Diagnose Proxyble Problems

Start diagnostics with read-only status and log checks. Do not reset rules, clear allow-lists, or change listener mode until you understand the affected traffic and have a rollback plan.

A service does not start

Check Proxyble’s summary, configuration, and the latest service output:

sudo proxyble --config-status
sudo proxyble --config-view
sudo proxyble --verbose --config-start
sudo journalctl -u haproxy.service -n 50 --no-pager
sudo journalctl -u nftables.service -n 50 --no-pager

Confirm that the listener port is available, the selected mode matches your TLS design, and the configured backend is not bound to the same loopback port as the listener.

Traffic does not reach the backend

Verify the listener mode, public port, primary backend host, and backend port in sudo proxyble --config-view. Then make a normal request to the listener and inspect both the backend logs and journalctl -u haproxy.service.

For HTTPS pass-through, use TCP mode. For endpoint-based enforcement, use HTTP mode or HTTPS mode with TLS termination so Proxyble can inspect HTTP paths.

A manual rule does not appear to apply

Check the source against active rules and inspect rule-agent activity:

sudo proxyble --rules-check --ip 203.0.113.25
sudo journalctl -u proxyble-rule-agent.service -n 50 --no-pager
sudo ls -lt /var/log/proxyble-rule-agent

Confirm the action is compatible with the listener mode. For example, LIMIT_ENDPOINT_RATE requires HTTP visibility, while connection-rate rules work in TCP mode.

A policy does not trigger

Confirm that RioDB is installed and healthy, the policy is deployed, and the listener mode exposes the signals the policy needs:

sudo proxyble --policies-list
sudo journalctl -u riodb.service -n 50 --no-pager
sudo journalctl -u proxyble-rule-agent.service -n 50 --no-pager

Policies evaluate traffic patterns, not isolated requests. Use representative, controlled traffic and review the policy’s intended conditions before treating a lack of enforcement as a failure.

Access was unexpectedly denied

Check whether a Basic or Endpoint allow-list was enabled. Basic allow-lists affect the entire Proxyble listener, while endpoint allow-lists apply only to selected HTTP path prefixes. Review Allow-Lists before removing entries, especially on remote hosts where you could remove your own access.

Need more detail?

Use Logs and Audit for component-specific log locations and the complete upstream Proxyble user guide for the current command reference.