WAN — is the internet actually reachable?

Pinging 1.1.1.1 and 8.8.8.8 by address separates 'the internet is down' from 'names don't resolve'. If this passes and DNS fails, it's DNS.

What the check does. It pings well-known public addresses (1.1.1.1, 8.8.8.8) by IP, deliberately without using DNS. That isolates routing from name resolution: if this line is green and the DNS line is red, the problem is DNS, full stop.

Good looks like: 5–30 ms on a home connection. Fibre lands at the low end; DSL, cable and 4G higher; satellite far higher.

When it's red

• Gateway green, WAN red — the router is up but its link to the ISP isn't: modem rebooting, ISP outage, or a captive portal (hotel/café Wi-Fi) that swallows everything until you log in through a browser.
• Both red — see [gw](gw).
• Green but slow (hundreds of ms) — a VPN exit on another continent, a saturated uplink (someone uploading), or bufferbloat. n top . shows who on this machine is talking the most.

The public IP line

The address the internet sees you as. If it's in 100.64.0.0/10, your ISP is using [CGNAT](cgnat) and you can't host anything inbound without a tunnel.