Most NetOz VPN problems come down to a handful of causes: the network you are on is blocking WireGuard, the configuration is out of date, the same configuration is being used on two devices, or you are trying to reach something the VPN does not carry. Work through the sections below that match what you are seeing.

First, check the handshake

Every WireGuard app shows a Latest handshake time for an active tunnel. On Linux, run sudo wg show and look for the latest handshake line.

A handshake within the last couple of minutes means your device is talking to the NetOz VPN server. Go to Connected but cannot reach work systems.
No handshake, or one that is old and not updating, means your device cannot reach the server. Start with No handshake.

While the tunnel is on, the configuration sends a keep-alive every 25 seconds, so a healthy connection refreshes its handshake regularly.

No handshake

The network is blocking WireGuard

WireGuard uses UDP. NetOz VPN servers usually listen on UDP port 51820. The exact host and port are on the Endpoint line of your configuration. Some networks block outbound UDP or only allow web traffic, including:

Hotel, airport and café guest Wi-Fi
Corporate and school networks with strict firewalls
Some public or shared networks

To check: switch to a different network, such as your phone's mobile data or a personal hotspot, and try again. If the tunnel works there, the original network is blocking it. Ask that network's administrator to allow outbound UDP to the endpoint in your configuration.

If you manage your own office firewall, allow outbound UDP from client devices to the VPN endpoint host and port.

The configuration is being used on two devices

Each NetOz configuration belongs to one device. The server only keeps one connection per key, so two devices sharing a configuration keep knocking each other off. The symptoms are a tunnel that works for a while, then stops, then works again.

Remove the tunnel from the second device and ask your administrator to use Add device for it. NetOz then sends a separate setup link for that device.

The device or your access has been removed

If an administrator removed the device or your access, the tunnel stops connecting immediately. Opening your setup link shows This link is no longer valid. Ask your administrator to send a new one. Contact your administrator.

The configuration was edited

NetOz configurations should be imported exactly as downloaded. If you or someone else edited the tunnel, delete it and import a fresh copy from your setup link.

Connected but cannot reach work systems

What you are trying to reach is not in the VPN

The NetOz VPN is a split tunnel. Only traffic to the networks listed under What you'll be able to reach on your setup page goes through the tunnel. On Windows, macOS and Linux these appear as Allowed IPs in the tunnel details.

If the system you are trying to reach has an address outside those ranges, it will not go through the VPN. Ask your administrator to check that it should be reachable. Only NetOz can change the list of destinations.

This also explains a common surprise: your public IP address and normal browsing do not change when the VPN is on. That is expected.

Your configuration is out of date

When your organisation's list of destinations changes, configurations created before the change do not include the new networks. Devices with an old configuration can still connect but cannot reach the new ranges.

You will know this has happened if:

your setup page shows The network changed since you last set this up. Scan or download again to get the updated settings, or
your administrator sees a Needs new link status next to your name and sends you a new link.

To fix it: open your setup link, delete the old tunnel in WireGuard, then scan the QR code again or download and import the new file.

Your home network uses the same address range

If your home or hotel network uses the same private address range as a network carried by the VPN, your device may not know which one to use. If you can reach some work systems but not others, check your local network address in your device's Wi-Fi settings and compare it with the ranges on your setup page. Tell your administrator if they overlap.

Large uploads stall but small pages load

NetOz sets the tunnel MTU to 1280 so that large transfers work on networks with smaller packet sizes. If someone changed the MTU, delete the tunnel and re-import it from your setup link.

Names do not resolve but IP addresses work

NetOz configurations do not set DNS servers, so your device keeps using its normal DNS while the VPN is on. Public names resolve as usual. An internal hostname that only exists on your organisation's private DNS may not resolve.

Try the IP address of the system instead of its name.
Ask your administrator which address to use, or whether internal names are published somewhere your device can reach.

The tunnel will not import

"Incorrect key length" or similar: the file may have been damaged while being copied or emailed. Download it again directly from your setup link.
QR code will not scan: make the browser window larger, increase screen brightness, or use the file import option instead.
Linux interface name error: interface names are limited to 15 characters. Rename the file to something short, such as netoz.conf. See Set up the NetOz VPN on Linux.

I lost my setup link

The setup link is not single-use. Search your email for the original message. The subject starts with the name of your VPN, followed by "set up" and the device name. The same link still works for as long as the device is active.

If you cannot find it, ask your administrator to use Resend setup link in the VPN area of the NetOz Portal.

Never forward your link to anyone else. Anyone who opens it can connect as you. If you think someone else has it, tell your administrator so they can remove the device and issue a replacement.

For administrators

In the VPN area of the NetOz Portal, select a person to see each of their devices, its tunnel address, when it was set up and when it last connected. A device that never shows a recent connection usually points to a blocked network or a configuration that was never imported.

If several people report problems at the same time, check the Incidents page in the portal for any known issue, then contact NetOz support.

Still stuck?

Your setup page may show a support contact for your organisation. Your administrator can raise a case with NetOz from the Support area of the portal, or email us at hello@netoz.au.

Troubleshooting the NetOz WireGuard VPN