"Connection refused"

The computer answered but nothing is listening on the SSH port. Causes, most likely first:

  • SSH isn't on. Mac: System Settings › General › Sharing › Remote Login. Linux: sudo systemctl status ssh (Debian, Ubuntu) or sshd.
  • Wrong port. Default is 22. If the server runs SSH elsewhere, set it in the app.
  • Wrong address. You typed the LAN address (192.168.x.x) but you're not on that Wi-Fi. Use the Tailscale address (100.x.y.z) or MagicDNS name.

"Connection timed out" or nothing happens

Packets aren't reaching the computer at all.

  • Tailscale is off on the phone or the computer. Both need the connection on. On the phone, check that the Tailscale app shows the computer as online.
  • The computer is asleep. A sleeping Mac is off the network and nothing can wake it remotely. Turn on Prevent automatic sleeping on power adapter when the display is off in Battery › Options on a laptop or Energy on a desktop (Displays › Advanced on Ventura) and keep it plugged in, or run caffeinate in a pane. Wake-on-LAN doesn't work over the internet; see waking a Mac remotely.
  • A firewall. Some Linux images block 22 by default; sudo ufw allow ssh. Tailscale traffic arrives on the tailscale0 interface, which most firewall rules allow.

"Permission denied (publickey)"

The computer was reached and refused the key. Check in this order:

  1. User name. It's your login name on the computer, which on a Mac is often not your full name. Run whoami there.
  2. The public key isn't in ~/.ssh/authorized_keys for that user, or was pasted with a line break in the middle. Each key is one line.
  3. Permissions. sshd silently ignores the file if it's too open. Fix: chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys. Your home directory must not be group-writable either.
  4. Passphrase. If the key has one, the app must have it.

On the computer, tail -f /var/log/auth.log (Linux) or log stream --predicate 'process == "sshd"' (Mac) shows the server's side of the story while you retry.

"Permission denied (password)"

Wrong password or wrong user, or the server has password login turned off (PasswordAuthentication no in sshd_config, which is common on servers). Use a key. Note that macOS also accepts keyboard-interactive rather than plain password auth; good apps try both.

"Host key changed" / "REMOTE HOST IDENTIFICATION HAS CHANGED"

The computer at that address presented a different identity than last time. Legitimate reasons: you reinstalled the OS, replaced the machine, or the Tailscale address was reassigned to a different device. If none of those happened, don't connect; something may be intercepting you. If one did, remove the old entry (ssh-keygen -R hostname on a computer; "forget host key" or "trust new key" in a phone app) and connect again.

It connects, then drops when I switch apps

This is the phone, not the server.

  • Android freezes an app within seconds of switching away and often cuts its network, so the SSH connection dies. Apps that run a foreground service (you'll see a persistent notification) stay connected. On Xiaomi, Samsung, Oppo and Vivo phones you may also need to set the app's battery use to unrestricted; dontkillmyapp.com has per-brand steps.
  • iOS keeps connections alive for a short while in the background, then reclaims them. Brief switches are fine; after a longer break, expect a reconnect.
  • Either way, use a multiplexer (tmux or Herdr) so a dropped connection never kills what's running. Reconnecting then just re-attaches.

It connects, then freezes on a train

SSH runs over TCP, which stalls on packet loss and breaks when your IP changes. Options: Mosh, which replaces the transport with something that tolerates loss and roaming (needs mosh-server on the computer and a client that supports it, such as Blink or Moshi), or simply reconnect when signal returns. Over Tailscale, an SSH session often survives a Wi-Fi to mobile handover because the Tailscale address doesn't change.

Everything works, but slowly

Tailscale connects devices directly when it can. When it can't, because of strict NAT on one side, traffic goes through a relay and latency jumps. tailscale status on the computer shows whether the phone is direct or relay. Being on the same Wi-Fi as the computer always gives a direct path.

A checklist to keep

  • Tailscale on, both sides. The phone's Tailscale app lists the computer as online.
  • SSH on. Remote Login enabled, or sshd running.
  • Key installed in ~/.ssh/authorized_keys, one line, permissions 700/600.
  • Computer won't sleep while you're away.
  • A multiplexer between you and anything long-running.

Melta's setup command checks the first three and prints what to enter; the Tailscale SSH guide covers the rest.