Worker connectivity

The worker is enrolled and uploading nothing useful. Almost always ICMP.

A worker needs two quite different kinds of network access, and they fail differently.

Outbound HTTPS, to the platform

How it fetches its target list and uploads results. If this is broken, vapn status says so directly: enrolment fails, or the snapshot goes stale and the upload queue grows.

Nothing inbound is ever needed. If somebody is asking you to open a port, the answer is no port is required.

Outbound ICMP, to the targets

How it measures. This is where the quiet failures live, because a worker with no ICMP still enrols, still heartbeats, and still looks healthy in every summary. It simply reports that everything is unreachable, forever.

Checking it

ping -c 3 1.1.1.1              # from the host
docker exec <container> ping -c 3 1.1.1.1   # from inside the worker

The second is the one that matters. Plenty of hosts allow ICMP from the host and not from inside a container, and that difference is invisible unless you look for it.

Common causes

• The hosting provider blocks outbound ICMP. Common on cheap VPS plans and on some cloud providers by default. Often adjustable in a firewall or security group.
• A local firewall. iptables, nftables or ufw rules dropping outbound ICMP or the replies.
• Missing capability. Sending raw ICMP needs a capability the container must be granted. The generated compose file handles this; a hand-edited one may not.

A worker that measures some targets and not others

Usually not a fault. Some hosts deliberately never answer pings, and a target that is silent for everybody is a measurement, not a failure. It becomes worth investigating when your worker sees silence that other workers do not, which points at a path problem on your side.

Intermittent connectivity

A worker on a connection that drops regularly is not useless, but it is much less useful than it looks: measurements that stop and start are hard to distinguish from the target stopping and starting, and the platform errs toward not counting them. If the machine's connection is unreliable, it is not a good host for a worker.

When to stop looking

If vapn doctor is clean, ICMP works from inside the container, and uploads are current, the worker is fine. A worker whose measurements do not visibly move anything is normal for some time after enrolment.