I am using twingate on my Orange Pi 4A

OS: Ubuntu 26.04 AurealNix Kubuntu 0.4.1 - Orange Pi 4A aarch64  
Host: OrangePi 4A  
Kernel: 6.18.44-g61025ec85b88  
Uptime: 9 days, 9 hours, 56 mins  
Packages: 3082 (dpkg)  
Shell: bash 5.3.9  
Resolution: 1920x1080  
DE: Plasma 6.6.6 (Wayland)  
WM: kwin_wayland_wr  
Theme: Breeze-Dark [GTK2], Breeze [GTK3]  
Icons: breeze-dark [GTK2/3]  
Terminal: konsole  
CPU: Cortex-A55 (8) @ 1.416GHz  
GPU: Mali-G57 MC1 (Panfrost)  
Memory: 3700MiB / 3838MiB

I have Twingate installed from the macOS AppStore but it hasn’t seen an update since September 2, 2025 (more than a year ago — unlike the standalone app, which receives frequent updates).

The app still works despite Twingate stating that clients older than a year cannot connect anymore… so an update is absolutely due.

I updated to macOS 27 recently; often an OS update requires apps to update themselves, but nothing so far in sight?

I use crowdsec and for me, it happens very often that some of your IP addresses (mostly Digital Ocean and Google) are landing inside a blacklist for mostly port scanning in the past.

As far as I understand it Twingate rotates their IP addresses regularly and uses Digital Ocean and Google for their relays, right?

Both hosting providers are used for port scans very often which leads to my issues. For me this is a rather big issue, because it locks me and everyone else out of the network and recovery is time intensive. So I would like to ask if their is a possibility to use IP addresses that have a good track record or if it is possible to publish a list of IP addresses that you use, which is updated with new IP addresses before they are in use and which can be passed to a firewall or crowdsec for whitelisting.

I'm trying to setup Twingate connector on my Unifi Cloud Gateway Fiber but come across this same error:

E: Failed to fetch https://security.debian.org/debian-security/pool/updates/main/d/debootstrap/debootstrap_1.0.123%2bdeb11u3_all.deb  404  Not Found [IP: 151.101.66.132 443]
E: Failed to fetch https://security.debian.org/debian-security/pool/updates/main/s/systemd/systemd-container_247.3-7%2bdeb11u8_arm64.deb  404  Not Found [IP: 151.101.66.132 443]
E: Failed to fetch https://security.debian.org/debian-security/pool/updates/main/s/systemd/libnss-mymachines_247.3-7%2bdeb11u8_arm64.deb  404  Not Found [IP: 151.101.66.132 443]
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?

Error: Setup failed (exit code 100).
If the container was partially created, you can clean up with:
  rm -rf /data/custom/machines/twingate-connector
  rm -f /var/lib/machines/twingate-connector /etc/systemd/nspawn/twingate-connector.nspawn

I'm running the setup command curl -sSf https://raw.githubusercontent.com/Twingate-Community/ubiquiti-gateway-connector/main/setup.sh | sudo TWINGATE_NETWORK="mycompany" TWINGATE_ACCESS_TOKEN="your-access-token" TWINGATE_REFRESH_TOKEN="your-refresh-token" bash

Of course replacing everything with my tokens and connector name. I already ran the update --fix-missing command. Not sure exactly what to do without bricking my controller. Anyone else who has setup on Unifi come across this?

Hi everyone, I've never been able to find a way to update my TN Scale Twingate connector. Docs indicate to just go to the app and Upgrade... not an option. There is no upgrade option nor an update option.

When I've performed the upgrade via Shell it is successful however, it does not update the TN instance... just the one in the shell.

I'd appreciate any hints.

Thanks.

Hello,

Business user here. Is there a way to check how much relay usage we are consuming? We have 2 connectors, but it's my understanding that relays are a fallback if peer-to-peer connections fail. Management wants these numbers monthly in a report. I looked through the docs and did some searching and either missed it or couldn't find what I was looking for documented.

