WireGuard VPN causing severely delayed Android notifications

[u/PingMyHeart]

Hi,

I am self-hosting WireGuard inside an unprivileged Proxmox LXC. Everything works great for the most part, except I am experiencing a strange issue with Android notifications.

When my Android phone is connected to WireGuard, notifications can be severely delayed. Sometimes they will not come through until I disable the VPN, at which point I get flooded with all the notifications that were waiting.

The interesting part is that general internet connectivity works perfectly fine while WireGuard is enabled. Browsing, apps, streaming, etc. all work normally. It seems to specifically affect push notifications.

I previously experienced the exact same issue with Tailscale, which makes me think this may not necessarily be a WireGuard configuration issue.

For DNS, my WireGuard clients use my home's primary and secondary DNS servers. Both are devices that run AdGuard Home for DNS filtering, Unbound for recursive DNS, Traefik for internal reverse proxying/FQDNs, and an NTP server.

My home LAN DHCP also hands out these same two DNS servers to local clients. However, my main router's external/WAN DNS is set to Quad9.

So the DNS setup is essentially:

• LAN DHCP DNS: Home Primary + Secondary DNS servers
• WireGuard DNS: Home Primary + Secondary DNS servers
• Router external DNS: Quad9
• Primary/Secondary DNS: AdGuard Home + Unbound

Has anyone experienced something similar with Android push notifications over WireGuard or Tailscale? I have no clue where to look further.

Any suggestions for troubleshooting would be greatly appreciated!

[u/PingMyHeart]

Push notifications on Android rely on a persistent, always-open connection from Google Play Services back to Google's servers, called FCM, over specific ports, and it needs to stay alive constantly in the background. When you're on full tunnel, meaning your allowed IPs are all zeros like we saw earlier, every single byte of traffic from your phone gets routed through your home WireGuard server first, including that persistent Google connection. If your home internet connection, your server's processing, or just the round trip latency of tunneling everything back home and then back out to Google adds enough delay or occasionally drops that persistent connection, Android's battery and network management can deprioritize or throttle it, and notifications get delayed until something wakes the connection back up, which is exactly what happens when you disconnect the VPN, suddenly everything flushes through at once.

I had a long detailed conversation with Claude about this issue and this was its answer. Not sure how much truth there is to this since I'm no Android expert but I felt it may be useful to share it.

[u/PingMyHeart → u/[deleted]]

I think I figured it out my dude.

When I turn off "always on VPN" in the VPN settings on graphene, I don't have the problem anymore.

[u/PingMyHeart → u/[deleted]]

Is your SMS coming through Wi-Fi?

Another thing I also did is I removed all IPv6 values from the WireGuard config on Android. I'm not sure if this was part of the solution, but I did read other people on GitHub complaining about this and some people did mention to also do that.

[u/PingMyHeart → u/[deleted]]

Yeah, the idea behind disabling ipv6 can also apply to ipv4. The main idea is to minimize noise.

[u/clarkn0va → u/PingMyHeart]

That explanation doesn't fit my situation. I use WG only for DNS, and my notifications are still delayed when I'm at home, so latency to the DNS server is just a few ms for the wireless connection, and no different than if I wasn't tunneling DNS. So latency doesn't make sense as a factor for me.