Self-hosted runner cannot connect: tokenghub.actions.githubusercontent.com (20.85.108.33) unreachable

[VolkovIlia]

Description

Two self-hosted runners (Linux x64, version 2.331.0) have been unable to connect to GitHub Actions for ~10 hours. The runners are stuck in a retry loop with Runner connect error: The HTTP request timed out after 00:01:40.

Root Cause

The OAuth token endpoint tokenghub.actions.githubusercontent.com resolves to 20.85.108.33 (Azure), and this IP is unreachable from our server. TCP connections to port 443 time out.

Other GitHub Actions endpoints work fine:

• pipelines.actions.githubusercontent.com → 2620:1ec:21::16 (IPv6) → OK
• vstoken.actions.githubusercontent.com → 2620:1ec:21::16 (IPv6) → OK
• api.github.com → OK
• github.com → OK

Diagnostics

MTR trace to 20.85.108.33

HOST: [redacted]              Loss%   Snt   Last   Avg  Best  Wrst StDev
 1.|-- [gateway]               0.0%     3    0.2   0.3   0.2   0.3   0.0
 ...
10.|-- 104.44.230.20           0.0%     3   23.9  12.4   1.8  23.9  11.1
11.|-- ???                    100.0     3    0.0   0.0   0.0   0.0   0.0

Packets reach Azure edge (hop 10: 104.44.230.20) but are dropped at hop 11.

Runner diagnostic log

[2026-02-09 22:25:40Z INFO BrokerMessageListener] Connecting to the Broker Server...
[2026-02-09 22:25:40Z INFO RunnerServer] Establish connection with 100 seconds timeout.
[2026-02-09 22:25:40Z INFO GitHubActionsService] Starting operation Location.GetConnectionData
[2026-02-09 22:27:04Z ERR  RunnerServer] System.Threading.Tasks.TaskCanceledException: A task was canceled.
   at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(...)
   at GitHub.Services.Location.Client.LocationHttpClient.GetConnectionDataAsync(...)

Runner logs

2026-02-09 21:06:00Z: Runner connect error: The HTTP request timed out after 00:01:40.. Retrying until reconnected.
2026-02-09 22:08:17Z: Runner connect error: The HTTP request timed out after 00:01:40.. Retrying until reconnected.
2026-02-09 22:41:45Z: Runner connect error: The HTTP request timed out after 00:01:40.. Retrying until reconnected.
2026-02-09 23:32:46Z: Runner connect error: The HTTP request timed out after 00:01:40.. Retrying until reconnected.

Verification from inside the container

# These work:
curl https://api.github.com/          # 200 OK
curl https://pipelines.actions.githubusercontent.com/_apis/health  # 200 OK
curl https://vstoken.actions.githubusercontent.com/_apis/health    # 200 OK

# This times out:
curl https://tokenghub.actions.githubusercontent.com/  # Connection timed out

Observation

tokenghub.actions.githubusercontent.com resolves to an IPv4-only address (20.85.108.33), while other *.actions.githubusercontent.com endpoints resolve to IPv6 (2620:1ec:21::16) which works fine. The issue may be related to Azure routing for this specific IPv4 address from certain regions.

Environment

• Runner version: 2.331.0 (latest)
• OS: Ubuntu 22.04.5 LTS (Docker container)
• Server location: Europe
• Started: 2026-02-09 ~21:00 UTC
• Still ongoing: Yes

Expected Behavior

Runner should be able to connect to tokenghub.actions.githubusercontent.com for OAuth token exchange.

Workaround Attempted

• Restarted containers multiple times — same result
• Verified network, DNS, iptables — no local blocking
• The issue is specifically with the Azure IP 20.85.108.33 being unreachable

[VolkovIlia]

Update: Server reboot did not help

Full server reboot performed — all services came back up, but the issue persists. tokenghub.actions.githubusercontent.com (20.85.108.33) is still unreachable.

This confirms the problem is not local (no stale connections, firewall state, or DNS cache). The routing issue is between our hosting provider's upstream and Azure.

Timeline

• 2026-02-09 ~21:00 UTC — Runners disconnected
• 2026-02-09 22:20 UTC — Container restarts attempted (no effect)
• 2026-02-10 06:35 UTC — Full server reboot (no effect)
• ~10 hours and counting — Still offline

Key observation

Could tokenghub.actions.githubusercontent.com get an IPv6 AAAA record like the other Actions endpoints? The IPv6-enabled endpoints (pipelines, vstoken → 2620:1ec:21::16) work perfectly from this server. Only tokenghub is IPv4-only (20.85.108.33) and unreachable.

[TingluoHuang]

I am able to hit the endpoint via curl.

tingluohuang@macbookpro runner % curl  https://tokenghub.actions.githubusercontent.com/_apis/connectiondata 
{"instanceId":"84ff2294-8721-ab49-db5a-db17b0f6c2de","deploymentId":"84ff2294-8721-ab49-db5a-db17b0f6c2de","deploymentType":"hosted","locationServiceData":{"serviceOwner":"00000052-0000-8888-8000-000000000000","defaultAccessMappingMoniker":"PublicAccessMapping","lastChangeId":602,"lastChangeId64":602}}%  

tingluohuang@macbookpro runner % nslookup tokenghub.actions.githubusercontent.com 
Server:		100.100.100.100
Address:	100.100.100.100#53

Non-authoritative answer:
tokenghub.actions.githubusercontent.com	canonical name = tokenghubeus21.actions.githubusercontent.com.
Name:	tokenghubeus21.actions.githubusercontent.com
Address: 20.85.108.33

is your runner configured with github.com or one of the data residency service of github?
Also, do you mind share your geo location? ex: I run my curl from EastUS area.

Also, if you reconfigure a new runner, does it still use tokenghub.actions.githubusercontent.com or it will use vstoken.actions.githubusercontent.com?

[VolkovIlia]

Thanks for the quick response @TingluoHuang!

Answers

1. Configuration: Standard github.com (not data residency). The runner's .runner config shows:

{
  "serverUrl": "https://pipelinesghubeus11.actions.githubusercontent.com/...",
  "gitHubUrl": "https://github.com/<owner>/<repo>"
}

And .credentials uses:

"authorizationUrl": "https://tokenghub.actions.githubusercontent.com/_apis/oauth2/token/..."

2. Geo location: The server is in Frankfurt am Main, Germany. The Azure IP 20.85.108.33 is unreachable from there — packets reach Azure edge (104.44.230.20) but get dropped at the next hop.

3. Reconfiguring to use vstoken instead of tokenghub: I haven't tried yet. Will do and report back.

Quick question

Is there a way to force the runner to use vstoken.actions.githubusercontent.com instead of tokenghub? That endpoint resolves to IPv6 (2620:1ec:21::16) and works perfectly from this server.

[TingluoHuang]

The service decide whether it sends tokenghub or vstoken, technically those 2 URL points to the same backend service. (i think).

Do you remember when did you configure the runner, recently or long time ago? The reason I am asking is i think the tokenghub might be a domain we used a long-time ago, and the vstoken is something we introduced more recently.

Also, to mitigate, you can try to replace the tokenghub with vstoken in your .credentials, and see if that helps.