Read what conflux says, then do what it names

Reading conflux status

Start here. sudo conflux status prints conflux's own state and anchorctl status beneath it. Conflux decides the mode, the taints it asked for, the IPv4, the subnets, the proxies, the exits, the medium, where the files live and when to renew. The anchor underneath decides everything else: every packet, every route, every credential check.

$ sudo conflux status
conflux 1.0.0-pre (f47de0fac83d24489664ca15fc6a317ac9c9f683) linux/amd64

  service      active (systemd: conflux.service, enabled at boot)
  mode         tun — interface anchor0
  taint        brhk-2mq9-tzva-6pjs-k4xe-nw7d-qf
  ipv4         10.128.0.1/24
  anchor       anchor6btpa3gn6w4stipba4hekzho7caw6srfyy5puvbz7mfanaiept5a
  credential   valid until 2026-10-06T06:35:43Z (8d 4h)
  renewal      failing since 2026-09-26T08:10:00Z: dial tcp: no route to host
  api          https://api.veilnet.com.au
  telemetry    none — nothing is exported until an endpoint is set

The DATA column

sudo conflux peers lists each peer the anchor knows, and its DATA column says whether the two may exchange data. It is the first thing to check when two machines are up and cannot see each other, after giving them a minute: peers find each other by gossip, in fifteen to sixty seconds.

$ sudo conflux peers
ANCHOR      OVERLAY                                  IPV4        HARDWARE           STATE      CONN     DATA  REACH     RTT
i46dpakhug  fd80:c4b9:99ae:df9b:5261:d178:18f1:783c  10.128.0.2  ae:70:60:82:85:68  connected  out*,in  yes   nat-cone  990µs
s5g3oefl2s  fd80:c4b9:99ae:a015:58f1:5b6e:b140:5e8e  -           5a:f0:a9:da:4e:32  connected  out      no    unknown   1.2ms

• DATA no on a peer that should be reachable is taint separation, working as designed. Two anchors exchange data only if one carries every taint the other does, so {office,laptop} and {office,desktop} cannot talk. Compare both machines' taint lines character for character. A credential's taints never change, so a machine enrolled in the wrong one needs a new identity: sudo conflux uninstall --yes, then sudo conflux up --taint with the right one. A member's Taints order may also have moved one of them, which status does not show.
• DATA no on every peer can also mean this machine is blocked. A block leaves the anchor running, outside its realm, and every member treats it as an outsider. sudo conflux blocks on another member lists the blocks in force, and nothing on this machine needs doing once it is lifted.
• A peer that is not listed at all has not been seen yet. If one machine has no peers, it has not reached the bootstrap node, which is a network problem rather than a conflux one.
• A peer that is connected, shows DATA yes and an RTT, while every ping times out, is the host's routing table: nothing sends overlay addresses to the overlay interface. Check with ip route on Linux, netstat -rn on macOS or route print on Windows. anchor installs those routes itself, so one routed elsewhere is worth reporting to anchor with that output.

EXPIRED

credential EXPIRED means renewal has been failing for longer than the credential had left, and the renewal line beneath it names the last error. A running anchor stays up with every handshake refused. A restarted one does not start at all, since anchor will not build an anchor on an expired credential, so the supervisor keeps retrying with a backoff up to thirty seconds, renewing first each time.

It recovers on its own once a renewal gets through. The renewal route works after expiry, so a machine that was off for a month renews on its next start and keeps its AnchorID and its address. Conflux never re-enrols to work around a failed renewal, because that would draw a new identity and orphan every peer. The exception is a fixed-term credential, which names nowhere to renew: once it has expired it has to be replaced, and the unit shows as failed until it is.

Errors and what they mean

The messages below are quoted as conflux prints them, with … where it names the value at fault. Most go on to say what to type next.

Uplink

On a machine with an uplink, conflux status shows the link and no underlay address. That is correct and not the fault: an anchor on a cable advertises no way to be reached, because a cable has none. When such a machine is up and reaches nothing, check in this order.

• Both ends are on the link. One link carries one peer, and both ends have to be brought up with --uplink; an anchor on a socket and one on a cable have no medium in common.
• The line speed is set, and matches, on both ends. A device opened without a speed is left as it is, so one configured elsewhere at 9600 stays there. /dev/ttyUSB0:115200 sets it. A handshake is twenty to thirty kilobytes, comfortable at 115200 and marginal at 9600 against a sixty-second idle timeout.
• The machine was ever enrolled. Enrolment is an HTTPS call the link cannot carry, and one that has only seen the cable says credential none — nothing enrolled yet. Bring it up once where it has the internet.
• The credential has not lapsed. Renewal needs the same API, so a machine permanently on a cable stops being admitted thirty days after its last renewal, and status says credential EXPIRED.

