Path view¶
The path view shows the chain a visitor's request follows to reach a published service, with a verdict on each hop, so you can see where it breaks.
Where: Connectivity > Published services, The path to this service on each service card. The header reads Clear end to end or Something in the way.
The hops¶
| Hop | Shows |
|---|---|
| Visitor | A browser opening the published address |
| Name resolves to | The address the service's name resolves to |
| Relay | The relay forwarding the connection, and its state |
| Tunnel | The link between relay and gateway, and the rung that carries it (carried on rung 2) |
| Gateway answers at | The gateway's address inside the tunnel |
| Service on the LAN | The target address and port |
Problems it reports¶
Read left to right; the first problem is usually the cause.
| Message | What to do |
|---|---|
| this gateway has no relay, so the address resolves to nothing | Relay assignment is automatic; if it persists, ask an administrator |
| the relay has no public address / the relay has gone quiet / the relay reports itself unwell | A relay fault; an administrator moves gateways off it |
| the relay is being emptied; this gateway will move | Nothing; the gateway moves on its own |
| the relay is nearly full | Informational |
| the gateway has not built the tunnel / the tunnel exists but has no peer | The gateway has not applied its relay link yet; check it is online |
| the tunnel has never handshaken | The gateway cannot reach the relay: check its internet connection and whether the site filters outbound traffic |
| no handshake for several minutes | The link dropped; it normally recovers on its own |
| the relay is dialling an address this gateway does not hold | The two sides disagree; usually clears at the gateway's next check-in |
| the gateway is not answering on this service | The device may be offline, rebooting or applying a change |
| the service points at nothing | The service has no LAN target; edit it |
If the path is clear and the page still does not load, check the target from the gateway with Diagnostics.
Tunnel rungs¶
The gateway reaches its relay by the fastest transport the site allows, and falls back automatically:
| Rung | Transport |
|---|---|
| 1 | WireGuard over UDP |
| 2 | WireGuard over UDP port 443 |
| 3 | WireGuard inside a WebSocket over TLS on TCP 443 |
It re-probes periodically to move back to a faster rung when the site allows it. Nothing needs configuring. A site that blocks both outbound UDP and TCP 443 blocks all three.