Get connected, fast.

Portal cannot sign in

Check that the control plane URL is configured and uses HTTPS when the site is HTTPS. Mixed content will block cookie auth in browsers.

Fix: update /runtime-config.js and re-publish, or rebuild with NEXT_PUBLIC_CONTROL_PLANE_URL.

Pairing approval does nothing

The desktop app must be open and polling for approval. After you approve the code, return to RavenVPN Desktop to finish provisioning.

Fix: keep the app running, then re-open the pairing portal from the desktop activation card.

Windows app cannot connect

Verify WireGuard is installed, then check the tunnel status and endpoint candidate list. If the handshake fails, try another region.

Fix: open Desktop Status view, confirm handshake timestamp changes after connect.

Kill switch blocks traffic

Kill switch is designed to block traffic when the tunnel is down. If you use advanced AllowedIPs overrides the semantics may change.

Fix: clear AllowedIPs override, reconnect, then re-apply advanced routing.

Joining a team

If you received an invite token/link, sign in first and then open Portal > Teams to accept it.

Tip: invite tokens are email-locked. Make sure you sign in with the same email address the admin invited.

Org routing policy

In Teams mode, routing policy is managed at the organization level and distributed to all member devices when they refresh config.

Admins: use Portal > Teams > Organization routing policy.

Private routes (overlay)

For zero-trust overlay deployments, define private_routes CIDR allowlists and then sync AllowedIPs so member devices route only private access traffic through RavenVPN.

Admins: open Portal > Teams > Private routes, then click Sync AllowedIPs. In the Windows app, you can also use Overlay routes under AllowedIPs override.

Optional: restrict a route to specific members via Access in the private routes table.

Connectors (overlay)

Overlay mode requires at least one connector edge running inside your private network. Clients will automatically prefer connectors when AllowedIPs is not full tunnel.

Admins: open Portal > Teams > Connectors, mint a connector token, then run the edge-agent on a Linux host. The connector will enforce enabled private routes via route_allowlist.

Billing ownership

Teams checkout requires an organization name and creates an organization owned by the buyer account. Use the billing portal for upgrades and invoices.

If billing is managed by your org, ask an owner/admin to start checkout in Billing.

Website snapshot

Open Status diagnostics and use the Copy support bundle button. It excludes tokens and focuses on configuration and connectivity.

Desktop snapshot

In RavenVPN Desktop, export a diagnostics bundle from the Diagnostics view. It writes a sanitized JSON file to Downloads for sharing.

What to include

Your email (or customer ID), the region you selected, and the approximate time of failure. Do not send secrets or raw tokens over chat.