A link that ends is reopened

anchor does not reopen a device, so conflux watches it. A device that leaves the filesystem is acted on at once, and a link that has carried nothing for ninety seconds is treated as ended. Either way the anchor is rebuilt on it, with the identity unchanged, and repeated failures back off from one second to thirty. Status keeps the tally, because the anchor's own uptime resets on every reopen:

$ sudo conflux status
  uplink       7 reopens, last 2026-09-08T11:04:12Z

Seven reopens is a cable, a connector or a far end at fault, which conflux is papering over rather than fixing. A link that keeps reopening and never stays up usually has a far end that is not running: an idle link whose far end is switched off looks exactly like a dead one, and is restarted on the same ninety-second grace. The grace is that long because an anchor holding no connection redials every five seconds or so, a dial that never answers takes its whole 45-second timeout, and a handshake on the slowest line conflux accepts takes about 25. To force a reopen by hand, run sudo conflux start.

Windows

• Every command that changes the machine needs an elevated PowerShell, and says … needs Administrator without one.
• conflux up needs wintun.dll, which conflux fetches the first time a TUN machine needs it and again at any start that finds it missing, after an upgrade say. Offline, it says what to do by hand, and names the way round it.

conflux: a network interface on Windows needs wintun.dll, and it could not be fetched: …

  Download wintun-0.14.1.zip from https://www.wintun.net and put
  bin\amd64\wintun.dll at:
    C:\ProgramData\conflux\bin\998ece52739a7c74\wintun.dll

  Or run "conflux proxy PORT=BACKEND", which needs no interface at all

• The archive is checked against a pinned SHA-256, and a mismatch aborts, printing both digests. Userspace mode needs no driver, so on a machine where Wintun cannot be installed, conflux proxy is a complete way to use the overlay.
• When the extracted binaries will not run, conflux names endpoint protection as the likely cause. Compare the digests conflux version prints with the release notes, and if an exclusion is needed, the directory is %ProgramData%\conflux\bin.
• Conflux gives %ProgramData%\conflux to SYSTEM and Administrators, and refuses a directory another account made there first, saying which. Remove it and run the command again as Administrator.
• --uplink is refused: anchor has no way to open a link on Windows.
• The service is conflux, displayed as VeilNet Conflux, and has no console, so it writes what it and anchord say to %ProgramData%\conflux\logs\conflux.log.

Service and logs

A start that times out names the right one for the machine. When the service starts and the anchor does not, stop the service and run the supervisor in the foreground. anchord's own lines are prefixed anchord:, so its reason for a refusal is printed in its own words.

$ sudo systemctl stop conflux
$ sudo conflux serve --foreground

How the supervisor restarts

• A failed start is retried with a backoff up to thirty seconds, which is what lets a --subnet whose interface is not up yet come right at boot.
• What no retry changes stops the supervisor after three attempts, with exit 70: a configuration or manifest conflux refuses, taints the credential does not grant among them, a credential expired with nowhere to renew it, one for a realm tree other than the one these binaries are pinned to, a TUN the host will not give, a host that will not be set up to forward, and an argument anchorctl refuses. Nothing to start at all is exit 78. systemd and Windows leave the service down on either, and launchd starts it again after its throttle interval.
• Anything else it stops on, such as an extraction onto a full disk, exits 1, which a service manager restarts.
• While it runs, it asks the daemon every thirty seconds whether it still holds an anchor, every ten through the link watcher on an uplink, and rebuilds it if not. A rebuild refused for good three times in a row, as after a conflux.json edited into one that will not build, makes the watcher give up and say so in the log. The service stays up holding no anchor until sudo conflux start or a reboot.
• A blocked anchor is not rebuilt. A block leaves it running, outside its realm, and rebuilding it would change nothing.

Clock skew

Three separate things break on a bad clock, and only one of them says so.

• A credential starts at the moment its issuer signs it, and anchor refuses one that starts more than ten minutes after its own clock says now. A machine ten minutes slow cannot start on a credential it has just been issued or renewed, and the refusal names the credential rather than the clock.
• anchor's handshake tag rotates hourly and a peer accepts one epoch either side, so two machines two hours apart cannot connect at all. The symptom is a TLS alert that looks exactly like a wrong realm.
• A clock weeks fast makes a current credential look expired, and one a year slow makes an expired one look fine.

So conflux compares the API's Date header with the local clock on every call, records the skew, and refuses to bring a machine up when it exceeds ten minutes, anchor's own allowance and the tightest of the three, naming NTP. The measurement is taken on the calls that reach the API, enrolling and renewing. A start whose credential is current makes none, unless the last measurement was over the limit, in which case it renews to measure again rather than trust a figure from before the clock was fixed. conflux status prints the last skew when it is more than a second.

$ sudo timedatectl set-ntp true
$ sudo conflux start