# Creating circuit error: how to understand it?

**URL:** <https://openziti.discourse.group/t/creating-circuit-error-how-to-understand-it/4968>\
**Category:** zrok\
**Created:** [August 7, 2025, 10:24pm UTC](https://openziti.discourse.group/t/creating-circuit-error-how-to-understand-it/4968 "2025-08-07T22:24:00Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\
**Post date:** [August 7, 2025, 10:24pm UTC](https://openziti.discourse.group/t/creating-circuit-error-how-to-understand-it/4968/1 "2025-08-07T22:24:00Z")

</div>

I am not sure about what is happening on routers.

I would say zrok tcptunnel does not work.

```auto
{
  "_context": "ch{edge}->u{classic}->i{zID/2xmp}",
  "chSeq": 7,
  "connId": 1,
  "edgeSeq": 0,
  "error": "exceeded maximum [2] retries creating circuit [c/j11o4KaOm] (error creating route for [s/j11o4KaOm] on [r/Y-UUoWCyIW] (error creating route for [c/j11o4KaOm]: timeout waiting for message reply: context deadline exceeded))",
  "file": "github.com/openziti/ziti/router/xgress_edge/listener.go:199",
  "func": "github.com/openziti/ziti/router/xgress_edge.(*edgeClientConn).processConnect",
  "level": "warning",
  "msg": "failed to dial fabric",
  "time": "2025-08-07T19:49:28.113Z",
  "type": "EdgeConnectType"
}

```

The tcptunnel generates tons of messages

```auto
{"time":"2025-08-07T19:49:04.340Z"}
{"time":"2025-08-07T19:49:04.340Z"}
{"time":"2025-08-07T19:49:04.341Z"}
{"time":"2025-08-07T19:49:04.341Z"}
{"time":"2025-08-07T19:49:05.491Z"}
{"time":"2025-08-07T19:49:05.507Z"}
{"time":"2025-08-07T19:49:07.578Z"}
{"time":"2025-08-07T19:49:09.838Z"}
{"time":"2025-08-07T19:49:09.839Z"}
{"time":"2025-08-07T19:49:09.839Z"}
......

```

```auto
{
  "file": "/__w/zrok/zrok/cmd/zrok/shareReserved.go:359",
  "func": "main.(*shareReservedCommand).shareLocal",
  "level": "info",
  "msg": "ziti-edge-router connId=2147485782, logical=ziti-sdk[router=tls:tunnel.svc.host:rport] -> ACCEPT 127.0.0.1:port",
  "time": "2025-08-07T19:49:26.336Z"
}

```

```auto
{
  "file": "/__w/zrok/zrok/endpoints/txer.go:33",
  "func": "github.com/openziti/zrok/endpoints.TXer",
  "level": "error",
  "msg": "read error '127.0.0.1:port' -> 'ziti-edge-router connId=2147486157, logical=ziti-sdk[router=tls:tunnel.svc.host:rport]': read tcp 127.0.0.1:48812->127.0.0.1:port: use of closed network connection",
  "time": "2025-08-07T19:53:17.788Z"
}

```

```auto
journalctl --since "Aug 07 19:49:00" -u zrok-tcptunnel.service | grep 'use of closed' | wc -l
828

```

Does _zrok tcptunnel_ have a limit on the number of connections? The user tried to run apt upgrade via local http proxy bound to squid using a _zrok tcptunnel._ At the same time I tried to use the tunnel, curl – proxy localhost:lport [https://www.google.com](https://www.google.com) and got an error. There was a network congestion. The total number of connection was approximately 90.

---

<div class="post-metadata">

**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\
**Post date:** [August 12, 2025, 7:34pm UTC](https://openziti.discourse.group/t/creating-circuit-error-how-to-understand-it/4968/2 "2025-08-12T19:34:09Z")

</div>

tcp tunnel does not work

```auto
{
  "file": "/__w/zrok/zrok/cmd/zrok/shareReserved.go:359",
  "func": "main.(*shareReservedCommand).shareLocal",
  "level": "info",
  "msg": "ziti-edge-router connId=2147489798, logical=ziti-sdk[router=tls:router.name:rport] -> ACCEPT 127.0.0.1:port",
  "time": "2025-08-12T19:24:23.125Z"
}
{
  "circuitId": "9Vo8pLeOn",
  "connId": 1,
  "error": "timeout waiting for message to be written to wire: context deadline exceeded",
  "file": "/github/home/go/pkg/mod/github.com/openziti/sdk-golang@v1.2.1/ziti/edge/network/conn.go:824",
  "func": "github.com/openziti/sdk-golang/ziti/edge/network.(*newConnHandler).dialSucceeded",
  "level": "error",
  "msg": "failed to send reply to dial request",
  "time": "2025-08-12T19:24:32.129Z"
}
{
  "circuitId": "zMU8pLaRm",
  "connId": 1,
  "error": "timeout waiting for message to be written to wire: context deadline exceeded",
  "file": "/github/home/go/pkg/mod/github.com/openziti/sdk-golang@v1.2.1/ziti/edge/network/conn.go:824",
  "func": "github.com/openziti/sdk-golang/ziti/edge/network.(*newConnHandler).dialSucceeded",
  "level": "error",
  "msg": "failed to send reply to dial request",
  "time": "2025-08-12T19:24:37.850Z"
}

