1# T3 Connect troubleshooting
2
3A T3 Connect connection goes through four parts, in this order:
4
5**This device** reaches T3 Connect over the internet.
6**T3 Connect** checks your sign-in and the host's link.
7**The host's tunnel** (cloudflared on the host) carries the request to the host.
8**T3 Code on the host** answers.
9
10When a connection fails, open **Settings > Environments**, find the environment,
11and select **Details**. The first part marked as failed is the cause. Find its
12section below.
13
14To see the host's side, run `t3 connect status` on the host, or open
15**Settings > Sharing & access** on the host. Both check the host's T3 Connect
16address from the host, and say why it fails. `t3 connect` runs the same check
17when it finishes setup. This check cannot test another device's network. For a
18problem on one device, use **Details** on that device.
19
20## The host's tunnel is offline
21
22T3 Connect could not reach the host's tunnel. This means one of these:
23
24The host is asleep, turned off, or offline.
25T3 Code is not running on the host.
26The host's network blocks the tunnel. See
27 [Port 7844 is blocked on the host](#port-7844-is-blocked-on-the-host).
28
29Fix:
30
31Make sure the host is awake and T3 Code runs on it.
32On the host, run `t3 connect status`. It names the problem on the host's side.
33If the host was offline for a long time, T3 Connect removes its tunnel. Start
34 T3 Code on the host and update it to the latest version. It gets a new tunnel.
35
36## Port 7844 is blocked on the host
37
38The tunnel on the host connects out to Cloudflare on port 7844, with TCP and
39UDP. Both tunnel protocols (QUIC and HTTP/2) use this port. When the host's
40network blocks it, the tunnel cannot start, but normal web traffic still works.
41The host looks online, so this problem is easy to miss.
42
43Common causes:
44
45**A Tailscale exit node on the host.** All of the host's internet traffic goes
46 through the exit node, and that network blocks port 7844. Turn off the exit
47 node on the host with `tailscale set --exit-node=`, or allow outbound port
48 7844 on the exit node's network.
49**A VPN on the host.** Work VPNs often block unknown ports. Ask for port 7844
50 to be allowed, or use a direct route instead (see below).
51**A firewall or strict network.** Allow outbound TCP and UDP port 7844.
52
53If you cannot unblock the port, you can connect without T3 Connect. When the
54host and this device are on the same Tailscale network, add the host's
55Tailscale address as a direct route. See
56[Reach one machine several ways](./remote-access.md#reach-one-machine-several-ways).
57
58## The tunnel works, but T3 Code does not answer
59
60The host's tunnel is up, but it cannot reach T3 Code on the host. Common causes:
61
62T3 Code on the host stopped, crashed, or is still starting.
63T3 Code restarted on a different port, for example after an update, and the
64 tunnel still points at the old port.
65The server binds only one network address with `T3CODE_HOST`. The tunnel
66 sends requests to `127.0.0.1`, so the server must also listen there.
67
68Fix: restart T3 Code on the host. For the background service, run
69`t3 service restart`. Then run `t3 connect status` on the host.
70
71## The T3 Connect address does not resolve or answer
72
73The host's T3 Connect address did not resolve, refused the connection, failed a
74secure (TLS) connection, or did not answer in time.
75
76Fix:
77
78Make sure the host is awake and online.
79On the host, run `t3 connect status`.
80If the check fails only on the host, check the host's DNS, VPN, or proxy.
81 If it says the host's network has an old cached answer, wait: it usually
82 clears within about 30 minutes.
83
84## This device can't reach T3 Connect
85
86The problem is on this device's network, not on the host. This device could
87not reach T3 Connect, or it reached T3 Connect but not the host's tunnel
88address.
89
90Fix:
91
92Check this device's internet connection. On a captive or dead Wi-Fi network,
93 the device can look online but cannot reach anything.
94A VPN, firewall, ad blocker, or DNS filter on this device can block T3
95 Connect. Turn it off for a moment to test.
96On iPhone, Connectivity Assist in the Wi-Fi settings can break T3 Connect.
97 Turn it off to test.
98Try another network, or add a direct route to the host, such as its
99 Tailscale address. See
100 [Reach one machine several ways](./remote-access.md#reach-one-machine-several-ways).
101
102## Sign-in, account, or link problems
103
104This device's T3 Connect sign-in is not ready yet, or T3 Connect does not have
105an active link between your account and the host.
106
107**The host is linked to a different account.** Sign in to the same T3 Connect
108 account on this device and on the host. On the host, run `t3 connect logout`,
109 then `t3 connect`.
110**T3 Connect is off on the host, or the host only publishes agent activity.**
111 On the host, open **Settings > Sharing & access** and turn **T3 Connect** on, or
112 run `t3 connect`.
113**The host was linked, but the server did not apply the link yet.** Restart
114 the server on the host: quit and reopen the T3 Code desktop app, run
115 `t3 service restart`, or stop `t3 serve` and run it again.
116**This device's sign-in expired, or the host no longer accepts this
117 device.** Sign out of T3 Connect and sign in again.
118**This device is still loading its T3 Connect sign-in.** Wait a moment;
119 T3 Code retries on its own. If it keeps waiting, reload or restart T3 Code on
120 this device.
121**Your account reached its tunnel limit.** Remove an environment you do not
122 use from your T3 account's T3 Connect page, or
123 [link a paid T3 Chat account](./remote-access.md#more-machines-with-t3-chat)
124 for a higher limit. Then restart T3 Code on the host.
125
126## The clock is off
127
128T3 Connect signs requests with short-lived proofs. When the clock on this
129device or the host is a few minutes wrong, T3 Connect rejects them. Turn on
130automatic date and time on both devices, then retry.
131
132## The host runs an older T3 Code
133
134This app needs a newer T3 Code on the host. Update T3 Code on the host. See
135[Updating T3 Code](./updating.md).
136
137## T3 Connect returned an error
138
139| Error | Fix |
140| --------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
141| `environment_link_limit_exceeded` or managed tunnel limit | Remove an unused environment or link a paid T3 Chat account, then restart T3 Code on the host. |
142| `auth_invalid` or `invalid_bearer` | Run `t3 connect login`. If credentials were revoked, run `t3 connect logout`, then `t3 connect` again. Restart the server after signing in. |
143| Expired or invalid link proof | Check the host's date and time, update T3 Code, then restart it. |
144| HTTP 403 without a recognized error | Check relay access, proxies, and firewall rules. Keep any Cloudflare Ray ID for a bug report. |
145| HTTP 408, 429, or 5xx | Wait a few minutes. T3 Code retries temporary failures on its own. |
146
147After you fix a permanent rejection, restart the host's server with
148`t3 service restart`. For a foreground server, stop it and run `t3 serve` again.
149
150If T3 Code on the host disappears when SSH closes, see
151[background-service troubleshooting](./background-service.md#troubleshooting).
152
153## Report a problem
154
155If none of this helps, open an issue on
156[GitHub](https://github.com/pingdotgg/t3code/issues). Include:
157
158The text from **Copy diagnostics** in the environment's **Details**.
159The output of `t3 connect status` on the host.
160The trace ID, if one is shown.
161If the tunnel dropped earlier, the host's tunnel log, `relay-client.ndjson`
162 in the logs folder (`~/.t3/userdata/logs` by default). It records when the
163 tunnel connected, warned, exited, and restarted, with the tunnel token
164 removed.