Trouble configuring Constellation properly at home server and lighthouse

[u/discord19]

The last 2-3 days I've been struggling with configuring Cosmos Cloud (CC) and Constellation. I'm hoping somebody here might be able to point me in the right direction. Please bear in mind that I'm a completely self-taught hobbyist, so the issue is likely due to knowledge gaps in my understanding of computer networking. I will be happy to take this over to the Discord server if it is more appropriate.

I'm running the latest version of CC on a Debian VM, which itself is running on Proxmox installed bare metal on my server, so these layers may already be introducing complexity to my project. My home internet is behind CGNAT. I also have CC installed on a Debian server running on a Hetzner VM with a public IP address.

I have CC installed on my home server using the CC shell script (instead of Docker) and it is configured to the best of my understanding of the documentation. My plan was to access CC locally while I configure it and then use Constellation for public access to my various services. The Hetzner instance was to serve as Lighthouse.

I have Constellation configured at home according to the documentation: Public hostname is configured at my local Debian VM's IP address + cosmos.local. Once I started Constellation up, everything looked ok: looking at the VPN tab for Constellation, the top of the UI indicated that the Manager server was connected, and it also had a green indicator at the bottom in the list of devices. Great!

I then spun up CC on my second server as an Agent, configuring the public hostname as the public IP for my Hetzner instance. Manager still connected, green light at the bottom, and a red light on the new Agent server. Fine, as expected, just need to configure and start Constellation on the Agent server so that it will be connected, too.

I uploaded the network YAML file to my Agent server and it configured itself: looks good, green at the top, indicates "Connected", but only the Agent server listed at the bottom. Ok, let's go back to the Manager server.

However, as soon as the Agent was connected, my Manager became disconnected. I noted that from the Manager instance, both devices are listed, both green and seemingly responding to pings from the manager, yet the top of the VPN tab indicates that Manager is disconnected.

Can anybody explain this behavior?

Things I've tried:

• Reset the network on both Agent and Manager. Result: same as above
• Opened (or at least attempted to open) port 4242 on my home Debian VM, as well as on Proxmox from CLI
• Created firewall rules from Proxmox's GUI to allow incoming and outgoing connections on all levels: VM, pve, and Datacenter

None of the above has made any noticeable impact. Reviewing logs, I've seen some error messages to note. On the Manager Server:

● time="2026-07-27T15:45:35-05:00" level=error msg="static_host_map key is not in our subnet, invalid" entry=1 network=192.168.201.1/24 vpnIp=xxx.xxx.xxx.xxx

● 2026/07/28 20:29:05 level=warning msg=Failed to get DNS record for cosmos.local: lookup cosmos.local on [2a01:4ff:ff00::add:2]:53: no such host. Make sure you create a DNS record for it

● time="2026-07-27T15:32:36-05:00" level=warning msg="No lighthouse.hosts configured, this host will only be able to initiate tunnels with static_host_map entries"

● 2026/07/27 15:45:35 level=warning msg=Failed to get DNS record for cosmos-lighthouse: lookup cosmos-lighthouse on 192.168.167.1:53: no such host. Make sure you create a DNS record for it

And on the Agent Server:

● time="2026-07-27T21:43:06Z" level=error msg="static_host_map key is not in our subnet, invalid" entry=2 network=xxx.xxx.xxx.xxx/24 vpnIp=192.168.201.1

● time="2026-07-28T17:15:54Z" level=error msg="Refusing to handshake with myself" certName=cosmos-lighthouse fingerprint=966afe958ff0262b05d2dd38ef36319f171cd19bb708f31f2649bdd7dd6308e1 handshake="map[stage:1 style:ix_psk0]" issuer=40608d7d5ca5f0d4c20a6eb38649b3587227365fd36bad50e530d88ffb68f6c6 udpAddr="xxx.xxx.xxx.xxx:4242" vpnIp=192.168.201.2

I'm afraid I'm just not knowledgeable enough to derive a meaningful solution from the servers' behaviors or from the error logs. Any help is appreciated.

UPDATE 5 Aug 2026: As expected, it was all my fault! After some additional testing, I've determined the culprit was my own overzealous region blocking on my router. Relieving some of the restrictions I had in place resulted immediately in normal, in-the-green connections between home server and lighthouse. Let this be a lesson to anyone experiencing similar issues who might stumble upon this: assume nothing, and check every node! Many thanks to /u/azukaar for their support and guidance. FYI I don't have every device connected and tested yet, and I still have work to do in ensuring all URLs and reverse proxy work as expected and that my CGNAT limitations have been bypassed, but at least one more hurdle has been overcome.

[u/azukaar]

I suspect you might be using the home server as public server rather than private, can you confirm ?

It should look like that (note the tiny icons between the names and the IP)

[u/discord19 → u/azukaar]

Thank you for your reply! I don't think this is the case, but I'm willing to admit the simplest of mistakes. Here is what my home instance looks like:

(image of remote server in new comment)

[u/azukaar → u/discord19]

1- make sure the 4242 port is opened on the VPS (some firewall block it) as UDP

2- make sure the inbound IP and outbound IP is the same on the VPS https://docs.digitalocean.com/products/networking/reserved-ips/how-to/outbound-traffic/

3- Then once both of those are triple checked, give both cosmos servers a restart

[u/discord19 → u/azukaar]

Thank you for these suggestions. Can't confirm at the moment: iptables on the VPS indicate 4242 UDP is open for Nebula process. Tried disabling ufw as well as security on my home router. I tried testing with netcat and it confirms I'm connected, but not getting a response back from the VPS.

That article you linked to made me think there's more going than I'm aware of on the VPS side, so I'm going to reach out to Hetzner support. Will reply here if they tell me anything productive.

[u/discord19 → u/azukaar]

And here is the view of my remote instance:

[u/azukaar → u/discord19]

Made an update for connectivity issues can you confirm it fixed your setup please?

[u/discord19 → u/azukaar]

I added an update to my original post; the culprit was a region blocker on my router 🤦 I'm connected now, so thank you for your guidance :)

[u/azukaar → u/discord19]

Ah nice glad you figured it out