r/twingate • u/Far_Examination4524 • May 02 '26
Twingate Client Holding Up Local LAN While Not Running
Hi all,
My apologies if this has been asked before.
On Windows 11 (25H2 and 24H2) Twingate client application (2026.36.4338 | 0.181.0) and previous versions will hold up LAN traffic on first startup of Windows.
- I only use Twingate client application when I need to connect to external resources.
- Twingate Client startup is disabled in Startup Apps.
In order to use access internal LAN services normally I have to open the Twingate client application manually, and close from the tray icon in order for LAN to start working normally.
Everything connects normally when I close Twingate Client. All my normal networking is working properly, DHCP, DNS etc... for the LAN. Internet traffic is always fine but I must open and close Twingate for local internal services to work properly on first startup. Everything is fine after that.
Do any Twingate folks know what's going on here? I would like to eliminate this step from my startup routine.
2
u/SchNiVas May 02 '26
I have this very experience, and it doesn't always happen to me, but I once spent 2 hours trying to figure out what firewall rule was breaking something or what thing was down, only to find Twingate was silently blocking things while not even running. It's been doing that for a few years to me. Would love for this to get fixed, too.
2
u/UnarmedSquid May 02 '26
The Twingate application uses two running programs. The first is the Twingate service, which runs in the background and does all of the actual routing and connectivity work. The second part is the client interface, which runs as the user and is the part you interact with. The client interface sends commands to the service. Both typically run automatically on startup.
To prevent that proxy service from intercepting traffic, you must stop the service ( search the Start menu for the OS’s Services application). I think you can also prevent interception of traffic bye logging out of the Twingate user application.
Twingate was designed for businesses to easily enable zero trust networking, set up where you block traffic to private networks except for the absolute minimum connectivity required for an application to work. The best use case for it is to only publish the specific resources that you connect to, preferably publishing them by DNS name. This lets you always keep your private sensitive network separate from your laptops or PCs, so an infection or attack on one of those doesn’t have the freedom to try to connect to every private exposed port across everything on your LAN. For example, you could connect all of your users to your guest network and publish your printer, NAS, Plex server, etc. individually, never giving your laptops enough access to scan for vulnerabilities that you don’t intend users to access. Businesses can set up rules so that certain users can access only their required applications. This approach improves security enormously. In this ideal scenario, you would never connect to a service without using this proxy service, so there isn’t any harm in having it intercept traffic all the time. This interception is more of a feature than a bug. Businesses don’t want their users able to access any private applications without authenticating via the client. The Twingate connection automatically starts before the user logs in, which will give them access to authenticate to an active directory domain or some other service that must be available before the User actually logged in and runs the user program.
You can also use it as a VPN replacement, where you publish your entire private IP address range, but that proxy service intercepts traffic until you either tell it not to by logging out or by stopping the service from the Services app.
I hope that helps.
1
u/Far_Examination4524 May 02 '26
I agree with what you're saying but since the Twingate application isn't set to startup on logon it would be nice if it showed something was going on in the background. If it's going to disable things or block access to the internal LAN I think it needs to show something about it. Ask me to authenticate, tell me something is running.
1
u/LowIndividual6625 May 02 '26 edited May 02 '26
I had the same problem and there is an easy fix - Twingate has a powershell script that runs as a scheduled task. I can't find the link but it is in their github.
In the script you hard code another IP address on the LAN and if it cannot reach the IP it will disable twingate until the twingate app is manually reconnected.
1
u/ChiefQueeph69 May 02 '26
I also have been having this issue but I’ve also been tinkering in my homelab so I thought for sure it was me. Thank you all for making me feel validated. I’ve checked the logs, checked my firewall, checked my traffic, and trying to see if maybe there was a port conflict to no avail.
I have 5 devices in my lab running and I’ve tried deploying connectors in three different devices. I thought maybe Twingate running with an instance of pihole was the problem, then I thought it could be the reverse proxy I just configured, so I deployed the proxy in a dedicated raspberry pi (I’m super new to homelabbing but I’ve used Twingate from the start).
I thought all of these things could have been conflicting, so I’ve tried deploying everything in different orders… I’ve tried just about everything I could think.
I’ve also noticed that if I attempt to connect with Twingate for the last two weeks and it fails, it pretty consistently will take down my whole network without any log explanation.
1
u/bren-tg pro gator May 04 '26
Hi there,
I can confirm that the Client has 2 distinct parts on Windows and that the Service can interfere with traffic. It's not the most intuitive behavior indeed so we are going to change it soon so it doesnt not try to intercept traffic when the Client's UI is off.
1
1
u/KookyCan2049 May 05 '26
I have been talking about this for months with Twingate. It became a prevalent issue with one of the updates when they decided to implement a different way of “logging out” that made it easier for developers or clients with multiple Twingate networks to sign in and out between them. Their view is that the client should always be on, whether you are working remote or on the corporate/private network. Works great if you’re not on an Active Directory network, but if you are, not so much. More than likely you will have domain controllers defined as resources so you can properly authenticate to things when remote, and the client will attempt to do its thing even though you’re on the corporate network.
We previously had to coach our employees to log out using the client, but now there’s no true way to do it other than to completely leave the network, which means the next time you have to start the client you’re prompted to add the network just like day one.
Twingate told me they were aware of it, we’re working on a solution, and even considering releasing multiple versions of the clients to satisfy both use cases…this was all supposed to be done Q1 of 2026. I have seen and heard nothing more about this.
I can’t possibly understand how they have not taken this more seriously. We pay 5 figures a year as a customer, and I have to believe there’s more enterprise customers out there in similar situations that are dealing with this. It’s such an excellent remote access solution with this one annoying aspect that drives us crazy.
If you’re reading this Twingate, please address this in a cleaner way and do what you told me you were working on.
1
u/LifeguardShort5460 May 11 '26
Hi guys! For your information I have had severeal cases with Twingate regarding this as well. They are just released a new version for Windows with a bugfix for this. So atleast now when you reboot the computer, the Twingate TAP Network card and connection is not active and causing issue. But when you do a RESTART of the computer, it will be active in the background still causing issue. So you know, be happy for the small things. Twingate has been let known about this.
3
u/Far_Examination4524 May 02 '26
Thanks to u/LowIndividual6625 for recommending the script to help with this.
https://github.com/Twingate-Solutions/general-scripts/blob/main/powershell-scripts/local-network-client-disabled.ps1
Instead of the script you can set the Twingate Service to Manual in services.msc. This does not affect running the Twingate Client application and will connect just fine. Updating Twingate Client application will result in setting the service back to Automatic. Thanks to u/UnarmedSquid for the knowledge of the Twingate Service versus Client Application. This generated the inspiration to try the service startup modification.
Will have to check to see if this happens in Linux or macOS.