Skip to main content

Fixing the "Limited Connectivity" Bug in Garuda/Arch Linux with AdGuard CLI

If you use AdGuard CLI (adguard-cli) on Arch Linux or an Arch-based distribution like Garuda Linux, you might have encountered a frustrating issue: your desktop environment constantly displays a yellow warning icon or a "Limited Connectivity" / "No Internet" notification, even though your web browser opens websites without any trouble.

Checking the network status in your terminal confirms the symptom:

$ nmcli networking connectivity check
Error: Timeout was reached.

In this post, we will break down why this happens deep within the Linux networking stack and how to solve it permanently in under two minutes.

1. How NetworkManager Probes for Internet

Linux desktop environments (KDE Plasma, GNOME, XFCE) rely on NetworkManager to check for active internet access and detect captive portals (like hotel or airport Wi-Fi).

Every few minutes, NetworkManager sends a lightweight HTTP request to an external endpoint:

  • Test URL: http://ping.archlinux.org/nm-check.txt
  • Expected Response: NetworkManager is online

To verify that a specific physical network card (such as your Wi-Fi card wlp2s0) is actually connected, NetworkManager attaches a special Linux kernel socket flag called SO_BINDTODEVICE to the probe request.

What SO_BINDTODEVICE does: It binds the socket strictly to the physical network interface. The kernel enforces that all packets from this socket must only exit through that specific hardware card.

2. Why AdGuard CLI Triggers a Deadlock

When adguard-cli runs in system-wide auto mode (proxy_mode: 'auto'), its root helper sets up transparent firewall redirection rules (iptables / nftables) to intercept outgoing traffic.

By default, AdGuard intercepts this port range in ~/.local/share/adguard-cli/proxy.yaml:

filtered_ports: '80:5221,5300:49151'

Because port 80 is included, the firewall intercepts NetworkManager's probe and attempts to redirect it to AdGuard's local proxy listening on 127.0.0.1:3129 (the loopback interface).

The Kernel Routing Conflict:

  1. NetworkManager sends a probe to port 80 with the socket bound to the Wi-Fi card (wlp2s0).
  2. The firewall redirects the packet to 127.0.0.1 (the loopback interface lo).
  3. The Linux kernel detects a conflict: A socket strictly bound to wlp2s0 is not permitted to communicate with the loopback interface lo.
  4. The kernel drops the packet immediately.
Why App Bypass Rules Fail: Adding NetworkManager to the apps: bypass section inside proxy.yaml does not fix this because AdGuard's user-space app bypass is only evaluated after a packet reaches port 3129. Since the kernel drops the packet during firewall redirection, AdGuard never sees it.

3. The Solution: Exclude Port 80 from Interception

NetworkManager tests connectivity using plain HTTP (port 80). Meanwhile, virtually all modern web browsing, ads, trackers, and telemetry operate over encrypted HTTPS (port 443).

By shifting AdGuard's filtered port range from 80 to 81:

  • Port 80 traffic bypasses firewall redirection completely, allowing NetworkManager's probe to reach ping.archlinux.org directly through your Wi-Fi interface.
  • 100% of your ad-blocking protection remains intact, because HTTPS (port 443) and all other application ports remain fully filtered.

Step-by-Step Fix

Step 1: Edit AdGuard's Configuration

Open your AdGuard CLI configuration file in your text editor:

nano ~/.local/share/adguard-cli/proxy.yaml

Find the filtered_ports: setting (around line 10) and change 80 to 81:

# Before:
filtered_ports: '80:5221,5300:49151'

# After:
filtered_ports: '81:5221,5300:49151'

Save and close the file (in Nano: press Ctrl + O, then Enter, then Ctrl + X).

Step 2: Restart AdGuard CLI

Restart the daemon so the root helper flushes the old firewall rules and applies the new port range:

adguard-cli restart

Step 3: Verify Full Connectivity

Ask NetworkManager to re-run the connectivity test:

nmcli networking connectivity check

It will now return:

full

You can also check the general network status:

nmcli general status

STATE      CONNECTIVITY  WIFI-HW  WIFI     WWAN-HW  WWAN     METERED      
connected  full          enabled  enabled  missing  enabled  no (guessed)

Alternative Fix: Disable NetworkManager Connectivity Checks

If you don't need captive portal detection (for example, on a home desktop) and prefer not to modify AdGuard, you can tell NetworkManager to stop probing altogether:

  1. Create a drop-in override file: 
    sudo nano /etc/NetworkManager/conf.d/20-connectivity.conf
  2. Add the following lines: 
    [connectivity]
enabled=false
  3. Restart NetworkManager: 
    sudo systemctl restart NetworkManager

Key Takeaways

  • SO_BINDTODEVICE binds a socket strictly to a physical network card. Redirecting such packets to 127.0.0.1 via NAT creates an invalid route that the Linux kernel drops by design.
  • Proxy-level application bypasses cannot process packets that are rejected at the kernel routing stage.
  • Excluding port 80 from filtered_ports solves the issue cleanly while keeping all your HTTPS ad blocking and privacy protection active.
Labels:

Comments

Post a Comment

Popular posts from this blog

BSNL GPRS Settings - what worked for me

The following are the BSNL GPRS activation settings in South India at the time of writing this blog post. To activate GPRS Post Paid Customers should send the following SMS to 53733 1. GPRS199 – Rs 199/month; unlimited usage 2. GPRS49 – Rs 49/month; After 5 MB usage, each 10 KB costs 3 paise 3. GPRSF – No monthly fee; each 10 KB costs 5 paise Pre Paid customers should send the following SMS to 53733 GPRSPRE – each KB costs 2 paise To deactivate GPRS facility: Send the following SMS to 53733 GPRSD Activate the automatic GPRS settings: Visit http://218.248.72.246/msp/html OR SMS the following to 58355 MODEL MAKE e.g. NOKIA 6070 BSNL INTERNET Settings: (This is what enabled internet access for my mobile applications) 1. Select Settings from Menu > Settings >Configuration>Personal configuration settings>Options>Add new>Access point 2. Connection name: BSNL GPRS 3. Data bearer: GPRS 4. Access point name: gprssouth.cellone.in 5. User name:...
25 comments
Read more

Zika virus

A third outbreak of Zika virus infection has occurred in India in Rajasthan. With more than 55 infected people of which more than 11 are pregnant females, it is time to recollect a few points about this viral infection. This is a viral disease; an emerging infection transmitted the same mosquito that transmits dengue and chikungunya. This virus was first identified in Uganda in 1947. The first outbreak in India was in January 2017 at Ahmedabad, the second in Tamil Nadu at Krishnagiri in the same year.  Most of the infections stay asymptomatic. The symptoms include fever, rashes, redness of eyes, muscle and joint pain, malaise and headache. The symptoms are mild, resemble other arboviral infections and last usually for 2 to 7 days. The fearsome aspect of this seemingly mild infection is the devastation it can bring about to the future generations. Microcephaly in the newborn and other neurological syndromes like Guillain Barre Syndrome can wreak havoc in a developing...
Post a Comment
Read more

World Mental Health Day

Mental Health problems are one of the leading morbidity even in the developing world. Most people would find it easy to talk to a religious guru than to a qualified mental health practitioner. Thus the sad state of affairs is that the patient ends up with a psychiatrist after receiving all the ill advice of every Tom, Dick and Harry. Depression is a very common psychiatric illness that can wear off many productive hours and even life of the patients. Millions of people around the world live with depression. In this context it is worthwhile to watch the video released by the WHO.
Post a Comment
Read more