My "LAN speed test" was actually an internet speed test

I wanted to know how fast my server's network actually is. The standard tool is iperf3: run a server on one end and a client on the other, and it measures raw throughput with the disks out of the picture.

iperf3 -s                    # on the server, listens on port 5201
iperf3 -c <server-ip>        # on the client
iperf3 -c <server-ip> -R     # reverse direction: server sends to the client

Attempt 1: timed out

I pointed my Windows PC at the server's wired LAN address and got:

iperf3: error - unable to connect to server - server may have stopped running
or use a different port, firewall issue, etc.: Connection timed out

My first thought was the firewall. But ping to the same address timed out too, so this wasn't about iperf3 or a port at all. The PC couldn't reach that address.

The clue I'd left out

Then I mentioned that I was talking to Claude over SSH from that same PC. If SSH works but the LAN address doesn't, the SSH session must be taking a different path. Claude checked where the session was coming from: a Tailscale address. The PC wasn't on my home LAN at all. It was reaching the server through the Tailscale tunnel.

Attempt 2: about 30 Mbit/s

Pointed at the server's Tailscale address, iperf3 connected and reported about 30 Mbit/s. That's terrible for gigabit Ethernet, so I asked whether something was wrong.

It wasn't. tailscale status showed a direct connection (not relayed through a DERP server), with the PC at a public IP on a different network about 10 ms away. So the test measured:

the slower of the PC's download speed and the server's home upload speed, plus WireGuard overhead.

30 Mbit/s is a normal home upload speed. The number was right. I was just measuring something other than what I thought.

Checking the actual LAN link

To rule the cable out, Claude ran a few checks from the server towards the router:

• Link speed: ethtool reported 1000Mb/s, so the Cat6 cable and router port negotiated gigabit. A damaged cable often falls back to 100 Mbit/s.
• Latency to the router: about 0.8 ms average, with 0% packet loss.

The wired link is healthy. Measuring its real throughput needs a second wired device on the same LAN running iperf3 -s, since most routers can't act as an iperf3 endpoint.

Takeaways

• A timeout on both ping and the app means a reachability problem, not a port or firewall problem in the app.
• Know which path your traffic takes. With Tailscale running, "the server's address" can mean a LAN IP, a tailnet IP or something routed in between. Check with tailscale status, and echo $SSH_CLIENT shows where an SSH session is coming from.
• Over a VPN, iperf3 measures the internet. Over the internet, home upload speed is almost always the bottleneck.
• ethtool <iface> | grep Speed is the 5-second cable check before you go buying new cables.