AstroWarp Resources Unreachable: Virtual IPs, Permissions, and the GL.iNet Fix
Why the tunnel works but the resources don’t
The AstroWarp connection itself is clearly up — you can reach the home router’s admin panel remotely, the external IP matches, traffic is flowing. So why do the shared resources at 10.0.1.1 and 10.0.1.2 time out completely?
Two things, usually working together. First, AstroWarp does not expose LAN devices by their local IP addresses — it assigns each resource a dedicated virtual IP, and that is what remote nodes are meant to connect to. Second, AstroWarp has two separate permission layers, and most people accidentally enable only one of them.
The virtual IP problem
When you add a device as a resource in the AstroWarp topology map, the platform automatically allocates a virtual IP for that resource. That virtual IP is the address remote nodes actually route to. It exists specifically to sidestep subnet conflicts and survive DHCP reassignments on the home LAN.
The trap is exactly what the original post describes: DNS resolves a hostname to 10.0.1.2, which is perfectly correct on the home network, but from the travel router that address is unreachable. AstroWarp does not advertise the home router’s entire 10.0.1.0/24 subnet by default. It exposes each added resource through its own virtual IP instead.
Finding the virtual IP is easy. Open the AstroWarp topology map, click the resource node, and the allocated address appears right there next to the resource name. That is the address you test with first — ping it, open it in a browser, whatever fits the service. If that works, update your DNS records to point to virtual IPs rather than the raw LAN addresses.
The two-layer permission system
AstroWarp controls access through two separate toggles. Both have to be on, and they live in the same place: the connection line between two nodes in the topology map.
- Node access — lets the travel router node communicate with the home router node at all. Without this, nothing works.
- Resource access — grants the travel router node permission to reach the specific resources you have added to the home router node. This is a separate switch, and it starts off by default.
This two-layer design explains the exact symptom in the original post precisely. The router’s admin panel lives on the router itself, so node access alone is enough to reach it. Resources behind the router — the 10.0.1.x devices — need resource access enabled on top of that. One toggle active, one missed, and the admin panel responds while every resource times out.
Click the line between the home router node and the travel router node. Check both switches. If you need bidirectional resource access, confirm both directions are enabled, not just one side.
Step-by-step fix
- Open AstroWarp and go to the topology map.
- Click the connection line between your travel router and your home router.
- Verify that both node access and resource access are toggled on — in both directions if needed.
- Click each resource node and note the virtual IP assigned to it.
- Test connectivity to that virtual IP directly:
ping <virtual-ip>from the travel router side. - If it responds, update your DNS records so hostnames resolve to the virtual IPs rather than the 10.0.1.x addresses.
Firewall on the target device
Permissions correct, virtual IP in use, still timing out? Check the firewall on the target device itself. AstroWarp traffic arrives from an address the device has never seen before, and host-level firewalls often block it silently.
On Linux, inspect iptables -L or ufw status. On Windows, the built-in firewall blocks inbound ICMP from non-local ranges by default. A fast diagnostic: temporarily disable the firewall on the target machine and retry the ping. If it suddenly works, add an inbound rule permitting traffic from the AstroWarp virtual IP range and re-enable the firewall.
DNS and AstroWarp’s private DNS feature
Manually keeping DNS records in sync with virtual IPs gets old fast. AstroWarp includes a private DNS feature that resolves hostnames across the network automatically, always handing back the correct virtual IP without you touching a record. If you have resources with meaningful hostnames, migrating to private DNS is cleaner than maintaining parallel DNS entries.
One known edge case: on Android, if system-level private DNS (DNS-over-TLS) is active at the OS level, the internet exit feature can break. That is worth knowing if you are also using the home router as an exit node for outbound traffic.
Quick reference checklist
- Using the virtual IP (from the topology map), not 10.0.1.x, for remote connections
- Both node access and resource access enabled on the connection line
- Permissions confirmed in both directions
- Host firewall on the target device allows inbound traffic from the AstroWarp IP range
- DNS records updated to virtual IPs if using hostnames
Sources