```

Every time this happens I restart the zrok share to make the tcptunnel work again.

Here is the router’s log

```auto
{
  "_channels": [
    "establishPath"
  ],
  "apiSessionId": "cme8x26jogj4ucqig56e310fj",
  "attempt": 0,
  "attemptNumber": "1",
  "binding": "edge",
  "circuitId": "9Vo8pLeOn",
  "context": "ch{ctrl}->u{reconnecting}->i{dc/xzYA}",
  "destination": "4K6vU1SVTHHDN4WQGSRKBC",
  "error": "error creating route for [c/9Vo8pLeOn]: timeout waiting for message reply: context deadline exceeded",
  "file": "github.com/openziti/ziti/router/handler_ctrl/route.go:140",
  "func": "github.com/openziti/ziti/router/handler_ctrl.(*routeHandler).fail",
  "level": "error",
  "msg": "failure while handling route update",
  "serviceId": "4TDIgoL24R7kDi6z3EQZCe",
  "sessionId": "cme8x2784gj4wcqigloudf6qb",
  "time": "2025-08-12T19:24:27.090Z"
}
{
  "_channels": [
    "establishPath"
  ],
  "apiSessionId": "cme8x26jogj4ucqig56e310fj",
  "attemptNumber": "2",
  "bindConnId": 1,
  "binding": "edge",
  "circuitId": "9Vo8pLeOn",
  "connId": 2147489799,
  "file": "github.com/openziti/ziti/router/xgress_edge/dialer.go:132",
  "func": "github.com/openziti/ziti/router/xgress_edge.(*dialer).Dial",
  "level": "info",
  "msg": "sending dial request to sdk",
  "serviceId": "4TDIgoL24R7kDi6z3EQZCe",
  "sessionId": "cme8x2784gj4wcqigloudf6qb",
  "terminatorAddress": "4K6vU1SVTHHDN4WQGSRKBC",
  "time": "2025-08-12T19:24:27.127Z"
}
{
  "file": "github.com/openziti/ziti/router/xgress_edge/accept.go:171",
  "func": "github.com/openziti/ziti/router/xgress_edge.debugPeekHandler.Tx",
  "level": "info",
  "msg": "sending dial: seq: 130170 , connId: 1, newConnId: 2147489799, circuitId: 9Vo8pLeOn",
  "time": "2025-08-12T19:24:27.127Z"
}

```

---

<div class="post-metadata">

**Author:** ![michael.quigley](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/michael.quigley/32/1123_2.png) [@michael.quigley](https://openziti.discourse.group/u/michael.quigley)\
**Post date:** [August 12, 2025, 7:46pm UTC](https://openziti.discourse.group/t/creating-circuit-error-how-to-understand-it/4968/3 "2025-08-12T19:46:18Z")

</div>

There is nothing particularly different about `tcpTunnel` shares versus other types of shares. It does nothing different with regard to circuits on the ziti network.

Can you possibly describe in more detail what you’re trying to accomplish?

---

<div class="post-metadata">

**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\
**Post date:** [August 12, 2025, 7:47pm UTC](https://openziti.discourse.group/t/creating-circuit-error-how-to-understand-it/4968/4 "2025-08-12T19:47:57Z")

</div>

It simply does not work.

Where I should look?

apt full-upgrade

---

<div class="post-metadata">

**Author:** ![michael.quigley](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/michael.quigley/32/1123_2.png) [@michael.quigley](https://openziti.discourse.group/u/michael.quigley)\
**Post date:** [August 12, 2025, 7:49pm UTC](https://openziti.discourse.group/t/creating-circuit-error-how-to-understand-it/4968/5 "2025-08-12T19:49:02Z")

</div>

It definitely works. What is your `zrok share` command? How are you trying to `zrok access` it?

