This page has a new home — update your bookmark.
secret:*:write (every apply re-materializes the server key). Your account has interface write but not secret write, so this page is read-only for you.Every tunnel on this router, with what actually matters: its role, whether its port survives a reboot, which peers are connected, and whether it matches what is configured.
| Tunnel | Role | Port | Peers | Firewall | Drift | |
|---|---|---|---|---|---|---|
| {{T_NAME}}{{#T_RD_BADGE}} rd {{T_RD_ID}}{{#T_RD_HAS_NAME}} · {{T_RD_NAME}}{{/T_RD_HAS_NAME}}{{/T_RD_BADGE}}{{#T_HAS_ADDR}} {{T_ADDR}} {{/T_HAS_ADDR}} |
{{#T_HAS_ERROR}}status unavailable{{/T_HAS_ERROR}}{{^T_HAS_ERROR}}{{#T_ROLE_SET}}{{T_ROLE_LABEL}}{{/T_ROLE_SET}}{{^T_ROLE_SET}}role not set{{/T_ROLE_SET}}{{/T_HAS_ERROR}} | {{#T_PORT_FIXED}}{{T_PORT}} fixed{{/T_PORT_FIXED}}{{#T_PORT_EPHEMERAL}}ephemeral{{#T_HAS_LIVE_PORT}} {{T_LIVE_PORT}}{{/T_HAS_LIVE_PORT}}{{/T_PORT_EPHEMERAL}}{{#T_PORT_NONE}}none (client){{/T_PORT_NONE}} | {{#T_HAS_PEERS}}{{T_CONNECTED}} connected {{T_STALE}} stale {{T_NEVER}} never {{T_DISABLED}} disabled{{/T_HAS_PEERS}}{{^T_HAS_PEERS}}no peers{{/T_HAS_PEERS}} | {{#T_FW_NONE}}—{{/T_FW_NONE}}{{#T_FW_UNKNOWN}}unknown{{/T_FW_UNKNOWN}}{{#T_FW_OFF}}pf off{{/T_FW_OFF}}{{#T_FW_OK}}ok{{/T_FW_OK}}{{#T_FW_MISSING}}{{T_FW_N}} missing{{/T_FW_MISSING}}{{#T_FW_DRIFTED}}{{T_FW_N}} drifted{{/T_FW_DRIFTED}} | {{#T_DRIFT_OK}}in sync{{/T_DRIFT_OK}}{{#T_DRIFT_DRIFT}}drift{{/T_DRIFT_DRIFT}}{{#T_DRIFT_ERROR}}error{{/T_DRIFT_ERROR}}{{#T_DRIFT_SKIP}}not checked{{/T_DRIFT_SKIP}} | Manage |
Answer one question and the rest is derived: the port, the keepalive, what to hand out.
{{PENDING_IFACE}} is live but routes the management path, so it is awaiting confirmation and reverts by itself unless you keep it. If you lose connectivity, do nothing: it backs out at the deadline.
{{TUNNEL_ADDR}}
{{#PENDING_ROTATE}}The server key of {{PENDING_IFACE}} was rotated and is live behind an auto-revert window. Give every peer the new public key shown below; each one reads stale until it is re-keyed. Keep the change to remove the previous key from the store, or let it revert to the previous key at the deadline.{{/PENDING_ROTATE}}{{^PENDING_ROTATE}}A change to {{PENDING_IFACE}} is live behind an auto-revert window. Keep it, or let it revert at the deadline.{{/PENDING_ROTATE}}
{{PUBLIC_KEY}}| Name | Status | Last handshake | Endpoint | Allowed IPs | Transfer | |
|---|---|---|---|---|---|---|
{{#P_HAS_NAME}}{{P_NAME}}{{/P_HAS_NAME}}{{^P_HAS_NAME}}unnamed{{/P_HAS_NAME}} {{P_KEY_SHORT}}…{{#P_HAS_PSK}} · PSK{{/P_HAS_PSK}} |
{{#P_ST_CONNECTED}}connected{{/P_ST_CONNECTED}}{{#P_ST_STALE}}stale{{/P_ST_STALE}}{{#P_ST_NEVER}}never{{/P_ST_NEVER}}{{#P_ST_DISABLED}}disabled{{/P_ST_DISABLED}} | {{P_HS}} | {{#P_HAS_ENDPOINT}}{{P_ENDPOINT}}{{/P_HAS_ENDPOINT}}{{^P_HAS_ENDPOINT}}waits for the peer{{/P_HAS_ENDPOINT}} | {{P_AIPS}} | {{#P_HAS_XFER}}↓ {{P_RX}} ↑ {{P_TX}}{{/P_HAS_XFER}}{{^P_HAS_XFER}}—{{/P_HAS_XFER}} | {{#P_CAN_EDIT}}Edit{{/P_CAN_EDIT}} |
This tunnel predates roles. Setting one tells the page what to derive -- the port rule, the right peer controls. Nothing about the interface changes until you fix the port or add rules.
