All documentation
Troubleshooting14 min

Common issues and fixes

Start from the symptom, isolate the failing layer and verify recovery at the target.

Outcome

A repeatable diagnosis separating device, overlay, policy, service, browser and deployment failures.

Before you start

  • Device/site name
  • Last known working time
  • Permission to inspect the endpoint

Diagnose in layer order

  1. 1Endpoint: power, clock and local health.
  2. 2Internet: DNS and outbound connectivity.
  3. 3Overlay: current handshake and Online state.
  4. 4Policy: user, target and protocol allowed.
  5. 5Service: Winbox/SSH/HTTP listening on the expected address and port.
  6. 6Client/browser: current session, proxy, cache and credentials.
Operational note: Do not broaden policy to compensate for an offline device or stopped service.

Collect the smallest useful evidence

  • Status and last-seen time.
  • Assigned address and target port.
  • Exact first error message.
  • Whether the service works locally.
  • Whether another authorized user sees it.
  • For self-hosting, service status and the relevant log window.

Verify the real recovery

  1. 1Repeat the original action as the original user.
  2. 2Confirm target hostname/router identity.
  3. 3Remove temporary firewall, role or diagnostic changes.
  4. 4Record root cause and durable fix.
  5. 5Rotate/revoke when a credential boundary was crossed.

Verify the result

Original user completes the original workflow.
Target identity is correct.
No temporary public port or broad grant remains.
Monitoring is current.

Common issues

Everything is offline.
Likely cause

Shared DNS, hub, firewall, account or deployment failure.

Fix

Check service status and DNS before editing endpoint configs; compare several tenants/devices.

One site is offline.
Likely cause

Local power, ISP, clock, DNS, firewall or duplicate identity.

Fix

Use out-of-band access, validate local health and reapply only that device's unique config if needed.

Device online, every tool fails.
Likely cause

Policy or target management services are unavailable.

Fix

Test one service locally, check policy and verify exact overlay IP/port.

Only a browser tool fails.
Likely cause

WebSocket, proxy base URL, browser cache or upstream TLS issue.

Fix

Reconnect, verify upstream directly and retry in a clean browser session before changing the overlay.

Continue with

Getting startedCreate a workspace, connect the first device and prove that the remote path works.Remote MikroTik setupConnect RouterOS 7 behind CGNAT and prove remote management without exposing Winbox.Self-host WantasticCoreDeploy the all-in-one open-source control plane and verify day-two operations.
Common issues and fixes | Wantastic Docs