---
title: What to check if the Secure Remote Access is not working (Troubleshooting)
slug: kronpam-installation-guide/what-to-check-if-the-secure-remote-access-is-not-working-troubleshooting
docTags: 
createdAt: 2025-11-04T08:34:38.316Z
---

1\) Check whether the secure reboot is disabled on both Remote Access Portal (RAP) machine and Secure Remote Access Connector/Kron PAM server. If it is enabled the Wireguard might not work.

| **Linux CLI** | **\[root@**<font color="#EF4444">**rap**</font>**\~]#** mokutil --sb-state |
| ------------- | -------------------------------------------------------------------------- |

:::hint{type="success"}
**SOLUTION: Disable secure boot.**
:::

****

2\) Check the Wireguard configuration file on both Remote Access Portal (RAP) machine and Secure Remote Access Connector/Kron PAM server:

**\* Read the Wireguard config file command on the Remote Access Portal (RAP) environment:**

| **Linux CLI** | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  cat /etc/wireguard/wg-server.conf                                                                                                                                                                                                                                                                                                                                                                                                                    |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Example**   | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  cat /etc/wireguard/wg-server.conf<br />\[Interface]<br />PrivateKey = AAAAAAAL/mqg4KKabGXO1GvAmqhFpN3JmJi4A+SE4=<br />ListenPort = 50044<br />Address = <font color="#EF4444">**10.0.0.1/32**</font><br /><br />\[Peer]<br />PublicKey = BBBBBBTqwb8QxlgG0c+RFlol/2eRATmwT7hI/wzjP14=<br />AllowedIPs = <font color="#6b7280">**10.0.0.2/32**</font>**&#x20;(or&#x20;**<font color="#A855F7">**10.0.0.2/32**</font>**)**<br />PersistentKeepalive=25 |



**\* Read the Wireguard config file command on the Secure Remote Access Connector/ Kron PAM server:**

| **Linux CLI** | **\[root@**<font color="#6b7280">**connector**</font>**\~]#**  cat /etc/wireguard/wg-client.conf<br /><br />OR<br /><br />**\[root@**<font color="#A855F7">**pam**</font>**\~]#**  cat /etc/wireguard/wg-client.conf                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Example**   | **\[root@**<font color="#6b7280">**connector**</font>**\~]#**  cat /etc/wireguard/wg-client.conf<br />\[Interface]<br />PrivateKey=CCCCCCDUnTSCUfUSh3cROM8qnfLnct0XiRUh1RKSV1E=<br />ListenPort=50044<br />Address=<font color="#6b7280">**10.0.0.2/32**</font><br /><br />\[Peer]<br />PublicKey=DDDDDD9+EPCYlO4RxDaJ6WqPLLK9zVp691BkvZIP/jU=<br />EndPoint=10.10.10.10:50044<br />AllowedIPs=<font color="#EF4444">**10.0.0.1/32**</font><br />PersistentKeepalive=25<br /><br />OR<br /><br />**\[root@**<font color="#A855F7">**pam**</font>**\~]#**  cat /etc/wireguard/wg-client.conf<br />\[Interface]<br />PrivateKey=CCCCCCDUnTSCUfUSh3cROM8qnfLnct0XiRUh1RKSV1E=<br />ListenPort=50044<br />Address=<font color="#A855F7">**10.0.0.2/32**</font><br /><br />\[Peer]<br />PublicKey=DDDDDD9+EPCYlO4RxDaJ6WqPLLK9zVp691BkvZIP/jU=<br />EndPoint=10.10.10.10:50044<br />AllowedIPs=<font color="#EF4444">**10.0.0.1/32**</font><br />PersistentKeepalive=25 |



