Blog
What's new in TunnelHQ, and practical guides to keeping VPN servers up.
Posts
AmneziaWGAmneziaWG parameters explained: Jc, S1 to S4, H1 to H4, I1 to I5 and 3.x
Every AmneziaWG setting from Jc to HeaderProtectionKey: what it changes on the wire, which must match on both sides, the limits, and why handshakes fail.
Tahir Mehmood11 min read
ShadowsocksSIP003 explained: how Shadowsocks plugins work and how to test them
SIP003 is the Shadowsocks plugin spec. The env vars a plugin gets, how ss:// links carry plugin options, which plugins are maintained, and how to test one.
ST Muntaha11 min read
OpenVPNOpenVPN certificate has expired: find it and renew it
What OpenVPN's 'VERIFY ERROR: certificate has expired' means, how to tell which certificate expired, and how to renew it with easy-rsa 3 without surprises.
Tahir Mehmood10 min read
VLESSVLESS protocol explained: how it works, Vision, REALITY, configs
What the VLESS protocol is: a stateless proxy with UUID auth and no encryption of its own. The wire format, VMess differences, Vision, REALITY and configs.
ST Muntaha10 min read
WireGuardWireGuard: Handshake did not complete after 5 seconds, retrying
What the WireGuard log line means, the 5 and 120 second timers behind it, and the causes in order of likelihood, with the commands to check each one.
Tahir Mehmood8 min read
VLESSVLESS key checker: how to test a vless:// link properly
A VLESS key can pass a ping test and still fail. How to check a vless:// link layer by layer with Xray-core and curl, and what each failure looks like.
ST Muntaha11 min read
MonitoringVPN server monitoring: what to check, how often, from where
What to check on a VPN server (real handshake, latency, certificates, DNS, blocking, the host), how often to check it, from where, and when to page.
Tahir Mehmood7 min read
Hysteria2Hysteria2 protocol explained: QUIC, auth, Brutal, Salamander
How Hysteria2 works, from the official docs: QUIC transport, HTTP/3 auth, Brutal vs BBR, Salamander, port hopping, the hysteria2:// URI and real checks.
ST Muntaha11 min read
October 2026: AI assistants, tunnel groups and sign-in by email
Connect Claude, ChatGPT, Cursor or VS Code by signing in, sort tunnels into groups, and sign in with a code we email you.
TunnelHQ team3 min read
September 2026: Uptime monitoring, heartbeats and 16 more alert channels
Website, keyword, ping and port checks in beta, heartbeats for scheduled jobs, DNS checks, expiry alerts and new places to send alerts.
TunnelHQ team3 min read
July and August 2026: better search, longer timelines and status at a glance
Ranked ⌘K search, health timelines up to 90 days, per-region results and live status counts above the tunnel list.
TunnelHQ team2 min read
WireGuardWhy WireGuard port monitoring misses real outages
A WireGuard server on UDP/51820 looks healthy to port monitors even when every client fails. What's happening on the wire — and how to catch it.
Mehmood Ali7 min read
OpenVPNOpenVPN: TLS key negotiation failed to occur within 60 seconds
You Googled the error. Monitoring says green. Users cannot connect. Eight things that actually cause it, ordered from most to least common.
Mehmood Ali7 min read
V2RayMonitoring V2Ray subscription URLs in production
Subscription URLs sound simple until you run a fleet. Stale caches, partial deliveries, dead servers in healthy bundles. A practical checklist.
T. Hussian7 min read