7. Uninstalling and troubleshooting
Uninstalling
sudo bash uninstall.sh --yes
removes the application, its system files and the tunnelry user, but keeps the certificate authority and the VPN
configuration (/etc/tunnelry, /etc/openvpn/server), so existing profiles stay valid if you reinstall.
sudo bash uninstall.sh --yes --purge
removes those too: every issued profile stops working and this cannot be undone. Installed packages (nginx, PHP, OpenVPN and so on) are left alone because other things may use them.
Where to look
| What | How |
|---|---|
| What the privileged helper did | sudo journalctl -t vpnctl --no-pager -n 50 |
| The VPN service | systemctl status openvpn-server@server, sudo journalctl -u openvpn-server@server -n 50 |
| The firewall | sudo nft list table inet tunnelry |
| The DNS server | systemctl status unbound, sudo journalctl -u unbound -n 50 |
| The web application | /var/lib/tunnelry/storage/logs/laravel.log |
| The installation | /var/log/tunnelry-install.log |
| A check of the machine | `echo '{}' |
Common problems
A device connects but reaches nothing. Its role has no rule for what it is trying to open (open Roles), or the change is saved but not applied (look for the bar at the top of the page). For internet access, the role needs internet access and the server must have NAT on.
A device cannot connect at all. Check that UDP 1194 (or the port you chose) reaches the server through any router or cloud firewall, that the address in the profile is the one people can reach, and that the profile has not been revoked. The VPN service must be running (Dashboard → Server health).
I changed a setting and nothing happened. Settings are saved first and applied with the Apply button. After applying, confirm in time, or the server undoes the change.
The page shows the server is "not known" or does not answer. The web application could not reach its helper. Check
sudo journalctl -t vpnctl -n 50 and sudo -u tunnelry sudo -n /usr/lib/tunnelry/vpnctl version.
It worked yesterday and today nothing connects. Check whether the server's own address has changed. If the server gets its address from DHCP (Tunnelry warns about it on the Dashboard and on the VPN server page), it can change after a reboot, and then devices look for the server at the old address and the router's port forwarding points at the wrong machine. Give the server a static address (a reservation in the router helps, but it is not fully reliable); see a static address for the steps.
An update failed. The previous version is running again; see updating.
The browser warns about the certificate. The web interface uses a self-signed certificate by default. Compare the fingerprint with the one the installer printed. To use your own certificate, put it behind the web server you already run and keep Tunnelry's port closed to the outside with Only people connected to the VPN.
My own network is also 10.x.x.x and things clash. Choose another VPN network under VPN server → How devices connect (only possible while no profiles exist) so it does not overlap any network you use; the wizard refuses overlaps with the networks it can see.