**\* Ping the Remote Access Portal (RAP)’s Wireguard IP address and the Secure Remote Access Connector/Kron PAM server’s Wireguard IP address on both environments (you should see that messages are received/sent).**

| **Linux CLI** | **\[root@**<font color="#6b7280">**connector**</font>**\~]#**  ping \{Remote Access Portal’s Wireguard public IP}<br /><br />OR<br /><br />**\[root@**<font color="#A855F7">**pam**</font>**\~]#**    ping \{Remote Access Portal’s Wireguard public IP} |
| ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Example**   | **root@**<font color="#6b7280">**connector**</font>**\~]#**  ping <font color="#EF4444">**10.0.0.1**</font><br /><br />OR<br /><br />**\[root@**<font color="#6b7280">**pam**</font>**\~]#**  ping <font color="#EF4444">**10.0.0.1**</font>             |



| **Linux CLI** | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  ping \{Secure Remote Access Connector/Kron PAM server’s Wireguard public IP}<br />                                                                                              |
| ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Example**   | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  ping <font color="#6b7280">**10.0.0.2**</font><br /><br />OR<br /><br />**\[root@**<font color="#EF4444">**rap**</font>**\~]#**  ping <font color="#A855F7">**10.0.0.2**</font> |

:::hint{type="success"}
**SOLUTION: Check the wireguard configurations, and restart them.**
:::

| **Linux CLI** | **\[root@ \~]#**    wg-quick down \{Wireguard configuration file name} <br /><br />**\[root@ \~]#**    wg-quick up \{Wireguard configuration file name}<br /><br />                                                                                                                                                                                                                                                                                                                                                                                                          |
| ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Example**   | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  wg-quick down wg-server<br />**\[root@**<font color="#EF4444">**rap**</font>**\~]#**  wg-quick up wg-server<br /><br />OR<br /><br />**\[root@**<font color="#6b7280">**connector**</font>**\~]#**  wg-quick down wg-client<br />**\[root@**<font color="#6b7280">**connector**</font>**\~]#**  wg-quick up wg-client<br /><br />OR<br /><br />**\[root@**<font color="#A855F7">**pam**</font>**\~]#**  wg-quick down wg-client<br />**\[root@**<font color="#A855F7">**pam**</font>**\~]#**  wg-quick up wg-client |

3\) Check the iptables rules on the Secure Remote Access Connector:

| **Linux CLI** | **\[root@**<font color="#6b7280">**connector**</font>**\~]#**  iptables -t nat -nvL   |
| ------------- | ------------------------------------------------------------------------------------- |

**You need to see at least one iptables rule.&#x20;**

:::hint{type="success"}
**SOLUTION: Add the iptables rules on the Secure Remote Access Connector/Kron PAM server manually.**
:::

| **Linux CLI** | **\[root@**<font color="#6b7280">**connector**</font>**\~]#**  iptables -t nat -A PREROUTING -p tcp --dport \{HTTPS port} -j DNAT --to-destination \{KronPAM server’s IP}:\{HTTPS port}<br />iptables -t nat -A POSTROUTING -p tcp -d \{KronPAM server’s IP} --dport \{HTTPS port} -j SNAT --to-source \{Secure Remote Access Connector’s IP}<br /> |
| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Example**   | **\[root@**<font color="#6b7280">**connector**</font>**\~]#**  iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination 10.20.42.129:443<br />iptables -t nat -A POSTROUTING -p tcp -d 10.20.42.129 --dport 443 -j SNAT --to-source 10.20.42.17<br />                                                                              |

4\) Check the status of the pam-rap.service on the Remote Access Portal (RAP) machine:

| **Linux CLI** | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  sudo systemctl status pam-rap.service<br /> |
| ------------- | ---------------------------------------------------------------------------------------------------- |

**If the pam-rap.service is not working, you need to start it again.**

:::hint{type="success"}
**SOLUTION: Restart pam-rap.service.**
:::

| **Linux CLI** | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  sudo systemctl restart pam-rap.service<br /> |
| ------------- | ----------------------------------------------------------------------------------------------------- |

5\) Check the port allowance at the server-level that is defined in the firewalld service:

| **Linux CLI** | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  sudo firewall-cmd --list-ports<br /><br />OR<br /><br />**\[root@**<font color="#6b7280">**connector**</font>**\~]#**  sudo firewall-cmd --list-ports<br /><br />OR<br /><br />**\[root@**<font color="#A855F7">**pam**</font>**\~]#**  sudo firewall-cmd --list-ports |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

