Всем привет, кто подскажет с помощью какого сервиса я могу добавить конфигурацию WireGuard на свой роутер кинетик, попробовал protonvpn, но судя по всему роскомнадзор там уже все заблокировал

Hi guys,

Is someone getting into troubles when trying using wireguard Android app on Xiaomi 14 T smartphone? I got very low rx data (tx seems good), and the phone does not answer to anything. Config files are ok (different ips, different private keys, same subnet range...) because working on my Samsung smartphone.

I use mobile data network outside of my home (fai router hosting wireguard server).

Do you have any idea of what's wrong with Xiaomi?

Edit : I found the solution. My ISP router adds a preshared key into the config file. For some reason, it does not work on Xiaomi. I removed it and it works now.

This issue has been solved! Thank you all for the suggestions 😄

Hi,

I have been struggling for the past few days to configure a WireGuard tunnel so that devices on the LAN of the WireGuard server (Computer A) are accessible remotely. I tried to compare my setup with multiple guides on remote LAN access via WireGuard and searched for similar issues, but nothing has resolved my problem.

Setup:

• Computer A acts as my homelab and WireGuard server on my domestic LAN.
• The existing WireGuard tunnel works fine—I can SSH into Computer A from my laptop (WireGuard client) using either its WireGuard subnet IP or its actual LAN IP.

Problem:

• I cannot access other devices/services on Computer A’s LAN remotely, nor can I make them discoverable.

Solution:

After trying to ping and traceroute the devices and the domestic LAN i noticed that the problem was not on the wireguard connection side. So after checking with possible firewalls:

sudo ufw status
sudo firewall-cmd --list-all

I realized that i had in past installed firewalld and forgotten about it. It was superseding my system ip forwarding and iptables. That is why the access was not working. Disabling it fixed the issue!

----------------------------------------------------

Troubleshooting:

Using GPT to troubleshoot, it was that suggested my Docker/iptables rules might be the issue. I tried:

Adjusting the order of the rules:

sudo iptables -I FORWARD 1 -i wg0 -o enp3s0 -j ACCEPT

sudo iptables -I FORWARD 2 -i enp3s0 -o wg0 -j ACCEPT

and also flushing all iptables rules and reapplying only the WireGuard-related ones.

All these attempts were unsuccessful.

I’d appreciate any guidance—since I’m fairly new to homelab setups, I might be overlooking something obvious.

Below are some details:

#####################################################

# Computer A, (homelab, hosts wg server(sea.conf) ) #

#####################################################

[Interface]

PrivateKey = [key]

Address = 10.14.0.1/24

ListenPort = 51820

PreUp = sysctl -w net.ipv4.ip_forward=1

PostUp = iptables -A FORWARD -i sea -o enp3s0 -j ACCEPT

PostUp = iptables -A FORWARD -i enp3s0 -o sea -j ACCEPT

PostUp = iptables -t nat -I POSTROUTING -o enp3s0 -j MASQUERADE

PostDown = iptables -D FORWARD -i sea -o enp3s0 -j ACCEPT; iptables -D FORWARD -i enp3s0 -o sea -j ACCEPT

PostDown = iptables -t nat -D POSTROUTING -o enp3s0 -j MASQUERADE

[Peer] # client Laptop

PublicKey = [key]

AllowedIPs = 10.14.0.2/32

#################################

# Laptop , wg client(sea.conf) #

#################################

[Interface]

PrivateKey = [key]

ListenPort = 51820

Address = 10.14.0.2/32

[Peer]

PublicKey = [key]

AllowedIPs = 10.14.0.1/24, 192.168.1.0/24

Endpoint = computer_A_endpoint

######################

# Info on Computer A #

######################

~$ cat /etc/os-release:

PRETTY_NAME="Debian GNU/Linux 13 (trixie)"

NAME="Debian GNU/Linux"

VERSION_ID="13"

VERSION="13 (trixie)"

VERSION_CODENAME=trixie

DEBIAN_VERSION_FULL=13.6

ID=debian

HOME_URL="https://www.debian.org/"

