Indexed by symptom; most issues trace back to one of four categories: network, license, delivery, and SSH.
| Symptom | Investigation |
|---|
| 502 / connection refused | systemctl status ff1-master; journalctl -u ff1-master -n 50 |
| Data / startup error | Check logs with journalctl -u ff1-master; confirm the data directory is writable and the disk isn’t full |
| Certificate error | Reverse-proxy TLS config; is the browser using the correct domain |
| Symptom | Investigation |
|---|
| ”License invalid” prompt | Console → Settings → License, re-save the Key; has it been renewed |
| Cannot create nodes / rules | Is the plan quota (servers_cont / forward_count) exhausted |
| Symptom | Investigation |
|---|
| Node shows offline | On the node, systemctl status ff1-agent; can it reach Master outbound |
| Intermittently offline | Reverse-proxy WebSocket idle timeout; unstable node egress |
| SSH works but node offline | Does FF1_MASTER_URL match the browser access address; firewall egress |
| Symptom | Investigation |
|---|
Delivery task stuck pending | Node offline or ff1-agent not running, see above |
Delivery failed | Error message in the config delivery queue |
| Shows success but can’t connect | Node firewall, is the entry port allowed, is the upstream reachable |
| One hop of a multi-hop chain is down | Confirm delivery succeeded on every node on the chain, see Tunnels and nesting |
Usually the node can’t reach the internet to download or the disk is full: check node egress and disk, SSH credentials, and security groups.
- Master: startup failure → check logs with
journalctl -u ff1-master, roll back from a DB backup if needed
- Core: version too old → upgrade and restart
ff1-agent
Provide (do not include plaintext Tokens / keys):
- Master version, License plan
request_id (in the API error response)- Node ID, forwarding rule ID, screenshot of the failed task
- A summary of the audit log for the relevant time window