:::hint{type="success"}
**SOLUTION: Stop the firewalld service, if it is not needed:**
:::

| **Linux CLI** | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  sudo systemctl stop firewalld<br /><br />OR<br /><br />**\[root@**<font color="#6b7280">**connector**</font>**\~]#**  sudo systemctl stop firewalld<br /><br />OR<br /><br />**\[root@**<font color="#A855F7">**pam**</font>**\~]#**  sudo systemctl stop firewalld |
| ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

6\) Check the ip routing configuration on the both Remote Access Portal (RAP) and Secure Remote Access Connector/Kron PAM server:

| **Linux CLI** | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  sysctl net.ipv4.ip\_forward<br />**\[root@**<font color="#6b7280">**connector**</font>**\~]#**  sysctl net.ipv4.ip\_forward |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |

**The result should be 1.**

:::hint{type="success"}
**SOLUTION: If it is 0 please enable ip routing by setting with 1:**
:::

| **Linux CLI** | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  sysctl -w net.ipv4.ip\_forward=1<br /><br />OR<br /><br />**\[root@**<font color="#6b7280">**connector**</font>**\~]#**  sysctl -w net.ipv4.ip\_forward=1<br /><br />OR <br /><br />**\[root@**<font color="#A855F7">**pam**</font>**\~]#**  sysctl -w net.ipv4.ip\_forward=1 |
| ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

7\)Check the SELinux security mode on the tenant connector:

| **Linux CLI** | **\[root\@rap\~]#**  getenforce<br /><br />OR<br /><br />**\[root\@connector\~]#**  getenforce<br /><br />OR<br /><br />**\[root\@pam\~]#**  getenforce |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |

**The result should be&#x20;*****permissive*****.**

:::hint{type="success"}
**SOLUTION\:If the result is Enforcing, please select permissive security mode with this command:**
:::

| **Linux CLI** | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  setenforce 0<br />**\[root@**<font color="#EF4444">**rap**</font>**\~]#**  setsebool -P httpd\_can\_network\_connect on<br />**\[root@**<font color="#EF4444">**rap**</font>**\~]#**  setsebool -P httpd\_can\_network\_connect 1<br /><br />OR<br /><br />**\[root@**<font color="#6b7280">**connector**</font>**\~]#**  setenforce 0<br />**\[root@**<font color="#6b7280">**connector**</font>**\~]#**  setsebool -P httpd\_can\_network\_connect on<br />**\[root@**<font color="#6b7280">**connector**</font>**\~]#**  setsebool -P httpd\_can\_network\_connect 1<br /><br />OR<br /><br />**\[root@**<font color="#A855F7">**pam**</font>**\~]#**  setenforce 0<br />**\[root@**<font color="#A855F7">**pam**</font>**\~]#**  setsebool -P httpd\_can\_network\_connect on<br />**\[root@**<font color="#A855F7">**pam**</font>**\~]#**  setsebool -P httpd\_can\_network\_connect 1 |
| ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

8\) Check the portal rights of the users, if the SSH/RDP session over Remote Access Portal (RAP) comes with blank or ***undefined\@undefined page:***

:::hint{type="success"}
**SOLUTION: Grant these portal rights to the users through user groups:**
single.connect.rdp.client.moduleVisibility
single.connect.cli.moduleVisibility
:::

9\) Check the nginx configuration file under /etc/nginx/nginx.conf on the Remote Access Portal (RAP):

| **Linux CLI** | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  cat /etc/nginx/nginx.conf<br />…<br />upstream backend \{<br />        server \{Secure Remote Access Connector’s Wireguard public IP}:443;<br />    }<br />…   |
| ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Example**   | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  cat /etc/nginx/nginx.conf<br />…<br />upstream backend \{<br />        server <font color="#6b7280">**10.0.0.2**</font>:443;<br />    }<br />…                 |

**Check the server info in the upstream backend section at the nginx.conf and check the activiness of the nginx.service.**

:::hint{type="success"}
**SOLUTION: If the nginx.service is not working, please restart it on Remote Access Portal (RAP) machine.**
:::

| **Linux CLI** | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  sudo systemctl restart nginx.service<br /> |
| ------------- | --------------------------------------------------------------------------------------------------- |

