The Server Is Up but Nobody Can Connect: A Layered Debugging Playbook
Your dashboard is green and users still can't connect. A repeatable, layer-by-layer method to localize whether the fault is the client, the network path, the listener, the app, or a silently-dead upstream — plus the two highest-signal symptoms most monitoring misses.
The most expensive class of outage isn't the one where everything is on fire — it's the one where everything looks fine. The host is running, the service is "active," CPU is flat, and users still report it's dead. The instinct is to restart things and pray. The discipline is to walk the path one layer at a time and let each layer tell you whether to keep going or stop.
This is that walk: a repeatable playbook for any self-hosted service — a reverse proxy, a tunnel endpoint, an API, a mail server — to localize the fault fast. The running example terminates TLS and forwards to an upstream, because that shape exposes every interesting failure mode, but the method is general.
By the end you'll be able to:
- Localize a fault to one of six layers instead of guessing
- Recognize the two highest-signal symptoms most monitoring misses: TCP-open-but-L7-dead (
HTTP 000) and zero completed sessions in the access log - Avoid the trap that fools almost everyone — testing through the very tunnel you're debugging
- Turn the walk into L7 health checks and alerts that actually catch this class of outage
DMIT ships dual-stack: the IPv6 leak that breaks your IPv4 tunnel
Chaining DMIT Tokyo with a Webshare residential exit: the two-hop egress pattern
Provisioning a DMIT Tokyo node from zero: 45 minutes to a working CN2 GIA tunnel
We do this kind of work for hire.
Network architecture review, self-hosted privacy stacks, zero-trust corporate VPNs.