F3 Cloud Knowledge Base

English

Русский
Deutsch
Español

English

Русский
Deutsch
Español

VPN on your own server does not connect – finding the cause step by step

The VPN on your own server does not connect, or connects without internet. Step-by-step diagnostics for AmneziaWG, VLESS, WireGuard and OpenVPN, checking the server, the port and the network, MTU and DNS, what to send to support.

When a VPN stops connecting, the first urge is to reinstall everything. Usually there is no need, because the cause almost always sits in one specific place and can be found in a few minutes. This article works for any VPN on your own server, whether it is AmneziaWG, VLESS in 3X-UI, Marzban or Remnawave, WireGuard or OpenVPN. We tested all commands on a test server with Debian 12.

Where a VPN can break ​

A VPN connection passes through a chain of several links. First comes the app on your device, then your home or mobile network, then the provider and the backbones between countries, and only then the server running the VPN software. A failure in any link looks the same to you, the app simply cannot connect.

That is why it is easiest to look for the cause from the end of the chain. First we make sure the server is alive and the VPN runs on it, then that it can be reached, and only after that we look at the network and the device settings. Each step below rules out part of the chain, and the cause is usually found by the second or third.

What happensWhich step to start from
Nothing connects, not even SSHstep 1
SSH works, the VPN does notstep 2
The VPN fails only on one network, for example mobile internetstep 4
The VPN connects, but sites do not openstep 5

1. Make sure the server is alive ​

Try connecting to the server over SSH, for example via Termius. If that works, go to step 2.

If SSH does not respond, check in the client area that the server status is Active and the rental has not expired. Then open the VNC console, which works even when the server's network is unreachable. How to open it is described in the article on server management.

  • If the console shows a login prompt, the server works and only the network is unreachable. A common cause is a firewall that has closed the SSH port.
  • If the server does not boot, use rescue mode from the same article.

2. Check that the VPN is running on the server ​

Most popular VPN panels and the Amnezia app run the VPN in Docker containers. Connect to the server and look at the list of containers.

bash
# All containers, including stopped ones
docker ps -a

A working container has Up in the STATUS column. If it says Exited or Restarting, the VPN has crashed. Look at its log, using the container name from the first column.

bash
# The last 50 lines of the container log
docker logs --tail 50 CONTAINER_NAME

Then check that the server is listening on the right port.

bash
# All ports the server listens on, with program names
ss -lntup

The output should include your VPN port. For VLESS, for example, it is usually 443 on a tcp line, and for AmneziaWG it is the protocol port on a udp line. If the port is missing, the VPN is not running or is running on a different port.

If you installed the VPN with our guide

For Amnezia, check the protocol in the app, in the server settings. For Marzban, 3X-UI and Remnawave, open the panel and see whether the Xray core is running. Links to the guides are in the VPN setup section of the menu on the left.

3. Check that the port is reachable from outside ​

The service may be running while the port is closed by a firewall. For TCP protocols such as VLESS and OpenVPN in TCP mode, this is easy to check from your computer.

bash
# Check whether TCP port 443 is open on the server
nc -vz SERVER_IP 443

succeeded means the port is open. Connection refused means nothing is running on that port, and if the command waits for a long time and ends with a timeout, the port is closed by a firewall or the connection is cut along the way.

If the port is closed, open it in the server firewall. If you enabled UFW following our guide, use ufw allow 443/tcp, and for UDP protocols such as AmneziaWG and WireGuard a command like ufw allow 1234/udp with your port.

Why UDP cannot be checked this way

UDP protocols do not answer empty requests, so nc and Test-NetConnection are useless for them. For AmneziaWG and WireGuard it is more reliable to check the network as in step 4.

4. Check the network ​

If the server and the VPN are fine, the cause is most likely in the network between you and the server.

  1. Try another network. If the VPN fails on mobile internet but works over Wi-Fi, or the other way round, the provider is to blame rather than the server.
  2. Try another protocol. Plain WireGuard and OpenVPN are easily recognised and blocked in Russia. Masked protocols, AmneziaWG and VLESS with REALITY, are more resilient, and if UDP is cut, VLESS helps because it runs over TCP. This is explained in detail in the article on Amnezia VPN.
  3. Change the port. Some providers restrict UDP on high ports. For AmneziaWG the developers advise a port no higher than 9999.
  4. Check whether the server IP is blocked. Run a traceroute to the server. If all packets are lost on the last hops while the server is reachable from another network, the address may be blocked along the way. In that case, write to us in a ticket.

5. It connects, but sites do not open ​

If the app shows the VPN as connected but sites do not load or open only sometimes, check two things.

  • MTU. This is the largest packet size that passes through the network without being split. Inside a VPN, service data is added to every packet, and if the original packet was already large, it may stop getting through. Then the VPN connects, small requests work, and large pages and downloads hang. Try lowering the MTU in the connection settings, for example to 1280, and reconnect.
  • DNS. If sites do not open by name but do open by IP address, the problem is DNS. Set a public DNS server in the VPN settings, for example 1.1.1.1 or 8.8.8.8.

What to send to support ​

If you could not sort it out, write to us in a ticket. To let us see the picture straight away, include the following.

  1. The server IP address and which VPN is installed, for example "AmneziaWG via the Amnezia app" or "VLESS in 3X-UI".
  2. Where it fails. Home or mobile internet, which provider, whether it works on another network.
  3. The output of docker ps -a and ss -lntup from the server.
  4. A traceroute to the server made with our guide.
  5. The error text from the app, if there is one.

Our resources ​

Telegram channel: https://t.me/f3cloud_news
F3 Cloud: https://f3cloud.com