Tag: SSH

Three Latches and One Acquittal: The Layered Investigation of SSH Unreachable Under Tailscale, Shield and Stealth as Twin Gate Gods, and the Exoneration of Huorong

A cloud agent could not reach the PC on ports 22, 3389 and 9119 alike, and the investigation descended three layers: the first latch was Tailscale Shield mode (ShieldsUp: true drops every tailnet-inbound connection) — switched off, still unreachable; the second was the silent reversal of the NIC class — after restarting Tailscale the adapter stalled in Identifying and fell to Public, where the Tailscale-In rules (Domain,Private only) all expire, cured by a Profile-Any CGNAT allow rule limited to 22/9119 and the 100.64.0.0/10 range; the third was the Windows firewall Stealth mode — for ports with no listener it silently drops SYN instead of answering RST, and nothing was listening on 22 at all. Along the way Huorong was suspected and then acquitted (the WFP event 5152 Stealth filter is the Windows default, the blacklist empty, the logs clean), and the finale installed OpenSSH Server 10.0 via winget, wrote the public key to administrators_authorized_keys (ACL only SYSTEM+Administrators), saw the Mac connect and read the banner, and passed the end-to-end key authentication.