WireGuard VPN Manager

    Please i need help,

    I configured my config file (Proton VPN), but when I import and start the service manager, I get this error message: "error <general>: service.wireguard.manager v1.4.9: VPN Connector: VPN connection, handshake failed. Handshake failed. Refused, rate-limited, or unreachable."

    I can't seem to find where the problem is.

    ;(

    Quote from Brun0

    Please i need help,

    I configured my config file (Proton VPN), but when I import and start the service manager, I get this error message: "error <general>: service.wireguard.manager v1.4.9: VPN Connector: VPN connection, handshake failed. Handshake failed. Refused, rate-limited, or unreachable."

    I can't seem to find where the problem is.

    ;(

    Provide the wireguard config file(s) please no privatekey. Did you read https://github.com/BrodjagaRatnik…via-Custom-Mode

    Set kodi in debug logging and copy/paste this in ssh:

    Shell session
    grep -i "service.wireguard.manager" /storage/.kodi/temp/kodi.log | pastebinit

    Or provide a full debug log.

    How to post a log (wiki)

    1. Enable debugging in Settings>System Settings>Logging
    2. Restart Kodi
    3. Replicate the problem
    4. Generate a log URL (do not post/upload logs to the forum)

    use "Settings > LibreELEC > System > Paste system logs" or run "pastekodi" over SSH, then post the URL link

    Good morning,

    Great, it works; my mistake was using my PC's 192... address as the host. However, I'm now having trouble streaming French TV channels (getting error 422 or geolocation issues). Is it possible to disable the VPN for specific add-ons?

    I've attached the logs for the add-ons that are throwing errors. Thanks in advance.

    https://paste.libreelec.tv/multichannelled-garret.log

    https://paste.libreelec.tv/rollable-sherice.log

    https://paste.libreelec.tv/predependent-esther.log

    I see in your rollable-sherice log:
    requests.exceptions.HTTPError: 422 Client Error: Unprocessable Entity for url: https://k7.ftven.fr/videos/006194e…a9-153d999c59ae?country_code=NL&capabilities=drm&os=androidtv&diffusion_mode=tunnel_first&offline=false

    You either not connected to a French VPN server or the video plugin uses cache and NL is in the cache (so remove cache from that addon). For mapping video plugin -> VPN-country you do not have to use it you can also do:

    1. Connect to the desired VPN country server.
    2. Start/stream the addon.

    🗺 4. VPN Mapping (The Priority System)

    This automated tool pairs specific VPN locations directly to individual Kodi video add-ons. If you do not pair your chosen add-on app to a specific server location no connection will be made.

    Salute.

    Hello, I configured the VPN mapping priority and it works very well, the problem is that when I switch add-ons, certain things persist (for example, the command `curl ifconfig.co` returns `curl: (6) Could not resolve host: ifconfig.co`), so I cannot access the TV channels. I cannot provide the new error logs because the `pastebinit` path isn't working; perhaps I need to configure `resolv.conf`? Thanks for your time.

    The Could not resolve host: ifconfig.co error confirms that your system is experiencing a DNS deadlock after switching add-ons, meaning LibreELEC's network manager (ConnMan) is failing to restore your local router's DNS servers.

    Since this issue does not occur for other users, it is likely caused by a local configuration conflict or a static IP setup on your device.

    To fix this and get your TV channels back immediately without rebooting, you can manually force a working DNS server via SSH using ConnMan. Please follow these steps:

    1. Connect to your LibreELEC device via SSH.

    2. Run the following command to find your active network service ID:

    Shell session
      connmanctl services

    (Look for the line starting with *AO or *AR which represents your active Ethernet or Wi-Fi connection. Copy the long ID string at the end of that line, it will look like ethernet_b0d5cc... or wifi_2ccf67...)

    3. Run this command to force assign public DNS servers to your connection (replace <your_service_id> with the ID you just copied):

    Shell session
      connmanctl config <your_service_id> --nameservers 1.1.1.1,8.8.8.8

    Once executed, your internet connectivity, TV channels, and the pastebinit log uploader should work instantly.

    A quick question to help prevent this from happening again: Do you have a manual/static IP address configured in your LibreELEC network settings, or do you use any other VPN/IPTV management add-ons on this system?