Are you trying to use `tcpTunnel` against a public frontend? You cannot access it via `http` in your public frontend. You _must_ use `zrok access private` to bind the share to a network listener.

---

<div class="post-metadata">

**Author:** ![michael.quigley](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/michael.quigley/32/1123_2.png) [@michael.quigley](https://openziti.discourse.group/u/michael.quigley)\
**Post date:** [August 12, 2025, 7:53pm UTC](https://openziti.discourse.group/t/creating-circuit-error-how-to-understand-it/4968/6 "2025-08-12T19:53:14Z")

</div>

If I use `zrok share private -b tcpTunnel 192.168.9.1:22` to create a share for the ssh endpoint on one of my local systems… I can then `zrok access private <shareToken>` that share to bind it to a local network address (`127.0.0.1:9191`)… and then I can `ssh` to `127.0.0.1:9191`.

That is how `tcpTunnel` works.

---

<div class="post-metadata">

**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\
**Post date:** [August 12, 2025, 7:53pm UTC](https://openziti.discourse.group/t/creating-circuit-error-how-to-understand-it/4968/7 "2025-08-12T19:53:44Z")

</div>

> [@michael.quigley](#):
>
> It definitely works. What is your `zrok share` command? How are you trying to `zrok access` it?

apt full-upgrade

It works only then I access via firefox. (small load)

On other hand then users download a lot of things the zrok tcptunnel does not reply to routers.

---

<div class="post-metadata">

**Author:** ![michael.quigley](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/michael.quigley/32/1123_2.png) [@michael.quigley](https://openziti.discourse.group/u/michael.quigley)\
**Post date:** [August 12, 2025, 7:55pm UTC](https://openziti.discourse.group/t/creating-circuit-error-how-to-understand-it/4968/8 "2025-08-12T19:55:13Z")

</div>

> [@Rantanplan](#):
>
> > [@michael.quigley](#):
> >
> > It definitely works. What is your `zrok share` command? How are you trying to `zrok access` it?
> 
> apt full-upgrade
> 
> It works only then I access via firefox. (small load)

I don’t understand what you’re saying.

---

<div class="post-metadata">

**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\
**Post date:** [August 12, 2025, 7:56pm UTC](https://openziti.discourse.group/t/creating-circuit-error-how-to-understand-it/4968/9 "2025-08-12T19:56:51Z")

</div>

Then I setup a proxy in FF, zrok tcptunnel works, similar

```auto
curl --proxy http://127.0.0.1:port http://www.google.com

```

Then we run _apt full-upgrade_ zrok tcptunnel stops

---

<div class="post-metadata">

**Author:** ![michael.quigley](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/michael.quigley/32/1123_2.png) [@michael.quigley](https://openziti.discourse.group/u/michael.quigley)\
**Post date:** [August 12, 2025, 7:57pm UTC](https://openziti.discourse.group/t/creating-circuit-error-how-to-understand-it/4968/10 "2025-08-12T19:57:57Z")

</div>

What zrok command are you using to create your `tcpTunnel`? What `zrok access` command are you using to bind the resulting share?

---

<div class="post-metadata">

**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\
**Post date:** [August 12, 2025, 8:01pm UTC](https://openziti.discourse.group/t/creating-circuit-error-how-to-understand-it/4968/11 "2025-08-12T20:01:23Z")

</div>

It is a reserved share,

```auto
zrok share reserved proxy --override-endpont 127.0.0.1:port --headless

```

As a usual share.

---

<div class="post-metadata">

**Author:** ![michael.quigley](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/michael.quigley/32/1123_2.png) [@michael.quigley](https://openziti.discourse.group/u/michael.quigley)\
**Post date:** [August 12, 2025, 8:02pm UTC](https://openziti.discourse.group/t/creating-circuit-error-how-to-understand-it/4968/12 "2025-08-12T20:02:42Z")

</div>

> [@Rantanplan](#):
>
> `zrok share reserved proxy`

And you are binding it to a network address using `zrok access` how?

---

<div class="post-metadata">

**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\
**Post date:** [August 12, 2025, 8:07pm UTC](https://openziti.discourse.group/t/creating-circuit-error-how-to-understand-it/4968/13 "2025-08-12T20:07:25Z")

</div>

Is there a way to see it somehow?

I use yours scripts:

env file:

ZROK\_TARGET="127.0.0.1:port"

ZROK\_BACKEND\_MODE="tcpTunnel"

ZROK\_PERMISSION\_MODE="open"

I should say that It works very well for FF.

The problem appears when someone tries to download a lot of things via apt.