10\) Check whether that you use correct nginx configuration file under /etc/nginx/nginx.conf on the Remote Access Portal (RAP) machine. If the Remote Access link returns 404 HTTP error,  you need to check the nginx configuration file. The file should have these lines:

| **Linux CLI** | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  cat /etc/nginx/nginx.conf<br />…<br />#-------------------------------<br /># KronPAM - Internal redirections(frontend)<br />#-------------------------------<br />…<br />location /rap-ui/static \{<br />        proxy\_set\_header X-Forwarded-For $remote\_addr;<br />        real\_ip\_header   X-Forwarded-For;<br />        proxy\_pass       http\://127.0.0.1:7777/static;<br />}<br />…   |
| ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

:::hint{type="success"}
**SOLUTION: If these lines are not added yet, please add location /rap-ui/static \{ … block into nginx.conf file on the Remote Access Portal (RAP) machine, and save the file. After that, restart nginx.service (sudo systemctl restart nginx.service)**
:::

11\) If the Remote Access Portal links get the certificate error, please check whether the self-signed certificate and generic RSA private key are changed with **the** **customer’s own certificate and RSA private key**. The customer should remove the self-signed certificate and generic RSA private key on **/etc/nginx/certs** directory. After this, the customer should add the customer’s AWS certificate and RSA private key with the same names. Lastly, the customer should restart nginx service by using **sudo systemctl restart nginx.service** command.

**SOLUTION: If the customer has its own certificate and RSA private key, put these files under /etc/nginx/certs by using the names of cert.crt and cert.key. After that, restart nginx.service (sudo systemctl restart nginx.service)**

:::hint{type="success"}
**SOLUTION: If the customer has its own certificate and RSA private key, put these files under /etc/nginx/certs by using the names of cert.crt and cert.key. After that, restart nginx.service (sudo systemctl restart nginx.service)**
:::

12\) If you face this error: ***“RAP- REQUST NOT FOUND: request with id \{no} could not be found”*** on the Remote Access Portal GUI, please check the CORS configuration on the Kron PAM server (for both with connector and without connector options):

**SOLUTION: Add \{RAP URL} as a cors.allowed.origins parameter under /pam/gui/conf/web.xml.**

:::hint{type="success"}
**SOLUTION: Add \{RAP URL} as a cors.allowed.origins parameter under /pam/gui/conf/web.xml.**
:::

| **Linux CLI** | **\[root@**<font color="#A855F7">**pam**</font>**\~]#**  cat /pam/gui/conf/web.xml<br />/cors<br />…<br />\<param-name>**cors.allowed.origins**\</param-name><br />\<param-value> \{RAP URL} e.g., <br />**https\://remote.cloudpam.com**\</param-value><br />… |
| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

13\) Check the IP/Domain name information on both Remote Access Portal (RAP) and the Kron PAM.

**SOLUTION: Use the correct values in Remote Access Portal (RAP) and Kron PAM server.**

:::hint{type="success"}
**SOLUTION: Use the correct values in Remote Access Portal (RAP) and Kron PAM server.**
:::

**13.1) If the IP is used in the RAP links:**

*\*On the Remote Access Portal (RAP):*

| **Linux CLI** | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  vi /etc/hosts<br />\{private IP of the Remote Access Portal environment} \{public IP of the Remote Access Portal environment}  |
| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Example**   | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  vi /etc/hosts <br />**10.10.10.10 204.232.204.232**                                                                            |



| **Linux CLI** | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  vi /pam/remote-access-portal/conf/application.properties<br />sc.server=\{private IP of the Remote Access Portal environment} |
| ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Example**   | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  vi /pam/remote-access-portal/conf/application.properties<br />**sc.server=https\://10.10.10.10&#x20;**                        |

*\*On the Kron PAM Server:*

System Config Man-> rap.cloud.server = **\{public IP of the Remote Access Portal environment + /connect}**

