Diagnose the connection.
Keep the protections.

Module installed.
Broker actually current?

Inspect Connectivity > TELIPHONES > System readiness. Module installation is not root broker installation. A stopped service, missing control socket or invalid status needs investigation.

For the local experimental 0.6.0 package, repeat the root bootstrap and verify all three installed helpers match the trusted module: broker, SSH authority and firewall listener helper. Confirm broker 0.6.0/protocol 12 and restart time using the complete upgrade verification guide. A protocol number alone is not build provenance.

Do not change socket ownership, loosen state-directory permissions or execute web-writable code as root. Bootstrap is an operational change: use trusted files, no active support session and disconnected workstation tunnels.

No WireGuard handshake.

• Confirm official WireGuard is verified on Windows and tunnel setup was approved.
• Confirm the profile belongs to the intended PBX and is still authorised.
• Check endpoint DNS/IP and the selected UDP port, default 51821.
• In 0.5.0, inspect the owned FreePBX Custom Service and generated UDP service/zone rules. FreePBX applies changes asynchronously; reconciliation errors must not be ignored.
• Check router forwarding, host policy, blacklists, Fail2Ban and other nftables chains without whitelisting each public IP or trusting the workstation subnet.
• Account for restrictive or carrier-grade NAT. No relay or universal traversal is supplied.

If an old network works and an unfamiliar one does not, packet arrival alone does not identify the dropping rule. Compare incoming/outgoing UDP, generated-rule counters and handshake timestamps using the read-only verification procedure. Actual 0.5.0 roaming still needs live testing.

A saved profile is not proof of endpoint reachability. Editing local expiry data cannot renew server authority; repeated pairings do not repair an unresolved network fault.

A handshake is not
a working web path.

Check Connection Health and the workstation table's last verified firewall integration status. The marked jump belongs inside fpbxfirewall, after INPUT's Fail2Ban processing. An “active” status is not proof that every later packet was delivered.

Confirm the approved scheme/port matches the actual service: standard 80/443 or alternatives such as 8080/8443. Inspect Apache listening addresses, virtual hosts, TLS and redirects. A public-only or loopback-only listener may not serve the tunnel address. TELIPHONES does not reconfigure Apache.

Use a Windows build with the intended 0.8.0 changes and re-pair after a management URL change. The updated TCP check uses the saved URL's port, but does not validate HTTP contents or TLS. Earlier drops, backend differences, independent nftables rules and output filtering remain possible causes.

The 0.4.0 invading-rule incident led to the 0.4.1 placement correction. Verify actual installed helper contents before attributing a new fault to the same cause. Preserve listener ownership/recovery records when cleanup reports failure.

SSH is a separate
permission and credential path.

• The original request must be SSH-capable and the PBX approval must name an existing account.
• Use Windows system OpenSSH and an OpenSSH-backed terminal. PuTTY is not supported for managed My PBXs certificates.
• Keep the adjacent TELIPHONES-SSH.exe helper with the app.
• Check the explicit error: issuance refusal, unreachable API, unsupported account policy and certificate/host mismatches are not interchangeable.
• Do not publish the managed ports or weaken Match, MFA, host verification or forced-command policy.

Host/CA rotation requires a trusted re-pairing process. Never accept an unverified key simply because the server is familiar. An expired certificate refusing a new login is expected and does not prove an existing shell ended.

Connection state is not authority.

A connection can be unhealthy while its original authorisation remains unexpired. Conversely, a local interface display may lag server revocation. No server-pushed revocation channel exists.

Temporary expiry removes authority on its original deadline; reconnecting cannot renew it. To regain access, obtain a fresh PBX approval. Removing the profile only deletes local data.

If revoke/uninstall reports cleanup failure, retain recovery state and investigate owned interfaces, listeners and cgroups from the independent console. Do not delete the state file to force a successful-looking outcome. Complete real-PBX lifecycle behaviour remains under validation.

Installer and application issues.

Useful detail.
Not a secret dump.

Use View Session Log for the selected Windows profile and the FreePBX Workstation diagnostics panel for PBX observations. Correlate the non-secret ws- pairing identifier, timestamps and local attempt identifiers, accounting for clock differences.

Record application/module versions, installed broker version/contents, build provenance, exact sanitised errors and the failing action. State whether My PBXs or Remote Support is involved.

Review output before sharing. Exclude private keys, credentials, complete pairing strings/grants, customer names, endpoints and unrelated ban lists. Do not export entire configuration/state directories or indiscriminate WireGuard dumps.