    Edited once, last by Doemela (July 24, 2026 at 2:20 PM).

    You're right, for my tests I'm using the .ova version of LibreELEC, but it causes a lot of network problems with VMware, especially the bridge which generates unknown IPs, so I hard-coded an address. Anyway, following your message, I tested it on my home setup and it works perfectly there. Thanks again for your help and congratulations again on your add-on.

    Brun0

    I have built a specific test build to automate this fix directly inside the add-on logic. This will proactively catch and repair the ConnMan DNS deadlock on your system during execution.

    You can download and install the update from here: service.wireguard.manager-1.5.1~beta.zip

    What this update does:
    Every time a VPN disconnection occurs, the manager now performs an internal DNS deadlock. If it detects that ConnMan has left your network in an unresolvable state (triggering the ifconfig.co error), it automatically triggers a fallback routine to flush the stale cache and force ConnMan to dynamically pull your local router's original DNS settings via DHCP. If a static IP is set, the script only clears the manual DNS block, causing ConnMan to immediately fall back to the manual DNS entered in LibreELEC, without affecting the static IP configuration.

    Please install this beta build, test your add-on switching workflow, and let me know if your TV channels and the pastebinit log uploader function correctly without any manual terminal commands.

    Salute.

    Edited once, last by Doemela (July 24, 2026 at 6:50 PM).

    Thank you so much for testing the beta build and sharing the logs!

    I can see from the entries that the connection teardown and the dynamic DNS recycling are now working flawlessly. The stream links (pvr.iptvsimple) are resolving instantly and cleanly right after the tunnel closes without hitting any deadlocks.

    The fix is officially successful! Thank you again for your time, and have a wonderful weekend as well!

    Hello Doemela, I hope you're doing well.

    I'm getting back to you because I've noticed some strange errors since last time.

    1) The VPN works intermittently—sometimes it connects, sometimes it doesn't (showing a "Handshake failed" error).

    2) When it crashes, it generates a new address, but I can't connect to it via SSH; I have to disable the network to get my original address back.

    3) At other times, when it crashes, it creates a "vpn_blackout_active.lock" file. I have to use SSH to delete it because otherwise, I lose access to the mediacenter even after a reboot and it also blocks the TV channels.

    I've attached the latest logs. Best regards,

    https://paste.libreelec.tv/unfavorite-candance.log

    https://paste.libreelec.tv/gymnospermic-jadwiga.log

    Hello Brun0 ,

    Because you are running on a non-Raspberry Pi wireless setup, your hardware requires slightly more time to cleanly tear down existing connection profiles when switching locations. Because the connection processing occasionally takes slightly longer than the hard-coded limits of the previous build, it caused a timeout crash. This left a stale .lock state file behind, which blocked your TV channels (PVR) and locked down your local routing parameters (disrupting SSH/Samba access).

    Please install the updated script modules https://github.com/BrodjagaRatnik…-1.5.2~RC.3.zip and let me know if everything is running smoothly!

    Best regards, Doemela.

    Quote from Reddirt

    Maybe try the latest version 1.5.2~rc

    Reddirt You beat moi :P you can also test https://github.com/BrodjagaRatnik…-1.5.2~RC.3.zip specially on that I7.

    v1.5.2 (2026-08-0?)
    - Fixed: Resolved an exit status 22 argument error on Wi-Fi profile swaps.
    - Fixed: Prevented system lockouts and file tracking freezes on slower hardware tiers.
    - Optimized: Maintained local subnets and gateway paths to guarantee uninterrupted SSH/Samba access.
    - Fixed: Resolved an exception routing conflict where upstream HTTP 429 server blocks returned empty token responses.
    - Fixed: Resolved an issue causing the exception tree to misinterpret events and erroneously trigger the 401 alert window.
    - Optimized: Implemented dynamic file state inspection within the token verification routine to accurately isolate locks.
    - Optimized: Prioritized system rate-limiting locks over authentication validation screens during active profile swaps.

    Salute.

    Edited 2 times, last by Doemela: Merged a post created by Doemela into this post. (July 31, 2026 at 9:41 PM).