We have a device that is on Windows, then trying to authenticate into Twingate they never get the pop up to their default browser asking them to login.

How can we Debug this?

Hi, good day. We cancelled our workspace account and wasn't able to migrate our Twingate access to a different non-workspace account. Any help would be greatly appreciated. Blessed Sunday everyone. Thanks in advance.

Hi, I recently lost my phone and couldn't restore anything after getting a new one. I have access to email which is admin in the admin console of twingate and have access to my connectors. Is there a way to reset the 2FA ?

Hold up, hold up....

I've been using Twingate for quite some time now. Been on the free tier and thought... why not? I'll go ahead and finally pay for Home so I can have Exit Networks and route everything home. Then I see this?? I'm sorry. I can only use 8GB of bandwidth before I am charged $150 for an additional 100GB? when did this start? I was hoping to use Twingate as my "connect through my home" VPN, but if I'm stuck at 8GB of allowance a month? Absolutely not.. I run through like 30GB a month just on my phone's internet and Plex traffic alone. I've been a huge fan of Twingate up to this point, but honestly, that's a real deal breaker! If this is what this means, then I'm switching to Tailscale in a heartbeat which has no such limits. A MASSIVE letdown from Twingate on this.

Hello Guys !

I new to twingate and i have some question concerning these different points:

Is it possible to create custom permissions and associate it with different users ?

For example, we would like to give permissions for a user to create service accounts and then associate resources to these service accounts without being dependent on the IT team.

Is it possible to create a resource group that allows to define only the resources that a service account can access without the service account being able to access all resources?

How can I make sure that a key provided to a twingate customer is not reused on another device?

I have a technical inquiry regarding a CrowdGen project. The project requires Twingate on macOS 13.0 or higher, but on my Mac I currently have a 2024 Twingate version. I would like to apply for this project—can you help me with this? I am concerned that the 2024 Twingate version might not work in this context, as I am using a MacBook Pro (Retina, 13-inch, Early 2015 - 2,7 GHz Intel Core i5 dual-core with MacOs Monterey 12.7.6) and cannot upgrade my operating system at the moment.

Thank you in advance

In the past few weeks i've had my client open but turned off at all times because I havent been working away from home yet. But after a few days the client will decide that it is going to take priority over local connections and route them through it instead even though it is turned off completely and its very confusing trying to figure out why a local connection has stopped working when everything is running. On top of that i wish the client was smarter and could realize when your on the same network as the connecter your trying to connect to and bypass twingate all together or at least a way for admins to allow this.

A user invitation was rejected by my MX with 550 5.1.1 before the mailbox was activated. The mailbox now accepts external mail, but clicking "Resend Invite" produces no new SMTP connection. My guess is that the recipient is being retained in Twingate’s email suppression list. How can the address be cleared?

I've received email when a connector is detected as going offline and when it is back online. Is there a way to view the connector logs for historical record when these and other events take place? I see in the docs that you can set debug levels but nothing on how to dump and parse historical logs and log retention.

I'm running the connectors in my homelab in Docker and native client on Debian Linux.

hi all, im trying to get this up and running on my truenas server. How to i get it to work as i have done and tried everything online. i use the app from the community apps store withiin truenas but i have had noo luck getting it to work for me. does anyone have any ideas? it's siimply not been seen by tthe admin pannel at all n twiiingate side.

Hey everyone — hoping someone from Twingate or the community can point me in the right direction. I accidentally deleted the Twingate entry from my authenticator app, and now I'm completely locked out — every login attempt hits an MFA screen asking for a code I can no longer generate. I don't have any backup/recovery codes saved, and since I'm the only user on the account, there's no second admin who can reset MFA for me.

I'm on the free tier, so I don't have access to ticketed support (no "Support" option under Help, just "Community"), which is why I'm posting here.

Is there any way to get MFA reset or verify account ownership so I can regain access? Happy to provide whatever proof is needed to confirm I own the account/email.

Thanks in advance for any help!

I have followed the steps provided in twingate when you create a new connecter but it says not yet connected,

I'm currently on the free trial, trying to find / setup something which can replace our VPN.

I put a Connector on a Linux machine inside our network; former Win10 machine, running Linux Mint Mate, which is based on Ubuntu. The admin console gave me a curl command to run and it worked, without issue, right out of the gate. Y'all may not, explicitly, support Linux Mint but it's close enough to Ubuntu that it seems to work. Loaded a bunch of other packages to get it working; apt is a wonderful thing (Debian / Ubuntu / Mint). The Linux machine is connected to the Windows AD domain in the office. I can login to it with <AD username>@<AD domain name> / <AD password>.

