# Fix a Blink agent that will not connect

## Symptoms

- The Blink support tool on the customer's computer stays on **Connecting…** and never gets to **Ready to connect**.
- In **Sessions**, the customer has run the tool but the session never connects.
- In **Access**, a device shows as **offline**.
- The support tool says **This copy of Blink belongs to another Blink server.** or **This version of Blink is out of date.**
- An Access install never shows up under **Access**, and `C:\ProgramData\Blink\install.log` says **This Blink plan's device limit is reached. Ask your administrator.** or **This Blink plan does not include Access. Ask your administrator.**

The Blink support tool keeps trying to connect every few seconds until the customer cancels it, so a stuck **Connecting…** almost always means the computer cannot reach your Blink server.

## Likely causes

- The computer has no internet access, or cannot look up your Blink address (DNS).
- A firewall blocks outgoing connections to your Blink address.
- A firewall or security product inspects HTTPS traffic and replaces the server's certificate.
- The network only allows traffic through a web proxy.
- The tool was downloaded from a different Blink server, or before your server's identity changed.
- Too many failed connections from that address, so your server has blocked it for a while.
- For an Access install: all Access devices in your plan are in use, or your plan does not include Access.
- The organization's agent IP rule does not allow the device's address (Access devices only).

## What Blink needs from the network

The agent only makes **outgoing** connections. You never need to open incoming ports on the customer's computer or the Access device.

- **The address agents connect to.** Agents connect to the host name in your license, not necessarily the address you type in your browser. An administrator can see it in **Instance** › **License** under **Agents connect to**, or in **Instance** › **Certificates** under **Agent connections**.
- **Outgoing HTTPS.** The computer needs to reach that host name over HTTPS (TCP 443, unless your license names another port).
- **Outgoing UDP, where possible.** Video and audio prefer UDP. When UDP is blocked, Blink relays the session instead, which works but can be slower.
- **No proxy.** The agent connects directly. It does not use a web proxy configured in Windows or in the browser.
- **No HTTPS inspection.** The agent accepts only your Blink server's own identity. A firewall that decrypts and re-signs HTTPS traffic looks to the agent like a different server, so the agent refuses it. Exclude the agent address from HTTPS inspection.
- **The computer's clock does not matter.** The agent does not check dates when it connects, so a wrong clock on the customer's computer is not the cause. (The session log shows an **agent clock** offset for information only.)

### If you run your own Blink server

Your server's firewall, and any router in front of it, must let these in. These are the default ports of the Blink server image; your installation may use different ones.

| Port | Used for |
|---|---|
| TCP 443, or the port you publish HTTPS on | The console, the join page, agents, and relayed sessions over TLS |
| UDP and TCP 8071 | Session video, audio, input and files |
| UDP 3478 and 2565, TCP 3478 | The built-in relay, for networks that block direct connections |
| UDP 49152 to 51199 | Relay ports, one per relayed connection |

**Instance** › **Security** › **TURN relay** shows the relay ports your server listens on.

## Check the connection

Run these checks on the customer's computer or the Access device.

1. Ask the customer to open your Blink address in a browser on that computer. If the join page does not load, fix the internet connection first.
2. Find the agent address (see above). If it is a different host name from the one in the browser, check that one too.
3. On Windows, open PowerShell and run:

   ```powershell
   Test-NetConnection yourname.onblink.cloud -Port 443
   ```

   Use your agent host name. `TcpTestSucceeded : True` means the computer can reach it. A name resolution error points to DNS; a failed TCP test points to a firewall.
4. If the computer is on a company network with a firewall that inspects HTTPS, ask its administrator to exclude the agent host name from inspection.
5. If the network only allows web traffic through a proxy, ask its administrator to allow direct outgoing connections to the agent host name.
6. Try another network, for example a phone hotspot. If Blink connects there, the original network is blocking it.

## Check the download

1. If the tool says **This copy of Blink belongs to another Blink server.** or **This version of Blink is out of date.**, create a new code and have the customer download the tool again.
2. Support tools carry your server's identity from the moment they are downloaded. If an administrator changed the identity key (**Instance** › **Identity**) since, older downloads cannot connect. A fresh download always works. Access devices pick up identity changes on their own.
3. If your Blink server was reinstalled as a new instance, existing agents belong to the old one and cannot connect. Support customers download again; Access devices need Blink installed again.

## Check for a ban

Your server blocks an address for a while after repeated failed connections.

1. An administrator with the **Manage security settings** permission opens **Instance** › **Security** and looks at **Bans**.
2. If the computer's public address is listed with the source **Support agents** or **Access devices**, click **Lift**.

## Check the agent IP rule

An organization can limit where its Access devices may connect from. Support tools are never affected.

1. In **Access**, a device outside the rule shows **blocked by IP rule** instead of **offline**. Hover over it to see the address and country it was refused from, and when.
2. An administrator with **View agent IP rules** switches to the device's organization and opens **Organizations** › **Agent IP rules**.
3. Type the device's public address in **Test an address against the saved rule** and click **Test**. **Refused** means the rule keeps the device out.
4. If the address is expected, someone with **Manage agent IP rules** adds it, or its country, to the rule. The device connects again on its next try.

See [Fix a block by an IP or country rule](/troubleshooting/blocked-by-ip-rule/) and [Restrict access by IP address and country](/configure/ip-and-country-rules/).

## Check an offline Access device

1. On the device, open **Services** and check that **IZT Blink Agent** is running. Start it if it is stopped.
2. Run the network checks above on the device.
3. Read the end of `C:\ProgramData\Blink\service.log` as an administrator. Repeated connection failures there name the reason.
4. In **Access**, check the device's status. An **uninstalled** device does not come back online by itself: enroll it again. A **revoked** device comes back only through **Un-revoke** (see [Revoke a device](/use/manage-devices/#revoke-a-device)). Both need a free Access device in your plan. A device marked **blocked by IP rule** is kept out by its organization's agent IP rule (see [Check the agent IP rule](#check-the-agent-ip-rule)).

## Check an Access install your plan refused

If an Access install exits with code `20` or `21`, the computer reached your Blink server, but the server refused to enroll it because of your plan. The message is printed to the console the install was started from and written to `C:\ProgramData\Blink\install.log`:

| Message | Exit code | What to do |
|---|---|---|
| **This Blink plan's device limit is reached. Ask your administrator.** | `20` | Every Access device in your plan is in use. Revoke or delete a device you no longer manage (see [Manage Access devices](/use/manage-devices/)), or ask for more devices in your plan. See [Access devices](/configure/plans-and-limits/#access-devices). |
| **This Blink plan does not include Access. Ask your administrator.** | `21` | Your plan does not include **Unattended Access**. Ask for it to be added to your plan. |

The install was rolled back, so nothing is left running on a computer that was not enrolled before. The agent does not try again by itself: once the cause is fixed, run the install again. See [Exit codes](/install/access-agent-windows/#exit-codes).

## See what the agent sees (Windows)

On Windows you can watch the support tool's log live while it tries to connect:

1. Ask the customer to close the support tool if it is open.
2. Open Command Prompt in the folder with the download, usually `cd %USERPROFILE%\Downloads`.
3. Start the tool with `--console`, using the exact file name:

   ```bat
   blink-xxxxxxxxxxxx.exe --console
   ```

   A console window shows each connection attempt and why it failed. Copy the lines that say `connect failed` for IZT.

## When to contact IZT

Contact [IZT](https://izt.app) when the computer can reach the agent address but still does not connect. Send the agent host name, the computer's public IP address, the time, and the `connect failed` lines or the device's `service.log`. See [Collect logs for IZT support](/troubleshooting/collect-logs/).