StartOS 0.4.0.1, StartTunnel 1.3.0. I’m trying to use private WireGuard access only, with no public exposure.
The StartTunnel Gateway LAN IP for my server is 10.59.154.2. My Mac is a separate StartTunnel device on the same subnet, and its WireGuard handshake is recent. From the Mac:
- Ping to 10.59.154.2 works (TTL 63, 1300-byte packets fine).
- TCP connects on port 443 (dashboard) and 52141 (Immich).
- The TLS handshake then gets “Connection reset by peer” immediately after Client Hello, both with and without SNI (tested with
--resolveusing the server’s .local hostname).
The local StartTunnel address toggles are on for both the dashboard and Immich. HTTPS via .local on the home LAN works fine.
As a test, I turned on Immich’s Public (IP) toggle. Immich then became reachable from the internet on the VPS WAN IP, but access from the Mac via 10.59.154.2 still reset. I’ve since turned Public off again and confirmed the port forward is gone and the WAN IP no longer responds.
So TLS works for traffic forwarded from the VPS’s public IP, but not for traffic from other VPN peers to the server’s tunnel IP. How do I enable private access for VPN devices without publishing the service? This is similar to thread 5439, where turning on Public fixed it, but I don’t want public exposure.
Per thread 5334, StartOS should terminate TLS at the edge and mint a per-connection cert for the dialed IP. In my case the connection is reset right after Client Hello, before any certificate is presented, so it looks like the edge is refusing or failing on connections from VPN peers.
Appreciate any assistance troubleshooting here. (Summary drafted by Claude after extensive troubleshooting).