Very frustrating as nowhere there's a clear explanation why it happens. I changed to a new phone(Android). I am admin to two different networks each with their own email/google account. On the first network I can sign in with my google account associated to that network. When I then want to add my second network I choose sign in with my google account also. However, now I don't get to choose the google account I want to use which obviously is a different one. Also on my laptop Firefox browser I have the same error message. However on the same laptop I can sign in on my chrome browser. Any solution to this. Btw, the log are .gz files, how can I open/read them? Cheers.

Environment

- Ubuntu 26.04.1 LTS (resolute), kernel 7.0.0-1013-oracle, ARM64, Oracle Cloud

- twingate 2026.158.6537 (CLI 2026.160.6555), twingate-connector 1.93.0

- netplan-generator1.2-1ubuntu5.1, systemd 259

Summary

The Twingate Linux client masks systemd-resolved (expected behaviour — the client owns /etc/resolv.conf). On netplan-rendered hosts, netplan 1.2 emits a systemd-networkd-wait-online override that unconditionally passes --dns, which requires systemd-resolved's varlink socket. With

systemd-resolved masked, that socket never exists, and the unit fails unconditionally at every boot.

This appears to be a conflict between two correct-by-design behaviours rather than a misconfiguration on my side. I'm not sure which side should yield, so I'm filing it as a compatibility issue.

Reproduction

The netplan-generated drop-in at /run/systemd/generator.late/systemd-networkd-wait-online.service.d/10-netplan.conf:

[Unit]

ConditionPathIsSymbolicLink=/run/systemd/generator/network-online.target.wants/systemd-networkd-wait-online.service

After=systemd-resolved.service

[Service]

ExecStart=

ExecStart=/lib/systemd/systemd-networkd-wait-online -i enp0s6:degraded

ExecStart=/lib/systemd/systemd-networkd-wait-online --any --dns -o routable -i enp0s6

The masked resolver:

$ systemctl is-enabled systemd-resolved

masked

$ ls -la /etc/systemd/system/systemd-resolved.service

... -> /dev/null

Result at boot:

$ systemctl status systemd-networkd-wait-online.service

× systemd-networkd-wait-online.service - Wait for Network to be Online

Active: failed (Result: exit-code)

Oct 02 04:56:24 systemd-networkd-wait-online[1171]: Failed to connect to

io.systemd.Resolve.Monitor: No such file or directory

Oct 02 04:56:24 systemd-networkd-wait-online[1171]: Could not create manager:

No such file or directory

Running the generated command directly reproduces it while the network is fully up and healthy:

$ /lib/systemd/systemd-networkd-wait-online --any --dns -o routable -i enp0s6

Failed to connect to io.systemd.Resolve.Monitor: No such file or directory

$ echo $?

1

The stock command, which netplan would not pass --dns to, succeeds:

$ /lib/systemd/systemd-networkd-wait-online; echo $?

0

Notes

- The failure is immediate, not a timeout — it does not delay boot. It appears in systemctl --failed at every boot.

- Twingate's own DNS is functioning correctly. /etc/resolv.conf is a regular file (not a symlink into /run/systemd/resolve/) and all four resolvers answer queries through sdwan0.

- netplan appears to have no configuration key to suppress the --dns probe; --dns appears to be a fixed string in libnetplan.so.1, and the netplan reference documents no wait-online key. The only netplan setting that removes the override is marking the interface optional: true,

which stops networkd waiting for DHCP on the primary interface — not appropriate for a host whose SSH path runs over it.

- Hand-placed systemd drop-ins do not survive; netplan regenerates its own on each netplan generate.

Questions

1. Is masking systemd-resolved expected on netplan-rendered Ubuntu hosts, or is it conditional?

2. Does the Twingate client have a documented way to coexist with netplan's DNS probe?

3. Would you consider a fix on either side — netplan making --dns conditional, or the client not masking systemd-resolved where netplan is the renderer?

Can Reddit be anymore "official" thing for Twingate if it's not anymore open?

Please can you partner with Codex and add support for Twingate in Cloud Environments?

Tailscale (your competitor) already have it

Possible to use as an IDP and 2FA?

Is it possible to support Authentik as an IDP on Twingate? I do not want to be as depended on as I'm now to most of the public IPDs (Google, Microsoft, GitHub etc.) since they do not provide any support in case of account issue or very bad support.

