Troubleshooting

Updated Oct 15, 2026

Start with what the visitor sees, then find the matching section.

I can't open the admin panel

• From another computer: the admin panel only answers to addresses on its allowed list. Connect from an allowed address, or use a secure tunnel through SSH.
• From the server itself: if it doesn't answer there, the RustProxy service isn't running. Check its status and recent log lines.
• Locked out by a setting: SSH on port 22 is never closed by RustProxy. Sign in over SSH, fix the setting and restart.

A certificate won't issue

1. Read the log for the error. It names the domain and the step that failed.
2. DNS method: the DNS credential must be allowed to add and remove records in that domain's zone. Allow up to a minute for DNS to catch up.
3. Web method: the certificate authority has to reach port 80 for that exact domain from the internet. A home router, an upstream firewall, or DNS that doesn't point here yet all break it quietly.
4. Wildcard certificates need the DNS method.
5. Let's Encrypt limits repeated failures. Wait before retrying a domain that has failed many times.

"Bad Gateway" (502)

RustProxy couldn't reach the real site. Check:

• The upstream address is right, and reachable from the proxy server.
• The "upstream uses HTTPS" switch matches the real site. A mismatch gives resets or garbage.
• A self-signed certificate on the real site needs "verify upstream certificate" turned off.
• If the app complains about its hostname, try the "preserve host" switch the other way.

Live features don't work (chat, dashboards)

Turn on Websockets for that host.

The app keeps asking me to sign in again

Some apps use cookies browsers now reject. Turn on the host's rewrite SameSite cookies switch.

"Access denied" (403) or "Not found" (404)

• Access denied on a site with an allowed-networks list: your address isn't on the list. If the proxy sits behind another proxy or a NAT, the address it sees may not be yours.
• Access denied on a site with a block list: your address, or the AS number it belongs to, is on a block list. Check the site's lists and any Global lists. Block lists beat everything else, including passwords and certificates.
• Not found on a page-locked site: the page isn't in the allowed paths (Locking a Site to Certain Pages).
• A page looks unstyled behind a page lock: its stylesheets, scripts or images are missing from the allowed paths.

A client certificate isn't accepted

• Check that the site's client-certificate list has names in it. An empty list lets nobody in.
• If Require my organization is on, certificates from any other organization (and older name-only ones) are ignored. Issue a new one from the Client certificates page.
• Was it revoked? Check the page's certificate list.
• Windows and Apple devices need the exact .p12 password. If the import says "password incorrect," double-check how you copied it.

A port or service isn't reachable

Everything is blocked unless you opened it. A non-website service needs a port rule (Opening Other Ports). Also check whether a global block list covers the visitor.

I blocked myself

If a global block list contains your own address, you can lose SSH and the admin panel. Sign in from a different address (or the server's console) and remove the entry, or turn off the list's Global switch.

Hosted addresses don't forward

Use the Check button on the allocation, and make sure the VM network is allowed through the host's own forwarding rules. See Hosting Public Addresses.

After an upgrade

Read the release notes. RustProxy is still before version 1.0, so settings can change between releases. The database is backed up every night, so you can roll it back along with the program.

Still stuck

Open an issue on the project's page with the version, the relevant log lines, and your host settings with any secrets removed.