> The full list of articles is in [llms.txt](https://docs.f3cloud.com/llms.txt). Every page has a Markdown version: add .md to its address. This page as Markdown: [https://docs.f3cloud.com/en/vpn-guide/vpn-not-connecting.md](https://docs.f3cloud.com/en/vpn-guide/vpn-not-connecting.md).

# VPN on your own server does not connect – finding the cause step by step

The VPN on your own server does not connect, or connects without internet. Step-by-step diagnostics for AmneziaWG, VLESS, WireGuard and OpenVPN, checking the server, the port and the network, MTU and DNS, what to send to support.

When a VPN stops connecting, the first urge is to reinstall everything. Usually there is no need, because the cause almost always sits in one specific place and can be found in a few minutes. This article works for any VPN on your own server, whether it is **AmneziaWG**, **VLESS** in 3X-UI, Marzban or Remnawave, **WireGuard** or **OpenVPN**. We tested all commands on a test server with Debian 12.

***

## Where a VPN can break

A VPN connection passes through a chain of several links. First comes the app on your device, then your home or mobile network, then the provider and the backbones between countries, and only then the server running the VPN software. A failure in any link looks the same to you, the app simply cannot connect.

That is why it is easiest to look for the cause from the end of the chain. First we make sure the server is alive and the VPN runs on it, then that it can be reached, and only after that we look at the network and the device settings. Each step below rules out part of the chain, and the cause is usually found by the second or third.

| What happens | Which step to start from |
| --- | --- |
| Nothing connects, not even SSH | [step 1](#id-1.-make-sure-the-server-is-alive) |
| SSH works, the VPN does not | [step 2](#id-2.-check-that-the-vpn-is-running-on-the-server) |
| The VPN fails only on one network, for example mobile internet | [step 4](#id-4.-check-the-network) |
| The VPN connects, but sites do not open | [step 5](#id-5.-it-connects-but-sites-do-not-open) |

***

## 1. Make sure the server is alive

Try connecting to the server over SSH, for example via [Termius](https://docs.f3cloud.com/en/vps/termius-connection.md). If that works, go to step 2.

If SSH does not respond, check in the [client area](https://my.f3cloud.com/) that the server status is **Active** and the rental has not expired. Then open the **VNC console**, which works even when the server's network is unreachable. How to open it is described in the article on [server management](https://docs.f3cloud.com/en/client-area/server-management.md#vnc-console).

* If the console shows a login prompt, the server works and only the network is unreachable. A common cause is a firewall that has closed the SSH port.
* If the server does not boot, use rescue mode from the same article.

***

## 2. Check that the VPN is running on the server

Most popular VPN panels and the Amnezia app run the VPN in Docker containers. Connect to the server and look at the list of containers.

```bash
# All containers, including stopped ones
docker ps -a
```

A working container has `Up` in the **STATUS** column. If it says `Exited` or `Restarting`, the VPN has crashed. Look at its log, using the container name from the first column.

```bash
# The last 50 lines of the container log
docker logs --tail 50 CONTAINER_NAME
```

Then check that the server is listening on the right port.

```bash
# All ports the server listens on, with program names
ss -lntup
```

The output should include your VPN port. For VLESS, for example, it is usually `443` on a `tcp` line, and for AmneziaWG it is the protocol port on a `udp` line. If the port is missing, the VPN is not running or is running on a different port.

> **If you installed the VPN with our guide.**
>
> For Amnezia, check the protocol in the app, in the server settings. For Marzban, 3X-UI and Remnawave, open the panel and see whether the Xray core is running. Links to the guides are in the **VPN setup** section of the menu on the left.

***

## 3. Check that the port is reachable from outside

The service may be running while the port is closed by a firewall. For TCP protocols such as VLESS and OpenVPN in TCP mode, this is easy to check from your computer.

#### macOS and Linux

```bash
# Check whether TCP port 443 is open on the server
nc -vz SERVER_IP 443
```

`succeeded` means the port is open. `Connection refused` means nothing is running on that port, and if the command waits for a long time and ends with a timeout, the port is closed by a firewall or the connection is cut along the way.

#### Windows

Open **PowerShell** and run the command.

```powershell
Test-NetConnection SERVER_IP -Port 443
```

The line `TcpTestSucceeded : True` means the port is open.

If the port is closed, open it in the server firewall. If you enabled UFW following [our guide](https://docs.f3cloud.com/en/vps/security/firewall.md), use `ufw allow 443/tcp`, and for UDP protocols such as AmneziaWG and WireGuard a command like `ufw allow 1234/udp` with your port.

> **Why UDP cannot be checked this way.**
>
> UDP protocols do not answer empty requests, so `nc` and `Test-NetConnection` are useless for them. For AmneziaWG and WireGuard it is more reliable to check the network as in step 4.

***

## 4. Check the network

If the server and the VPN are fine, the cause is most likely in the network between you and the server.

1. **Try another network.** If the VPN fails on mobile internet but works over Wi-Fi, or the other way round, the provider is to blame rather than the server.
2. **Try another protocol.** Plain WireGuard and OpenVPN are easily recognised and blocked in Russia. Masked protocols, **AmneziaWG** and **VLESS with REALITY**, are more resilient, and if UDP is cut, VLESS helps because it runs over TCP. This is explained in detail in the article on [Amnezia VPN](https://docs.f3cloud.com/en/vpn-guide/setup-amnezia.md).
3. **Change the port.** Some providers restrict UDP on high ports. For AmneziaWG the developers advise a port no higher than **9999**.
4. **Check whether the server IP is blocked.** Run a [traceroute to the server](https://docs.f3cloud.com/en/vps/network-troubleshooting-traceroute.md). If all packets are lost on the last hops while the server is reachable from another network, the address may be blocked along the way. In that case, write to us in a ticket.

***

## 5. It connects, but sites do not open

If the app shows the VPN as connected but sites do not load or open only sometimes, check two things.

* **MTU.** This is the largest packet size that passes through the network without being split. Inside a VPN, service data is added to every packet, and if the original packet was already large, it may stop getting through. Then the VPN connects, small requests work, and large pages and downloads hang. Try lowering the MTU in the connection settings, for example to **1280**, and reconnect.
* **DNS.** If sites do not open by name but do open by IP address, the problem is DNS. Set a public DNS server in the VPN settings, for example `1.1.1.1` or `8.8.8.8`.

***

## What to send to support

If you could not sort it out, write to us in a ticket. To let us see the picture straight away, include the following.

1. The server IP address and which VPN is installed, for example "AmneziaWG via the Amnezia app" or "VLESS in 3X-UI".
2. Where it fails. Home or mobile internet, which provider, whether it works on another network.
3. The output of `docker ps -a` and `ss -lntup` from the server.
4. A traceroute to the server made with [our guide](https://docs.f3cloud.com/en/vps/network-troubleshooting-traceroute.md).
5. The error text from the app, if there is one.

***

## Our resources

**Telegram channel:** [https://t.me/f3cloud_news](https://t.me/f3cloud_news)\
**F3 Cloud:** [https://f3cloud.com](https://f3cloud.com/en)