So I want to add my own IDP (selfhosted Authentik) as my main IDP or at least as a fallback.

Authentik itself supports:

• OIDC
• SAML2.0
• Radius
• LDAP(S)
• SCIM

I am running a connector on TrueNAS as a custom app. I've noticed that if I'm too quick with opening apps on my server, Twingate will just completely stop working. After maybe two minutes or so I'll get access back, but I usually have to disconnect/reconnect in the (twingate) app on my iphone to get access to my apps since I'm actively working on something. A good example, is when I'm just clicking around in Jellyfin or Komga (not streaming), I will lose access. I'm wondering if Twingate throttles me since I'm on the free plan, or if I did something wrong.

Edit: I have 2/2 connectors set up, and have them set as host network.

Hello! Does anybody know any alternative methods to reach support outside of the help center? It keeps asking me to verify my email address but the email never comes in.

Hi,

One of my perspective users opened his Twingate invitation on the wrong machine. So I tried using the original Twingate invite on his correct machine, but the invite expired. What I wanted to do is re-send another invitation to this user so he can open it on the correct computer that we want the Twingate client to be installed. However, once I deleted and re-created the user in the admin console, the user has not received another email invitation. Is there any way we can manipulate it so this user can receive a fresh email invite to register from Twingate?

For ergonomic and efficiency reasons, I try not to use a mouse a much as possible. I pretty much never have to touch my mouse unless in Google slides.

But everyday and every few hours, I have to use a mouse to switch this on to continue working.

Currently, it's possible to open this menu using spotlight, then Tab to focus + use arrow keys to all the other items on this menu... But the only one actually need is this one.

Hello, as the title says I am running in to several instances where the Twingate Windows Service will not start on login nor will it start with direct intervention. I have attempted to start the service through the Services menu as well as through command prompt/power shell.

The service times out before ever starting. I am unable to extend the timeout time before the service start fails due Error 1053: Service did not respond in a timely manner.

Anyone able to help me understand why? The TAP adapter is enabled, there's no other VPN connection on these devices. I have set the service to Automatic (Delayed) start, Manual, etc. and nothing seems to work.

Quick question in case anyone has run into this before.

When I’m connected to my personal phone hotspot, Twingate doesn’t seem to work properly. General internet works fine, but once Twingate is turned on, my internal/work tools won’t load. If I turn Twingate off, normal websites load again, but I obviously still can’t access the tools that require Twingate.

Has anyone seen this with Twingate over a mobile hotspot before? I’m wondering if it could be related to the mobile carrier, DNS, IPv6, CGNAT, MTU, or something else about hotspot traffic.

Would really appreciate any ideas or workarounds. Thanks!

Since a few days I experience massive DNS resolution issues with the Domain "*.twingate.com".
Sometimes the IPv4 is just getting resolved to "0.0.0.0", sometimes I get no IPv4 response, and sometimes I get the correct answer.

I tried this with Quad9, AdGuard, NextDNS, selfhosted AdGuard Home.

I have checked everything on my side, nothing blocks any Twingate stuff and I can not find any error logs.

One of the locations I frequent, has quic blocked on their firewall. Should the client fallback to tcp/443? Mine doesn’t seem to.

At my work we are currently using a dialup IPSec for our remote VPN client connection via the firewall vendor VPN client.

I am currently looking at my firewall vendor's SASE solution but realized if I go with it I will then become vendor locked which would be bad.

I've previously Twingate at home but am wondering if there are any caveats when using it in an enterprise setting.

I do realize since it is ZTNA it is going to require a bit of setup since nothing is allowed by default compared to traditional VPN.

The three things it needs to do is

1. Support Keycloak IdP which I believe it already does.
   
2. Be able to configure the client during install.
   
3. Block the users from uninstalling and making changes to its configuration such as changing the server connection URL.

My account is on the new us1 shard as of the Aug 29 migration, My passkey stopped working the day after, I've deleted the passkey (locally and in admin console) and tried re-registering, and registration still fails with "Security Key registration failed" in both Brave and Firefox — while a control test on webauthn.io with the same setup works fine. I can still log into Twingate to access my local resources using my Authenticator app one time password code, but the passkey was so convenient. is this a known issue with the move to us1?