Add a monitor

What a monitor checks

Every monitor performs a real VPN handshake for one of the 11 supported protocols and reports whether a client could actually connect — not just whether a port answers. That distinction is the whole point: a WireGuard server can accept packets all day while the handshake silently fails.

Two ways to add one

Paste a config (recommended)

Paste a config or share link into the box at the top of the dialog and TunnelHQ figures out the rest. It recognizes share links like vless://, vmess://, trojan://, ss://, and the full text of WireGuard and OpenVPN config files. The protocol, host, and port are filled in for you; you just confirm and save.

Enter the details manually

Expand Or enter manually to type everything in. The fields are:

• Server name — optional, and auto-generated from the protocol and host if you leave it blank. (It's required for OpenConnect.)
• Host — the server address, e.g. vpn.example.com or an IP. Required.
• Port — required for most protocols. OpenConnect and IKEv2 don't take one (they use the protocol's own defaults), and config-file protocols like WireGuard read the endpoint port from the pasted config.
• Protocol — grouped into Standard (WireGuard, OpenVPN, IKEv2), V2ray/Xray (VLESS, VMess, Trojan, Shadowsocks, Hysteria2, TUIC), and Obfuscated (AmneziaWG, OpenConnect).

Picking a protocol reveals its specific fields — a WireGuard config and interface IP, an OpenVPN username and password, a connection URL, and so on. Every protocol's fields are documented in VPN protocols.

Monitor settings

These apply to any monitor, regardless of protocol.

Regions

A monitor tests from Any region by default. Add specific regions to confirm the server is reachable from each one independently — TunnelHQ then tracks a status per region and rolls them into a single aggregate. There's a whole page on how that works: Regions & status.

Check interval

How often the monitor runs. Free checks every 10 minutes; Starter every 5; Pro every 2; and Business down to every 1 minute. If you pick an interval faster than your plan allows, the dashboard tells you and the API rejects it.

Timeout & retries

Each check has a timeout (how long to wait for the handshake before calling it a failure) and a retry count (how many times to re-attempt before recording the result). Sensible defaults are applied, so you only need to touch these for slow servers or flaky links.

Tags

Tag monitors to group and filter them — by region, customer, environment, whatever fits. Tags drive the filters on the Monitors page and can scope alerts and status pages.

After you add it

Open any monitor to manage it:

• Run Now — fire an immediate on-demand check without waiting for the schedule.
• Pause — stop checks temporarily; the monitor stays in your list but the scheduler skips it. You can also pause individual regions.
• History — every heartbeat with status, region, latency, and message.
• Settings — change any field above, or delete the monitor.

The test journey

Every check records the stages it went through, so a failure tells you where it failed — not just that it did:

• Setup — preparing the connection test.
• Connect — DNS, reachability, and the protocol handshake. On success you'll see the tunnel IP that was assigned.
• Verify — real traffic through the established tunnel, with the exit IP it egressed from.

Expand any entry under Recent Test Results or any row in History to see the stage waterfall with per-stage timings. Failed checks also include a diagnostic — the tail of the VPN client's own output (with secrets scrubbed) — so you can read exactly why the handshake died: wrong key, auth rejected, endpoint filtered, certificate problems, and so on, without SSH-ing anywhere.