# Troubleshooting Diagnose traffic filtering behavior with configuration and forwarding examples. For an overview of Traffic Filtering, see [Traffic Filtering](https://docs.soracom.io/en/services/vpg/traffic-filtering). To configure Traffic Filtering, see [Configuration](https://docs.soracom.io/en/services/vpg/traffic-filtering/configuration). For behavior details that may explain unexpected results, also see [Usage Notes](https://docs.soracom.io/en/services/vpg/traffic-filtering#usage-notes), [Forwarding by Platform Services Is Out of Scope](https://docs.soracom.io/en/services/vpg/traffic-filtering#forwarding-by-platform-services-is-out-of-scope), and [What Domain Filtering Cannot Control](https://docs.soracom.io/en/services/vpg/traffic-filtering/domain-rules#what-domain-filtering-cannot-control). ## Traffic from a Device Is Unexpectedly Blocked 1. Confirm that the device's IoT SIM is assigned to the VPG on which Traffic Filtering is configured. 2. Confirm that Traffic Filtering is **enabled** on the VPG. If it is disabled, no rules are applied, but if it was just disabled, data sessions may not yet have picked up the change. 3. Check that the VPG is a supported type (see [Limitations](https://docs.soracom.io/en/services/vpg/traffic-filtering#limitations)). 4. Confirm that an allow rule exists that matches the destination (CIDR or FQDN), protocol, and port. 5. Confirm that you clicked **Save** below the list; rules added in the User Console are not applied until saved. 6. Re-establish the device's data session to apply the latest rules (see [When Rule Changes Take Effect](https://docs.soracom.io/en/services/vpg/traffic-filtering#when-rule-changes-take-effect)). 7. If [Outbound Filter](https://docs.soracom.io/en/services/vpg/outbound-filter) is also configured on the VPG, confirm that it does not have a deny rule matching the traffic; Outbound Filter rules are evaluated after Traffic Filtering and can block traffic that a Traffic Filtering allow rule permits. ## Traffic from a Device Is Unexpectedly Allowed 1. Confirm that the device's IoT SIM is assigned to the VPG on which Traffic Filtering is configured. 2. Confirm that Traffic Filtering is **enabled** on the VPG. If it is disabled, all traffic passes without filtering. 3. Check for overly broad allow rules, such as the default `allow 0.0.0.0/0` rule added automatically when Traffic Filtering is first enabled (see [Default Rule](https://docs.soracom.io/en/services/vpg/traffic-filtering#default-rule)). 4. Confirm that you clicked **Save** below the list; a deny rule that has not been saved is not yet applied. 5. Re-establish the device's data session to apply the latest rules (see [When Rule Changes Take Effect](https://docs.soracom.io/en/services/vpg/traffic-filtering#when-rule-changes-take-effect)). 6. Confirm that the device is not using encrypted DNS. If the device uses DoH or DoT, the platform cannot read DNS queries, so domain rules generate no dynamic IP rules and domain filtering does not apply (see [DNS Resolution and Dynamic Rules](https://docs.soracom.io/en/services/vpg/traffic-filtering/domain-rules#dns-resolution-and-dynamic-rules)). ## A Rule Was Rejected on Save | Condition | HTTP status | Cause and resolution | | - | - | - | | `Traffic filtering is not allowed for operator ` | 403 | See [When Traffic Filtering Is Not Enabled for Your Operator](https://docs.soracom.io/en/services/vpg/traffic-filtering/troubleshooting/#when-traffic-filtering-is-not-enabled-for-your-operator) below. | | Unsupported VPG type | 400 | The VPG is not a supported type (see [Limitations](https://docs.soracom.io/en/services/vpg/traffic-filtering#limitations)). | | IP or domain rule count exceeds 500 per VPG | 400 | Capped at **500** per type. Consolidate CIDR ranges or use wildcards to reduce the count. | | Rule specifies an IPv6 address | 400 | Use IPv4 only. | | Invalid FQDN pattern | 400 | The pattern exceeds 255 characters; the wildcard label is not standalone (e.g., `*foo.example.com`); the wildcard appears in a non-leading label; more than one wildcard label is used; or the pattern contains consecutive dots. See [Domain Rules](https://docs.soracom.io/en/services/vpg/traffic-filtering/domain-rules#wildcard-patterns) and [Limitations](https://docs.soracom.io/en/services/vpg/traffic-filtering#limitations). | | Invalid `fromPort` / `toPort` | 400 | `fromPort` must not exceed `toPort`; both must be in 0–65535. See [Protocol and Port Semantics](https://docs.soracom.io/en/services/vpg/traffic-filtering#protocol-and-port-semantics). | | Missing required field | 400 | Each IP rule requires `cidr`, `protocol`, and `action`; each domain rule requires `fqdnPattern`, `protocol`, and `action`. | | `deny` action on a domain rule | 400 | Domain rules support only `action: "allow"`. | | Duplicate rule | 400 | Identical rules in the same payload are rejected. Remove duplicates before saving. | ### When Traffic Filtering Is Not Enabled for Your Operator Symptoms: the **Traffic Filtering** section (under the **Filtering** tab) shows a contract-required notice, the section reports **Traffic Filtering is not available for this VPG type.**, the API returns `Traffic filtering is not allowed for operator `, or the enable API (`POST /v1/virtual_private_gateways//traffic_filtering/enable`) returns `403 Forbidden`. Traffic Filtering requires a separate contract. [Contact Soracom Support](https://docs.soracom.io/en/services/account/support#creating-a-support-request) to apply.