Example= **https\://204.232.204.232/connect**

**13.2) If the Domain Name is used in the Secure Remote Access’ links:**

*\*On the Remote Access Portal (RAP):*

| **Linux CLI** | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  vi /etc/hosts<br />\{private IP of the Remote Access Portal environment} \{URL of the Remote Access Portal environment}  |
| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Example**   | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  vi /etc/hosts <br />**10.10.10.10 remote.testcloudpam.com**                                                              |



| **Linux CLI** | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  vi /pam/remote-access-portal/conf/application.properties<br />sc.server=\{URL of the Remote Access Portal environment} |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Example**   | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  vi /pam/remote-access-portal/conf/application.properties<br />**sc.server=https\://remote.testcloudpam.com**           |

*\*On the Kron PAM Server:*

System Config Man-> rap.cloud.server = **\{URL of the Remote Access Portal environment + /connect}**

Example= **https\://remote.testcloudpam.com/connect**

14\) Check the Remote Access Portal (RAP)’s service log under /pam/remote-access-portal/ on the Remote Access Portal (RAP).&#x20;

:::hint{type="success"}
**SOLUTION: Check the recent log lines to see if there are any errors.**
:::

| **Linux CLI** | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  tail -1000f    /pam/remote-access-portal/logs/application.log |
| ------------- | ---------------------------------------------------------------------------------------------------------------------- |

15\) Check whether the rap-0.0.1-SNAPSHOT.jar is downloaded to /pam/remote-access-portal/ on the Remote Access Portal (RAP) via the Remote Access Portal (RAP)’s installation script. If it is not downloaded, fixing NetworkManager might solve this issue.

:::hint{type="success"}
**SOLUTION: Configure DNS with nmtui command on the Remote Access Portal (RAP) machine to allow downloading the regarding jar file.**
:::

| **Linux CLI** | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  nmtui  <br /><br />\*\*\*Select eth0\*\*\*<br />\*\*\*EDIT\*\*\*<br />\*\*\*Change DNS as 8.8.8.8 and Save \*\*\*<br />**\[root@**<font color="#EF4444">**rap**</font>**\~]#**  sudo systemctl restart NetworkManager<br /> |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |

16\) Check the catalina.out and localhost\_access\_log.2025-XX-YY.txt under **/pam/gui/logs&#x20;**&#x6F;n the Kron PAM server during the session opened on the Remote Access Portal (RAP):

:::hint{type="success"}
**SOLUTION: Check the recent log lines to see if there are any errors.**
:::

| **Linux CLI** | **\[root@**<font color="#A855F7">**pam**</font>**\~]#**  tail -1000f /pam/gui/logs/catalina.out<br /> |
| ------------- | ----------------------------------------------------------------------------------------------------- |



| **Linux CLI** | **\[root@**<font color="#A855F7">**pam**</font>**\~]#**  tail -1000f /pam/gui/logs/localhost\_access\_log.\{YEAR-MONTH-DAY}.txt <br /> |
| ------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| **Example**   | **root@**<font color="#A855F7">**pam**</font>**\~]#**  tail -1000f /pam/gui/logs/localhost\_access\_log.2025-02-25.txt                 |

17\) If you get ***“Passcode is wrong”*** error on the Remote Access Portal (RAP) with the usage of 3.6.0 Kron PAM, the remote access jar file (rap-0.0.1-SNAPSHOT.jar) for 3.6.0 should be downloaded manually, because the Remote Access Portal script automatically downloads the latest jar file (for instance, for 3.7.0).&#x20;

:::hint{type="success"}
**SOLUTION: Download the rap-0.0.1-SNAPSHOT.jar for 3.6.0, if the Kron PAM server version is 3.6.0. Once this file is downloaded manually, it should be placed under /pam/remote-access-portal/. After that, change its ownership and mod by executing chown and chmod commands respectively, and in the last step you need to restart pam-rap.service.**
:::

| **Linux CLI** | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  \*\*\*Download rap-0.0.1-SNAPSHOT.jar file for 3.6.0 and place it under /pam/remote-access-portal\*\*\*<br /><br />**\[root@**<font color="#EF4444">**rap**</font>**\~]#**  chown pamuser\:pam-group /pam/remote-access-portal/rap-0.0.1-SNAPSHOT.jar<br /><br />**\[root@**<font color="#EF4444">**rap**</font>**\~]#**  chmod 755 /pam/remote-access-portal/rap-0.0.1-SNAPSHOT.jar<br /><br />**\[root@**<font color="#EF4444">**rap**</font>**\~]#**  systemctl restart pam-rap.service |
| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