{{#CAN_EDIT}} {{/CAN_EDIT}}{{POOL_USED}} of {{POOL_SIZE}} addresses used (router + {{COUNT_PEERS}} devices). Each device gets the next free /32; two devices can never hold one address -- the router refuses it.
{{/HAS_POOL}} {{^HAS_POOL}}No device pool is stored for this tunnel; set the role again or recreate it through the wizard to derive one.
{{/HAS_POOL}}{{DEVICE_ERROR}}
{{^DEVICE_RATE_LIMITED}}{{DEVICE_DESCR}} at {{DEVICE_ADDR}} was not added.{{#DEVICE_PSK_STORED}} Its pre-shared key is already in the secret store, so Retry sends the apply alone -- the same key, address and name, no second paste.{{/DEVICE_PSK_STORED}}{{#DEVICE_OFFER_REGEN}} The config you saved was never valid on this router: generate again for a fresh address and new keys.{{/DEVICE_OFFER_REGEN}}
{{/DEVICE_RATE_LIMITED}} {{#DEVICE_RATE_LIMITED}}Nothing was stored for {{DEVICE_DESCR}}. The config you saved carries a pre-shared key the router could not take; generate again without one, or add the device later.
{{/DEVICE_RATE_LIMITED}}Paste this on the other side. It carries this router's public key, where to reach it{{^HAS_PUBLIC_HOST}} (the egress address -- set a public address below if this router sits behind NAT){{/HAS_PUBLIC_HOST}}, and the subnets behind it, derived from the interfaces configured now.
{{PASTE_BLOCK}}
{{#CAN_EDIT}}
Rules are derived from the role. Set the role first.
{{/ROLE_UNSET}} {{^ROLE_UNSET}} {{#FW_HAS_ROWS}}{{R_TEXT}}{{N_TEXT}}
{{/FW_NOTES}} {{#FW_LEGACY}}The firewall still uses raw pf.conf rules, so these rows cannot be reconciled or added from here. Convert it to the visual editor on the firewall page first.
{{/FW_LEGACY}} {{#FW_OFFER}} {{/FW_OFFER}} {{#FW_NEED_PF_WRITE}}{{FW_MISSING}} rule{{^FW_MISSING_ONE}}s{{/FW_MISSING_ONE}} missing. Adding them to the firewall editor needs firewall write permission.
{{/FW_NEED_PF_WRITE}} {{#FW_PF_OFF_MISSING}}PF is disabled: nothing to do. When you enable it on the firewall page, come back here to add the missing rows.
{{/FW_PF_OFF_MISSING}} {{#FW_RECONCILED}}Reconciled by the identity comment on each rule, so a hand-edited rule reads as drifted, never as missing.{{#FW_HAS_DRIFTED}} {{FW_DRIFTED}} drifted: review on the firewall page.{{/FW_HAS_DRIFTED}}
{{/FW_RECONCILED}}net.inet.ip.forwarding: {{#FW_FWD_KNOWN}}{{FW_FWD}}{{/FW_FWD_KNOWN}}{{^FW_FWD_KNOWN}}unknown{{/FW_FWD_KNOWN}}{{#FW_FWD_OFF}} off{{/FW_FWD_OFF}} Network tuning
{{/ROLE_UNSET}}Computed at page load{{#HAS_PEERS}}; the peer rows follow the 5 s status poll{{/HAS_PEERS}}. A row marked · was not checked or needs nothing.
Pick a tool. Output streams here.
The tools need JavaScript; the Diagnostics page runs the same ping and capture.
{{/TOOLS_ANY}} {{^TOOLS_ANY}}No tool is available to this session: ping needs diag:run, capture diag:capture, the log feed log:*:read.