TLS

   11. × Transport HTTPS only plain HTTP served · HSTS 365 days · subdomains included

       HQ serves plain HTTP on its port.

       Verified by

       HTTPS redirect and HSTS

   12. ✓ Browser boundary Scripts only from HQ Trusted Types · nonce scripts · no framing · reported

       Scripts run only from HQ or with a one-time code for this page, the page cannot be framed, and Trusted Types is on.

       Verified by

       Content Security Policy

This shows only how this request reached HQ. Each check names what it relied on, and no single passed check is the whole defence.