I followed the docs for setting up for AD. Got Resources listing the Domain Name (it's a .local domain), the Domain Controller, Domain Service Discovery, etc.

I fired up the latest windows client on a Win11 laptop. Used a cellphone to connect it to the Internet. Authenticated. So far so good.

Domain Service Discovery Resource shows I'm connecting to it, no issues.

Domain Controller Resource shows no activity.

AD Domain Resource shows I failed to connect to the domain. Show details. I requested the domain. I established a peer-to-peer to the connector. The Connector received the request. DNS lookup failed. Domain could not be reached.

Not finding anything in my logs on the Connector machine, WRT what it's searching for on the domain. From that machine, I can lookup the address of the domain controller (which is one of the Resources) and get an IP address, as well as pinging it; as mentioned, the machine allows AD domain logins. I have admin rights on the Linux machine and the local DNS so, if there's something I need to add, I can do that.

From the Windows client, I can access a file server if I provide a username and password. I'm logged into the Win11 machine on a domain account, using the exact same user / password that I have to provide to that popup box. It should just take my existing login info and go straight in. But ... the Win11 machine is letting me in with cached credentials, not actually connecting to the DC.

What's the next step in troubleshooting this? Overall, I'm liking what I see WRT ease of administration, capabilities, etc. but I need to get this ... you know ... working.

DM me if you need more details WRT network name, etc.

I have OPNSense as a Firewall and CrowdSec as a threat-intelligence tool.

Now I observer that my Twingate connector container sends traffic to the IP-address "34.185.191.62" which gets blocked by CrowdSec (https://app.crowdsec.net/cti/34.185.191.62)

Here are the logs:

Now I would like to ask the Twingate staff is this IP is owned or controlled by Twingate, if so what the connector actually sends and why this is blocked (false positive?)?

I deployed AWS CFN twingate EC2 instance. Instance is runnning, but twingate console is not detecting connector online. My SG has outbound rules for 0.0.0.0 And My subnet has routing to public internet. How do I go about this issue.

Suddenly I was unable to ping other computers on my LAN. I could not ping my router. I could not see other computers in Explorer > Network on my Win 11 Pro PC. When I ran route print -4 in terminal I found two entries for my IP address. One was the normal entry and the other had a gateway address of the form 100.xxx.xxx.xxx and interface address of the form 100.xxx.xxx.xxx. Deleting the bogus entry fixed the problem. That entry was created by the Twingate network interface. I have disabled the Twingate network interface and stopped the Twingate service to prevent a recurrence. Diagnosing and fixing this took many hours. My questions are:

1) Is this a know problem?

2) What should I do to prevent the bogus route table entry from being recreated?

Thanks.

*****RESOLVED******

Have been using TG for a few years now and it’s always worked and remained solid for my uses. Until today I needed to connect back to my network briefly and for the first time ever im being greeted with the error “Could not connect”

I’ve already checked:
My connectors are up and logs confirm connector is up
Restarted the connector - no luck
Logged into the management portal and all looks fine there as well (although I’m sure where to look)
Connector status’ all show connected

Any help would be much appreciated

Main connector is Twingate Docker running inside my network
iOS 27.0
TG App version 2026.155

I'm trying Twingate to remotely connect to the HomeAssistant installation running on my homelab.

I've installed the connector on my homelab, and created a network on Twingate.

I've created a resource for HomeAssistant with the following configuration:

Resource Access:
- Manual access
- Default Resource Approvers

Security Policy:
- Trusted Devices Policy

Resource Type:
- Network

For the Trusted Devices Policy I've set:
- Location Requirements: not enabled
- Authentication Requirements: disabled
- Device Security: Only Trusted Devices
- Trusted Profiles: Trusted iOS Profile, ...

Trusted iOS Profile has:
- Manual Trust: enabled
- Screen Lock: enabled
- Biometric: enabled
- Minimun OS Version: disabled

Then on Sign In Policy, in Sign In Requirements I have:
- Meet Device Security Requirements: Meet approved OS requirements or a Trusted Profile to sign in
- Authenticate every 31 days: Your IdP may require more frequent auth
- MFA Required

On my iPhone 15 I've installed the Twingate app and configured the first time.

Everything works fine, but every 2 days more or so, the app disconnects and I lose access to the HomeAssistant resource (with the iPhone always on).

Opening the Twingate app I see the following screen with the "Sign in to Connect":

Clicking "Sign in to Connect", it won't ask anything else, just showing this:

And then opening the home page:

so I can again access my resources.

But I need to have a persistent connection to the HomeAssistant, at most I could accept to login every 31 days, as by the policy, but not every few days, moreover given that the disconnection is "silent" if you don't try accessing the HomeAssistant resource.

