Operate and choose
Troubleshoot the path by layer
Locate a failure by checking the device, route, Cloudflare edge, connector, destination network, and service in order.
8 minute lesson
Start on the remote device. Confirm the client is connected to the intended team and the destination matches a routed prefix.
Check Tunnel health and whether cloudflared can reach the destination locally.
Review Gateway or Access policy logs for an explicit block. Then check the destination firewall, listening address, and service logs.
Change one layer at a time. A broad allow rule can hide the real problem and leave permanent access behind.
Start with evidence from both peers:
sudo wg show
ip address show wg0
ip route get 10.14.0.1
ping -c 3 10.14.0.1No recent handshake points toward endpoint, key, UDP, or firewall trouble. A handshake with no useful traffic points toward AllowedIPs, routes, forwarding, DNS, or MTU. Change one layer at a time. Save the before and after output so you can explain which change fixed the path.
Lesson completed