18\) ***LASTLY, please ask the customer to check their firewall at the network-level.*** You can understand whether the firewall at the network-level blocks the secure tunnel messaging by executing the **sudo wg show** command and checking its result (if the transfer line has **“0B received, 0B sent”**, the firewall at the network-level blocks the messages through the Wireguard port):

| **Linux CLI** | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  sudo wg show<br />interface: wg-server<br />public key:  BBBBBBTqwb8QxlgG0c+RFlol/2eRATmwT7hI/wzjP14=<br />private key: (hidden)<br />listening port: 50044<br /><br />peer:  DDDDDD9+EPCYlO4RxDaJ6WqPLLK9zVp691BkvZIP/jU=<br />allowed ips: <font color="#6b7280">**10.0.0.2**</font>/32 \*\*\* OR <font color="#A855F7">**10.0.0.2**</font>/32 \*\*\*<br />**transfer: 0 B received, 0 B sent**<br />persistent keepalive: every 25 seconds<br /><br />OR<br /><br />**\[root@**<font color="#6b7280">**connector**</font>**\~]#**  sudo wg show<br />interface: wg-client<br />public key:  DDDDDD9+EPCYlO4RxDaJ6WqPLLK9zVp691BkvZIP/jU=<br />private key: (hidden)<br />listening port: 50044<br /><br />peer:  BBBBBBTqwb8QxlgG0c+RFlol/2eRATmwT7hI/wzjP14=<br />endpoint: 10.10.10.10:50044<br />allowed ips: <font color="#EF4444">**10.0.0.1**</font>/32<br />**transfer: 0 B received, 0 B sent**<br />persistent keepalive: every 25 seconds<br /><br />OR<br /><br />**\[root@**<font color="#A855F7">**pam**</font>**\~]#**    sudo wg show<br />interface: wg-client<br />public key:    DDDDDD9+EPCYlO4RxDaJ6WqPLLK9zVp691BkvZIP/jU=<br />private key: (hidden)<br />listening port: 50044<br /><br />peer:    BBBBBBTqwb8QxlgG0c+RFlol/2eRATmwT7hI/wzjP14=<br />endpoint: 10.10.10.10:50044<br />allowed ips: <font color="#EF4444">**10.0.0.1**</font>/32<br />**transfer: 0 B received, 0 B sent**<br />persistent keepalive: every 25 seconds<br /> |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |

You can also use tcpdump and send the test message to check the firewall at the network level.

| **Linux CLI** | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  tcpdump -i any port \{Wireguard port} -v<br /><br />**\[root@**<font color="#6b7280">**connector**</font>**\~]#**  echo "test packet" \| nc -u \{Remote Access Portal’s Wireguard public IP} \{Wireguard port}<br /><br />OR<br /><br />**\[root@**<font color="#A855F7">**pam**</font>**\~]#**    echo "test packet" \| nc -u \{Remote Access Portal’s Wireguard public IP} \{Wireguard port}<br /> |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Example**   | **\[root@**<font color="#EF4444">**rap**</font>**\~]#**  tcpdump -i any port 50044 -v<br /><br />**\[root@**<font color="#6b7280">**connector**</font>**\~]#**  echo "test packet" \| nc -u <font color="#EF4444">**10.0.0.1**</font> 50044<br /><br />OR <br /><br />**\[root@**<font color="#A855F7">**pam**</font>**\~]#**    echo "test packet" \| nc -u <font color="#EF4444">**10.0.0.1**</font> 50044<br />                                            |

:::hint{type="success"}
**SOLUTION: If the transfer line has “0B received, 0B sent” after sudo wg show, please ask customer to allow the neccessary ports on the Remote Access Portal (RAP) environment:**

**\*443/TCP,&#x20;**&#xA;**\*7777/TCP,&#x20;**&#xA;**\*7777/UDP&#x20;**

**\*\{selected-Wireguard-port(e.g., 51820)}/UDP.**
:::