---

<div class="post-metadata">

**Author:** ![michael.quigley](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/michael.quigley/32/1123_2.png) [@michael.quigley](https://openziti.discourse.group/u/michael.quigley)\
**Post date:** [August 12, 2025, 8:09pm UTC](https://openziti.discourse.group/t/creating-circuit-error-how-to-understand-it/4968/14 "2025-08-12T20:09:57Z")

</div>

`zrok access` does not care about the target, the backend mode, or the permission mode.

I’m not sure what you’re doing, but I think there is some confusion.

The `zrok access private` command takes a share token, and optionally a bind address and creates a network listener that routes traffic through the share. I would recommend doing this directly from the CLI and trying that.

Something like `zrok access private proxy –bind <address>:<port>` and then pointing your traffic at `<address>:<port>`.

---

<div class="post-metadata">

**Author:** ![michael.quigley](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/michael.quigley/32/1123_2.png) [@michael.quigley](https://openziti.discourse.group/u/michael.quigley)\
**Post date:** [August 12, 2025, 8:12pm UTC](https://openziti.discourse.group/t/creating-circuit-error-how-to-understand-it/4968/15 "2025-08-12T20:12:05Z")

</div>

> [@Rantanplan](#):
>
> I should say that It works very well for FF.
> 
> The problem appears when someone tries to download a lot of things via apt.

Ok. But the problem might be related to your usage pattern. If you’re trying to do something outside of how it’s intended to be used, you might have partial success.

---

<div class="post-metadata">

**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\
**Post date:** [August 12, 2025, 8:12pm UTC](https://openziti.discourse.group/t/creating-circuit-error-how-to-understand-it/4968/16 "2025-08-12T20:12:38Z")

</div>

As I explained It works pretty well.

The only problem if someone run apt using this tcptunnel.

---

<div class="post-metadata">

**Author:** ![michael.quigley](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/michael.quigley/32/1123_2.png) [@michael.quigley](https://openziti.discourse.group/u/michael.quigley)\
**Post date:** [August 12, 2025, 8:30pm UTC](https://openziti.discourse.group/t/creating-circuit-error-how-to-understand-it/4968/17 "2025-08-12T20:30:32Z")

</div>

Assuming it’s being used properly… based on your initial post, it sounds like you’re running into some kind of network congestion. There are no limits on the number of simultaneous connections that can be handled through `tcpTunnel`… but if you’re running into issues on your ziti network, you might be running out of underlay or overlay capacity.

---

<div class="post-metadata">

**Author:** ![michael.quigley](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/michael.quigley/32/1123_2.png) [@michael.quigley](https://openziti.discourse.group/u/michael.quigley)\
**Post date:** [August 12, 2025, 8:33pm UTC](https://openziti.discourse.group/t/creating-circuit-error-how-to-understand-it/4968/18 "2025-08-12T20:33:34Z")

</div>

And your `apt` usage scenario might be opening a LOT of connections in parallel. Creating connections can cause overhead on the overlay.

---

<div class="post-metadata">

**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\
**Post date:** [August 12, 2025, 8:35pm UTC](https://openziti.discourse.group/t/creating-circuit-error-how-to-understand-it/4968/19 "2025-08-12T20:35:14Z")

</div>

> [@michael.quigley](#):
>
> But the problem might be related to your usage pattern.

Firstly we run the command:

```auto
 curl --proxy http://127.0.0.1:port -s -w '%{time_total}s' -o /dev/null http://www.google.com
0.216196s

```

Then we run

```auto
curl --proxy http://127.0.0.1:port -o /dev/null https://sbg.proof.ovh.net/files/10Gb.dat

```

It will take time….

So we open another terminal window and repeat:

```auto
 curl --proxy http://127.0.0.1:port -s -w '%{time_total}s' -o /dev/null http://www.google.com
11.825697s

```

and then

```auto
curl -s -w '%{time_total}s' -o /dev/null http://www.google.comgoogle.com
0.104771s

```

---

<div class="post-metadata">

**Author:** ![michael.quigley](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/michael.quigley/32/1123_2.png) [@michael.quigley](https://openziti.discourse.group/u/michael.quigley)\
**Post date:** [August 12, 2025, 8:37pm UTC](https://openziti.discourse.group/t/creating-circuit-error-how-to-understand-it/4968/20 "2025-08-12T20:37:41Z")

</div>

If you combine significant upload or download traffic, while creating a large number of connections, you could certainly run into timeouts if your underlay is saturated, or your overlay has insufficient capacity.

[Next page](https://openziti.discourse.group/t/creating-circuit-error-how-to-understand-it/4968.md?page=2)