Can't connect to Rails console through Fly.io

Questions / Help
, , ,
1

bin/rails fly:console

fly ssh console --pty -C “/rails/bin/rails console” --app lokal-production
Error: ssh: can’t build tunnel for lokal: websocket: failed to WebSocket dial: failed to send handshake request: Get “https://jnb1.gateway.6pn.dev:443/”: dial tcp 102.67.165.132:443: connect: operation timed out

I keep getting this error. This was running perfectly yesterday and the las 2 years working with it.
This are the docs from which i configured the command: Running Tasks & Consoles · Fly Docs.

3

I just tried flyctl ssh console for a London machine, via a European VPN, and it was fine.

The address in your error appears to be part of the IPv6 infra at Fly. This might be related: Wireguard nodes (*.gateway.6pn.dev) unaccessible from IPv6 only

Try a different connection e.g. pairing with your phone. I wonder if there is something up with your current connection.

4

I re-tested on March 5, 2026 and it is still failing with the same error.

What I verified:

  • fly status --app lokal-production works
  • fly doctor -o lokal fails at the WireGuard gateway step
  • exact failure is timeout to https://jnb1.gateway.6pn.dev:443/
  • it fails on both my normal network and phone hotspot
  • fly agent restart, fly wireguard reset lokal, and fly wireguard websockets enable did not fix it
  • forcing machine/region still fails:
    fly ssh console -a lokal-production -r iad --machine 0801672a346378 --pty -C "echo ok"
  • LOG_LEVEL=debug shows GraphQL/app lookup succeeds and peer validation succeeds; the failure only happens when opening the gateway websocket

This looks like a Fly-side gateway/peer assignment issue rather than a local network problem. Can someone inspect or clear the org’s WireGuard/gateway assignment?

5

fly wireguard reset does the same thing as we would be able to do for this.

I will look at the health of this gateway later today

6

Re-tested on March 7, 2026 and still failing with the same timeout to https://jnb1.gateway.6pn.dev:443/.

No VPN involved, and it fails on multiple networks including phone hotspot.
fly wireguard reset still fails the same way, so I can’t clear the peer myself.

Any update on the health of this gateway or the jnb assignment?

7

in what way does fly wg reset fail? what is the exact error message?

does curl -kv https://jnb1.gateway.6pn.dev work? it works for me. if it doesn’t work, could you please provide a mtr: mtr -rwbzo "LSD NABVW" jnb1.gateway.6pn.dev

8

Here are the additional diagnostics.

fly wireguard reset:

? Select Organization: Lokal (lokal)
Error: websocket: failed to WebSocket dial: failed to send handshake request: Get "https://jnb1.gateway.6pn.dev:443/": dial tcp 102.67.165.132:443: connect: operation timed out

curl -kv https://jnb1.gateway.6pn.dev: 
Host jnb1.gateway.6pn.dev:443 was resolved.

IPv6: (none)

IPv4: 102.67.165.132

Trying 102.67.165.132:443…

connect to 102.67.165.132 port 443 from 192.168.100.200 port 58779 failed: Operation timed out

Failed to connect to jnb1.gateway.6pn.dev port 443 after 75377 ms: Couldn’t connect to server

Closing connection
curl: (28) Failed to connect to jnb1.gateway.6pn.dev port 443 after 75377 ms: Couldn’t connect to server

$ sudo mtr -rwbzo "LSD NABVW" jnb1.gateway.6pn.dev
Start: 2026-03-07T15:42:10-0300
HOST: MacBook-Pro-4.local               Loss%   Snt Drop   Last   Avg  Best StDev  Wrst
  1. AS???         192.168.100.1         0.0%    10    0    3.9   4.6   3.8   1.3   7.7
  2. AS???         100.77.160.1          0.0%    10    0   71.1  21.8   6.1  32.1  92.6
  3. AS???         10.253.204.241        0.0%    10    0   22.5  34.3   7.4  32.7  89.4
  4. AS???         10.253.204.242        0.0%    10    0    7.3  35.1   7.3  31.6  90.1
  5. AS???         10.253.211.37         0.0%    10    0    7.5  23.9   7.5  22.8  78.0
  6. AS???         192.168.9.133         0.0%    10    0    7.6  10.3   7.5   6.6  28.8
  7. AS6762        195.22.221.2          0.0%    10    0    9.5   9.4   8.9   0.3  10.1
  8. AS6762        195.22.221.51         0.0%    10    0  115.4 122.4 115.2   8.6 140.3
  9. AS???         ???                  100.0    10   10    0.0   0.0   0.0   0.0   0.0
9

thanks, I’ll ask our provider why this might be happening. in the meantime, could you try connecting with FLY_AGENT_WG_REGION environment variable set to a different region nearby?

10

@glyonbossay what is your ISP and/or public IP address?

11

actually, could you also share the output of curl -v https://debug.fly.dev, and a mtr to debug.fly.dev as well?

12

Quick update: forcing a fresh Fly agent to iad worked for the WireGuard checks.

The earlier FLY_AGENT_WG_REGION=gru/gig/iad fly doctor -o lokal attempts did not change anything because the existing background Fly agent was still running and still using jnb.

When I restarted the agent with the env var set:

fly agent stop
FLY_AGENT_WG_REGION=iad fly agent start
fly agent ping
fly doctor -o lokal

I got:
PID : 26288
Version : 0.4.19
Background: true
Testing authentication token… PASSED
Testing flyctl agent… PASSED
Testing local Docker instance… Nope
Pinging WireGuard gateway (give us a sec)… PASSED
Testing WireGuard DNS… PASSED
Testing WireGuard Flaps… PASSED

I can access the Rails console using the FLY_AGENT_WG_REGION=iad:

➜  pilcha git:(fixes) ✗ FLY_AGENT_WG_REGION=iad bin/rails fly:console

fly ssh console --pty -C “/rails/bin/rails console” --app lokal-production

It seems like…

  • Fly tunnel setup is fine when routed through iad
  • the broken part is the default jnb gateway path/selection

But why does it go on default to `jnb`?
i’ll send you my ip to your email.

1 Like
13

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.