Identify the failing stage
A successful download means the website created a configuration. It does not test connectivity from your device to the endpoint. A successful import is not proof that the client supports every option or routes every application through the tunnel.
| Symptom | Investigate |
|---|---|
| No file returned | Website error, rate limit or upstream registration |
| Client rejects the file | Format and protocol support |
| No recent handshake | Endpoint, network and protocol |
| Handshake, but sites fail | DNS, routes and application proxy settings |
| Large transfers stall | MTU and network conditions |
If the generator returns an error
For a rate-limit response, wait before retrying. Repeatedly pressing Generate does not fix the underlying cause. An upstream error means the site could not complete registration with Cloudflare; it does not mean that your installed VPN client needs reinstalling.
If a file downloads in a normal browser but not inside Telegram or another embedded browser, use the normal browser. For a useful error report, note the time, format and visible error. Do not publish the configuration, private keys or a screenshot of an open QR code.
If there is no recent handshake
Keep a baseline profile: a client-compatible protocol, All sites, default endpoint and no unnecessary custom options. Preserve a working profile while testing another.
- Read the first client error. Unknown fields suggest a format/core mismatch; reimporting the same profile will not add support.
- Compare with another active VPN or proxy temporarily stopped. Restore it after the test if needed.
- Try the same profile on another available network, such as Wi-Fi versus mobile data. A different result helps isolate network-specific conditions.
- Try another endpoint suitable for the protocol. WireGuard and MASQUE use different endpoint handling: do not transfer ports blindly.
- If a previously working profile stops connecting, inspect client updates and current network conditions. New keys alone cannot repair an unreachable endpoint.
If the tunnel connects but sites fail
Determine whether every site fails or just one service. Specific sites relies on IP ranges, which can become incomplete as service addresses change. Compare All sites, then restore your intended routing mode.
For name-resolution errors, compare a known DNS provider and inspect the exported DNS field. If small requests work but large transfers hang, return MTU to 1280 and change one setting at a time. In Clash, check the selected proxy and whether the affected application uses system proxy or TUN.
Cloudflare’s official-client troubleshooting guide is background reading, not a command reference for every third-party client. Use your app’s own logs and instructions. These checks can isolate a cause; they cannot guarantee connectivity on every network.
Official references
Client interfaces can change. Check menu actions and protocol support against the documentation for your installed app.