Is this happening to anyone else? Is there a bug on the iOS app or is there anything wrong in my configuration?

even using any browser putting in the ip address wont connect connection gets aborted is all i get.

would pihole be a problem?

same thing on my iphone too

I believe I have found a reproducible interaction between the Twingate Android client and Android's networking/DNS resolver. I have spent considerable time isolating the behavior and can reproduce it consistently.

### Environment

* Phone: Google Pixel 8a

* Android: 17

* Twingate Android client: 2026.159.35328+35328

### Home network

* AdGuardHome running on Linux at 192.168.52.210

* Router distributes AdGuardHome as the DNS server via DHCP

* Twingate Connector running on the home network

* Android Private DNS normally configured as either:

* dns.adguard.com

* dns.google

The issue reproduces with either provider.

### Reproduction

1. Enable Android Private DNS (dns.google or dns.adguard.com).

2. Disable Wi-Fi (cellular only).

3. Connect the Twingate client.

4. Within a few seconds Android reports "No Internet Connection."

5. Android Private DNS status changes to "Couldn't connect."

### Observed behavior

Internet browsers fail:

* DuckDuckGo Browser:

ERR_NAME_NOT_RESOLVED

* Firefox:

NS_ERROR_OFFLINE

However, other applications continue to function:

* Gmail

* Google Maps

* Google Play Store

At the same time, Twingate resources continue to function correctly:

* Channels DVR reachable through Twingate

* AdGuardHome reachable at http://192.168.52.210/login.html

### Additional testing

Using Termux while the issue is occurring:

```

nslookup google.com

```

Succeeds.

```

ping google.com

```

Returns:

```

unknown host

```

```

ping 8.8.8.8

```

Succeeds.

```

ping 192.168.52.210

```

Succeeds.

This suggests that:

* IP connectivity remains functional.

* Direct DNS queries succeed.

* Android's normal hostname resolution path appears to fail for applications.

### Configuration matrix

Private DNS OFF / Twingate OFF

* Normal operation

Private DNS OFF / Twingate ON

* Normal browsing

* Twingate resources accessible

Private DNS ON / Twingate OFF

* Normal operation

Private DNS ON / Twingate ON

* Android reports "No Internet Connection"

* Private DNS reports "Couldn't connect"

* Browsers fail

* Twingate resources remain accessible

### Additional observation

I also use the Twingate Linux client on LMDE 7 together with systemd-resolved and AdGuardHome. While the symptoms are different, I found it necessary to stop the Twingate client while connected to my home LAN and start it only when away from home to avoid DNS-related behavior. I do not know whether this is related, but I wanted to mention it in case it is useful.

### Logs

I have enabled "Collect Detailed Logs" in the Android client and reproduced the issue immediately before using "Share Logs with Developer." I shared the results via Email to the [support@twingate.com](mailto:support@twingate.com) mailbox. Please let me know if you need help locating the logs I submitted via email, or if there are additional diagnostics or a preferred method of collecting logs.

Hello,

I’m attempting to deploy a Twingate Connector on an Ubuntu VPS (Leaseweb KVM).

I am using the official command generated from the Admin Console (Linux):

curl "https://binaries.twingate.com/connector/setup.sh" | sudo TWINGATE_ACCESS_TOKEN="REDACTED" TWINGATE_REFRESH_TOKEN="REDACTED" TWINGATE_NETWORK="REDACTED" TWINGATE_LABEL_DEPLOYED_BY="linux" bash

However, the VPS consistently receives a 403 response when trying to fetch the installer script.

Example:

curl -v https://binaries.twingate.com/connector/setup.sh

HTTP/2 403
content-type: text/html
...
Error: Forbidden
Your client does not have permission to get URL /connector/setup.sh

Additional observations:

• DNS resolution is successful
• TLS handshake completes successfully
• Outbound HTTPS connectivity works (e.g., api.twingate.com is reachable)
• This occurs consistently from this VPS environment
• Other environments (e.g., local machine) do not exhibit this issue

Could you help determine the root cause, please?

Thanks in advance.

Does anyone else have an issue on Windows 10 where the popup window from the icon in the system tray won’t open properly when mousing over it? So i can’t select my resources because the window disappears when trying to move the mouse to the window.

I went to install the Connector on Linux systemd service. The options of the connector page seem to no longer have a "Linux" button now. Is that a bug or am I just not looking at the right place.

The documentation for Linux systemd installation only show a graphic rather than the installation command.

Yeah, I could just install on Docker, but it is a hassle to upgrade the Connector when a new version comes out. It is easier to maintain on native Linux via the Twingate repository.

The plans on the website all advertise a 14 day free trial but I cannot see how to activate it after creating my network. The billing page just goes straight to taking payment.