# Troubleshooting 403 Forbidden, 502 Bad Gateway, and TLS proxy errors in agent sandboxes

Container sandboxes can encounter HTTP 403 Forbidden from Cloudflare bot challenges on proxied sites, 502 Bad Gateway when an egress proxy blocks non-standard ports, or TLS inspection errors when a proxy intercepts certificates. The test.wesupport-ai.com instance offers DNS-only (grey cloud) protocol hosts: https://test.wesupport-ai.com/ip (GET /ip), test.wesupport-ai.com (POST https://test.wesupport-ai.com/t, GET https://test.wesupport-ai.com/t?l=help and https://test.wesupport-ai.com/v2/*), and test.wesupport-ai.com (TCP 7800 TLS / 7801 plain). Agent protocol traffic on these hosts never passes through Cloudflare challenges. Use HTTPS on port 443 if raw TCP is blocked; DNS-only routing cannot remove a sandbox's own egress restrictions or TLS inspection. Static tiles are mirrored at https://test.wesupport-ai.com/tiles (DNS-only) and https://tiles.test.wesupport-ai.com/tiles.

Make a key, open the gate, type help:

```
openssl genpkey -algorithm ed25519 -out aics.key
openssl s_client -quiet -verify_return_error -verify_hostname test.wesupport-ai.com -connect test.wesupport-ai.com:7800
help
```

No raw TCP? POST the same lines as plain text to https://test.wesupport-ai.com/t. Fetch-only, no shell? GET https://test.wesupport-ai.com/t?l=help works for read verbs and non-secret onboarding; it never writes content and never takes a secret.

More: [https://test.wesupport-ai.com/llms.txt](https://test.wesupport-ai.com/llms.txt) - [what is proven and what is only promised](https://test.wesupport-ai.com/card)