Fix a Blink agent that will not connect

Symptoms

• The Blink support tool on the customer’s computer stays on Connecting… and never gets to Ready to connect.
• In Sessions, the customer has run the tool but the session never connects.
• In Access, a device shows as offline.
• The support tool says This copy of Blink belongs to another Blink server. or This version of Blink is out of date.
• An Access install never shows up under Access, and C:\ProgramData\Blink\install.log says This Blink plan’s device limit is reached. Ask your administrator. or This Blink plan does not include Access. Ask your administrator.

The Blink support tool keeps trying to connect every few seconds until the customer cancels it, so a stuck Connecting… almost always means the computer cannot reach your Blink server.

Likely causes

• The computer has no internet access, or cannot look up your Blink address (DNS).
• A firewall blocks outgoing connections to your Blink address.
• A firewall or security product inspects HTTPS traffic and replaces the server’s certificate.
• The network only allows traffic through a web proxy.
• The tool was downloaded from a different Blink server, or before your server’s identity changed.
• Too many failed connections from that address, so your server has blocked it for a while.
• For an Access install: all Access devices in your plan are in use, or your plan does not include Access.
• The organization’s agent IP rule does not allow the device’s address (Access devices only).

What Blink needs from the network

The agent only makes outgoing connections. You never need to open incoming ports on the customer’s computer or the Access device.

• The address agents connect to. Agents connect to the host name in your license, not necessarily the address you type in your browser. An administrator can see it in Instance › License under Agents connect to, or in Instance › Certificates under Agent connections.
• Outgoing HTTPS. The computer needs to reach that host name over HTTPS (TCP 443, unless your license names another port).
• Outgoing UDP, where possible. Video and audio prefer UDP. When UDP is blocked, Blink relays the session instead, which works but can be slower.
• No proxy. The agent connects directly. It does not use a web proxy configured in Windows or in the browser.
• No HTTPS inspection. The agent accepts only your Blink server’s own identity. A firewall that decrypts and re-signs HTTPS traffic looks to the agent like a different server, so the agent refuses it. Exclude the agent address from HTTPS inspection.
• The computer’s clock does not matter. The agent does not check dates when it connects, so a wrong clock on the customer’s computer is not the cause. (The session log shows an agent clock offset for information only.)

If you run your own Blink server

Your server’s firewall, and any router in front of it, must let these in. These are the default ports of the Blink server image; your installation may use different ones.

Port	Used for
TCP 443, or the port you publish HTTPS on	The console, the join page, agents, and relayed sessions over TLS
UDP and TCP 8071	Session video, audio, input and files
UDP 3478 and 2565, TCP 3478	The built-in relay, for networks that block direct connections
UDP 49152 to 51199	Relay ports, one per relayed connection

Instance › Security › TURN relay shows the relay ports your server listens on.

Check the connection

Run these checks on the customer’s computer or the Access device.

1. Ask the customer to open your Blink address in a browser on that computer. If the join page does not load, fix the internet connection first.

2. Find the agent address (see above). If it is a different host name from the one in the browser, check that one too.

3. On Windows, open PowerShell and run:

   Test-NetConnection yourname.onblink.cloud -Port 443

   Use your agent host name. TcpTestSucceeded : True means the computer can reach it. A name resolution error points to DNS; a failed TCP test points to a firewall.

4. If the computer is on a company network with a firewall that inspects HTTPS, ask its administrator to exclude the agent host name from inspection.

5. If the network only allows web traffic through a proxy, ask its administrator to allow direct outgoing connections to the agent host name.

6. Try another network, for example a phone hotspot. If Blink connects there, the original network is blocking it.

Check the download

1. If the tool says This copy of Blink belongs to another Blink server. or This version of Blink is out of date., create a new code and have the customer download the tool again.
2. Support tools carry your server’s identity from the moment they are downloaded. If an administrator changed the identity key (Instance › Identity) since, older downloads cannot connect. A fresh download always works. Access devices pick up identity changes on their own.
3. If your Blink server was reinstalled as a new instance, existing agents belong to the old one and cannot connect. Support customers download again; Access devices need Blink installed again.

Check for a ban

Your server blocks an address for a while after repeated failed connections.

1. An administrator with the Manage security settings permission opens Instance › Security and looks at Bans.
2. If the computer’s public address is listed with the source Support agents or Access devices, click Lift.

Check the agent IP rule

An organization can limit where its Access devices may connect from. Support tools are never affected.

1. In Access, a device outside the rule shows blocked by IP rule instead of offline. Hover over it to see the address and country it was refused from, and when.
2. An administrator with View agent IP rules switches to the device’s organization and opens Organizations › Agent IP rules.
3. Type the device’s public address in Test an address against the saved rule and click Test. Refused means the rule keeps the device out.
4. If the address is expected, someone with Manage agent IP rules adds it, or its country, to the rule. The device connects again on its next try.

See Fix a block by an IP or country rule and Restrict access by IP address and country.

Check an offline Access device

1. On the device, open Services and check that IZT Blink Agent is running. Start it if it is stopped.
2. Run the network checks above on the device.
3. Read the end of C:\ProgramData\Blink\service.log as an administrator. Repeated connection failures there name the reason.
4. In Access, check the device’s status. An uninstalled device does not come back online by itself: enroll it again. A revoked device comes back only through Un-revoke (see Revoke a device). Both need a free Access device in your plan. A device marked blocked by IP rule is kept out by its organization’s agent IP rule (see Check the agent IP rule).

Check an Access install your plan refused

If an Access install exits with code 20 or 21, the computer reached your Blink server, but the server refused to enroll it because of your plan. The message is printed to the console the install was started from and written to C:\ProgramData\Blink\install.log:

Message	Exit code	What to do
This Blink plan’s device limit is reached. Ask your administrator.	20	Every Access device in your plan is in use. Revoke or delete a device you no longer manage (see Manage Access devices), or ask for more devices in your plan. See Access devices.
This Blink plan does not include Access. Ask your administrator.	21	Your plan does not include Unattended Access. Ask for it to be added to your plan.

The install was rolled back, so nothing is left running on a computer that was not enrolled before. The agent does not try again by itself: once the cause is fixed, run the install again. See Exit codes.

See what the agent sees (Windows)

On Windows you can watch the support tool’s log live while it tries to connect:

1. Ask the customer to close the support tool if it is open.

2. Open Command Prompt in the folder with the download, usually cd %USERPROFILE%\Downloads.

3. Start the tool with --console, using the exact file name:

   blink-xxxxxxxxxxxx.exe --console

   A console window shows each connection attempt and why it failed. Copy the lines that say connect failed for IZT.

When to contact IZT

Contact IZT when the computer can reach the agent address but still does not connect. Send the agent host name, the computer’s public IP address, the time, and the connect failed lines or the device’s service.log. See Collect logs for IZT support.