# Can't connect > Every message Fregata Mobile shows when it can't reach your NVR — refused connections, names that don't resolve, timeouts, HTTPS and certificate problems, client certificates, wrong passwords, proxies, Cloudflare Access and sign-in limits — what each means and how to fix it. When the app can't reach your server, it says why in one sentence: under **Connect** in the welcome walkthrough, under each address after **Test connection** in **Settings › Connection**, and on the screens that need the server. Each sentence points at a different cause. **Test connection** is the quickest check: it signs in, then asks each address for its version, and shows the result under each. **Now**, above the addresses, shows which one the app is using. | The app says | What it means | What to do | |---|---|---| | **Connected. Frigate 0.17.1.** | It works. | — | | **This iPhone says it has no network. If it does, check for a VPN or Zero Trust app holding the connection, or Cellular Data turned off for Fregata Mobile in Settings.** | iOS says the iPhone is offline. A VPN or Zero Trust app, or **Cellular Data** turned off for the app, makes it say that too. | Check the iPhone's connection. If Safari works, look at any VPN or Zero Trust app on the iPhone, and at **Settings › Apps › Fregata Mobile › Cellular Data**. | | **Reached it, but the connection was dropped before an answer came back. Usually a proxy or security service in front of Frigate turning the request away.** | Something answered, then hung up before replying. | Check what stands in front of Frigate. Behind Cloudflare Access, see [below](https://mobile.fregata.app/docs/troubleshooting/connection/#behind-cloudflare-access). | | **No answer before the timeout. Right address, wrong network, or the server is down.** | Nothing answered. Most often, a home address tried away from home. | Away from home, use your **Away** address. At home, check the server is on. | | **That name does not resolve. Check the spelling, or use the IP address.** | The name in the address doesn't exist on this network. | Check the spelling, or use the server's IP address. A `.local` name may only work on your home Wi-Fi. | | **Refused the connection. Something is at that address but nothing is listening on that port.** | The machine is there, but not Frigate on that port. | Check the port: Frigate's signed-in port is 8971. | | **That address needs https://, not http://. Everything else about it is right.** | Frigate's port 8971 only speaks HTTPS. | Change `http://` to `https://`. | | **The secure connection failed. Usually a self signed certificate, or the wrong port for HTTPS.** | The HTTPS handshake failed. | Check the port, and that the address really serves HTTPS. | | **The server asked for a client certificate. Import one under Advanced, below the server's address.** | A proxy in front of Frigate only lets in devices with a client certificate (mutual TLS), and this server has none in the app. | Import one under **Advanced**. See [Client certificate](https://mobile.fregata.app/docs/getting-started/connect/#client-certificate). | | **The server closed the connection after this device sent its client certificate. Check it is the one your proxy expects, and that it has not expired.** | The proxy was sent the certificate set for this server, then hung up. Usually it doesn't accept that certificate. | Check the date under **Client certificate** in **Advanced**, and that the proxy trusts whoever issued it. If it's the wrong one, tap **Replace client certificate**. | | **Answered with a certificate this iPhone has not been asked to trust yet.** | A self-signed certificate on an address that isn't on your home network. | Answer the certificate question. See [Certificate questions](https://mobile.fregata.app/docs/troubleshooting/certificates/). | | **Answered, but rejected the sign in. Check the username and password.** | Wrong username or password. | Re-enter them. They're the ones for Frigate's web interface. | | **Refused for a moment: too many sign-ins in a short time. It will clear on its own.** | Frigate is limiting sign-ins after several failed ones. | Wait a minute, then try once more with the right password. | | **Answered with HTTP 404, which is not Frigate. Check the address and any proxy in front of it.** | Something answered, but not Frigate. | Check the address, and that a reverse proxy sends it to Frigate. | | **Connected, but the reply was not something this app could read.** | Usually a login page or proxy in front of Frigate. | Add the [custom headers](https://mobile.fregata.app/docs/getting-started/connect/#custom-headers) it needs, or use a VPN. | | **Could not reach it. Check the address in Settings, or try again in a moment.** | Anything else. | Check the address, then try again. | ## Works at home, not away That's an address problem, not an app problem: your home address only works on your home network. Add an **Away** address that reaches the server from anywhere, such as a Tailscale address or a domain of your own. See [Away from home](https://mobile.fregata.app/docs/getting-started/remote-access/). ## Behind Cloudflare Access Cloudflare Access turns away every request without a service token it accepts, before Frigate sees it. Depending on how it turns one away, **Test connection** says the connection was dropped, that the reply was not something the app could read, or that the sign-in was rejected. Check, in this order: - **Both headers are there**: `CF-Access-Client-Id` and `CF-Access-Client-Secret`, under **Advanced**, with the names spelled exactly and the values pasted whole. See [Cloudflare Access](https://mobile.fregata.app/docs/getting-started/remote-access/#cloudflare-access). - **The policy uses Service Auth**: the Access application needs a policy with the **Service Auth** action that includes the token. With an **Allow** policy, Cloudflare ignores the token and asks for its own sign-in, which the app can't fill in. - **The token is current**: service tokens expire, and a token that has been renewed or deleted in Cloudflare stops working in the app. - **Nothing on the iPhone is in the way**: a Zero Trust app such as Cloudflare One routes the app's traffic through its own rules. If the app says the iPhone has no network while Safari works, turn it off for a moment and try again. - **The address is the Access address**: the hostname your Access application protects, with `https://` and no port, under **Away** (or **At home**, if it's the only one). ## Worked yesterday, not today - **The password changed**: update it in **Settings › Connection**. - **The certificate changed**: the app asks before trusting a new one. See [Certificate questions](https://mobile.fregata.app/docs/troubleshooting/certificates/). - **The server's address changed**: a new IP address from your router. Give the server a fixed address in your router, and update **At home**. - **The server is down**: **Settings › Server Status** says **Not responding**.