Troubleshooting

When something goes wrong, VpnHood! MANAGER usually shows it first: in a server's status, as a message in red, or as an error when you open a key. Find what you see below, and what to do about it.

What a server's status says

A server's Status tells you how it is doing:

NotInstalled: it has not reached MANAGER yet.
Configuring: it is taking new settings, which takes a minute or two.
Idle or Active: it works, and is Active while devices are connected.
Disabled: its Enabled switch is off.
Lost: it has stopped reporting to MANAGER.
Error: it could not use its settings.

New connections go only to a server that is Idle, Active or Configuring.

Installing over SSH fails

When MANAGER cannot install a server over SSH, it shows an error, with everything it got back under Details. The usual ones:

If it says The host has no public address, enter the server's public IP address, or a name that points to it: MANAGER reaches the server over the internet.
If the connection is refused or times out, MANAGER could not reach SSH on the server: make sure the server accepts SSH from the internet on that port, or install it with a command instead.
If it says Permission denied, the user name, the password or the key is wrong.
If it says Login Password required, the user needs its password for sudo: enter it under Login Password, even when you sign in with a key.
If it says Installation failed, the installer ran but did not finish, and Details shows what it printed. The user must be allowed to use sudo, which has to be on the machine even for root.

A server never connects

A server stays NotInstalled until it reaches MANAGER, which it does over HTTPS, at access.vpnhood.com, a minute or so after its installer finishes. If it stays that way:

Read what the install command printed. If it stopped with an error, fix that and run the command again: the command works until you delete the server.
Make sure the server can reach access.vpnhood.com over HTTPS: a firewall or a network that blocks it keeps the server out.
Look in the server's log, which says why it cannot connect: see Start and stop the server, or Start, stop and check the server in Docker.

A server shows an error

When a server cannot use its settings, its status turns Error, and its page says why, in red, under Error. It tries again every minute, so the error goes once you remove its cause.

If it says No working tcp end point is available after configuration, the server could not open any of its TCP ports. Under Access Points, a red icon beside a port marks one it could not open: select it to see why. Most often another program already uses the port. Free the port, or give the access point another one, as in Change an address.
If it says Your server version is not supported, the server is older than MANAGER accepts: run its install command again, which installs the latest version.

A server whose settings have failed for a week tries only every half hour. Once you remove the cause, restart it to try at once.

A server stops reporting

A server reports to MANAGER every few minutes. When it misses several reports in a row, its status turns Lost: the machine is down, the server has stopped, or it cannot reach access.vpnhood.com. It gets no new connections until it reports again, and the farm's other servers carry on.

Check that the machine is running, then check the server's status and log, and restart it: see Start and stop the server, or Start, stop and check the server in Docker.

A farm shows a red message

A red message under a farm's name means MANAGER could not build the farm's token, the part of a key that tells apps how to reach the farm's servers. Until you fix it, the farm keeps its last working token, so its keys carry its old addresses.

If it says The farm must have at least one server with PublicInToken access points to use a SelfSigned certificate, apps could find the farm's servers neither by a trusted domain nor by an address in the keys. Give one of its servers an address whose Mode is PublicInToken, as in An access point's settings, or give the farm your own domain: see Use your own domain. A new farm shows this until its first server is installed.
If it says DomainOnly certificates cannot be used as the default server farm tokens at this time, the certificate the keys carry has its Signing set to DomainOnly, which keys cannot carry. Choose another Signing for it, or put another certificate in the keys: see The certificate in the keys.

A key will not open

If Access Key on a key's page says The server farm token has not been initialized properly, the key's farm has never had a working token. Open the farm and fix its red message, as above, and the key opens.

Apps cannot connect

When a device cannot connect, the app says why:

If it says the key has expired, is locked or has used up its traffic, open the key in MANAGER: a key stops working once it expires, uses up its traffic or is turned off.
If it says no server is available, none of the farm's servers can take a new connection: check their status, as above.
If it cannot reach the server, check that the addresses whose Mode is PublicInToken are your servers' public ones, and that the server's firewall, or your cloud's, lets in their TCP port. If it connects on some networks but not on others, those networks block the server: see Keep your server's IP address from being blocked.