66 lines
3.0 KiB
Markdown
66 lines
3.0 KiB
Markdown
# Troubleshooting
|
|
|
|
Check the simplest layer that can explain the symptom, then move outward.
|
|
|
|
## Process exits immediately
|
|
|
|
- Run the same command in the foreground and read the fatal configuration
|
|
error.
|
|
- Check that every secret/certificate path exists and is readable by the
|
|
service account, but not by unrelated users.
|
|
- Run `wgcloak --help` and, where implemented, `wgcloak check-config` to spot a
|
|
command or schema mismatch.
|
|
- Confirm listener addresses are valid and no other process owns the port.
|
|
|
|
## Client cannot connect
|
|
|
|
- Verify DNS resolution and the configured server name/port.
|
|
- Confirm the selected transport is implemented in this build; an `auto` list
|
|
may mention future transports.
|
|
- For direct UDP, check both directions in the host firewall and allow the
|
|
server's UDP listener.
|
|
- For TLS transports, verify the hostname matches the certificate and do not
|
|
disable certificate verification.
|
|
- Authentication rejection means a bad/unknown client or secret and must not
|
|
be diagnosed as a firewall failure. Fix credentials before retrying.
|
|
|
|
## Authentication failures or repeated probing
|
|
|
|
Check client ID spelling, secret-file contents, ownership/mode, and system
|
|
clock skew. Direct HELLO timestamps have a target default 60-second window;
|
|
replayed client nonces are rejected. Repeated invalid credentials should stop
|
|
fallback probing rather than generate traffic across every transport.
|
|
|
|
## Connected but no application traffic
|
|
|
|
- Confirm the local application sends to the configured local UDP address.
|
|
- Confirm the server backend is listening at `[backend].target`.
|
|
- Check `status`/`stats` or structured logs for selected transport, maximum
|
|
datagram size, dropped/oversized datagrams, and backend errors.
|
|
- v1 remembers one most-recent local source peer per client tunnel. Concurrent
|
|
source peers can replace that return destination and produce a warning.
|
|
- No application-layer fragmentation exists: reduce payload size when the
|
|
configured transport limit is exceeded (starting target is 1200 bytes).
|
|
|
|
## Session disappears
|
|
|
|
The target idle timeout is 120 seconds, refreshed by authenticated data or
|
|
keepalive. Check keepalive settings, NAT expiry, server resource limits, and
|
|
whether the client is reconnecting after a transport failure. A valid direct
|
|
UDP packet can update the peer address after NAT rebinding; a spoofed packet
|
|
without a valid MAC cannot.
|
|
|
|
## Control socket unavailable
|
|
|
|
Check the daemon's `XDG_RUNTIME_DIR`, socket ownership/mode, and whether a
|
|
stale socket path remains after an unclean exit. The control interface is local
|
|
only and may be absent until the operational-polish milestone is implemented.
|
|
|
|
## Host hardening prevents startup
|
|
|
|
Read the unit's journal output. Common causes are a secret/certificate path
|
|
outside the unit's read paths, a changed binary location, or an address family
|
|
not allowed by `RestrictAddressFamilies`. Correct the reviewed unit rather
|
|
than weakening all hardening directives. `CAP_NET_BIND_SERVICE` is only needed
|
|
for ports below 1024.
|