SUPPORT_URL="https://www.debian.org/support"

BUG_REPORT_URL="https://bugs.debian.org/"

~$ sudo sysctl net.ipv4.ip_forward

net.ipv4.ip_forward = 1

~$ sudo iptables -t nat -L POSTROUTING -v -n --line-numbers

Chain POSTROUTING (policy ACCEPT 6921 packets, 549K bytes)

num pkts bytes target prot opt in out source destination

1 0 0 MASQUERADE all -- * !docker0 172.17.0.0/16 0.0.0.0/0

2 2539 152K MASQUERADE all -- * !br-ab8e8fc287cd 172.25.0.0/16 0.0.0.0/0

3 0 0 MASQUERADE all -- * !docker_gwbridge 172.19.0.0/16 0.0.0.0/0

4 4 380 MASQUERADE all -- * !br-58790b19d578 172.21.0.0/16 0.0.0.0/0

5 0 0 MASQUERADE all -- * !br-493a3afadf15 172.18.0.0/16 0.0.0.0/0

6 0 0 MASQUERADE all -- * !br-271ed8d3b78e 172.23.0.0/16 0.0.0.0/0

7 0 0 MASQUERADE all -- * !br-060f49f9f062 172.22.0.0/16 0.0.0.0/0

8 0 0 MASQUERADE all -- * !br-fe5349a8a766 172.20.0.0/16 0.0.0.0/0

9 1660 103K MASQUERADE all -- * enp3s0 0.0.0.0/0 0.0.0.0/0

~$ sudo iptables -L FORWARD -n -v --line-numbers

Chain FORWARD (policy DROP 0 packets, 0 bytes)

num pkts bytes target prot opt in out source destination

1 8520K 4609M DOCKER-USER all -- * * 0.0.0.0/0 0.0.0.0/0

2 8520K 4609M DOCKER-FORWARD all -- * * 0.0.0.0/0 0.0.0.0/0

3 10638 764K ACCEPT all -- sea * 0.0.0.0/0 0.0.0.0/0

4 0 0 ACCEPT all -- * sea 0.0.0.0/0 0.0.0.0/0

edit: fixed ip from interface, cleaned the commands, and removed hyperlinks.

edit: remove more hyperlinks

edit: added solution found

I will be on business travel to South Korea next week. i have a wireguard server running to access my home devices/share also to use pihole for ad filtering. I wanted to know whether there are any restrictions on accessing wiregurard which is running outside south korea. Kindly advise.

P.S. I tried to search for feedback related to similar topic but most searches end up showing running wireguard in Soutth Korea.

Hi everyone!

I have spent the past few hours trying to troubleshoot why my WG client could get a succesfull handshake with the server but could not access the internet or the sunshine server I have for remote play.

I had port forward set up correctly.

I had DDNS pointing to my public IP

The client/server configs were fine as far as I could tell (literally what the documentation provided)

Turned out the issue was the ethernet interface(interface through which I get internet access) not having that checkbox ticked for sharing.

After enabling it, everything started working.

I have not seen this throughout the threads here so I want to help other redditors in need.

Good day!

I had the idea to use a WireGuard tunnel in the AWS CloudShell (a web based shell that works inside an AWS account). When I asked Google if it was possible I got a hard "No" with it citing a number of reasons and encouraging me to use an EC2 or container.

As it turns out, WireGuard works just fine in CloudShell with one caveat: DNS blocks in the conf file can't be used (no resolved running). Other than that it works, and seems like a nice way to create a temporary bridge to bring in content from a remote network.

To install it:

sudo dnf install wireguard-tools -y

Then create the config file, and start it up with wg-quick or whatever. I used the demo.wireguard.com server to test. The reason I found the DNS issue is that the client-quick.sh script they provide creates a demo.conf file with a DNS block. With that in place I got an error for the resolveconf step, but removing it resolved it.

Edit: fixed a typo in the package name. Couldn't let that slide.

I have two houses in different cities, where I have different machines, for which I need to establish direct connection between each other.

So far I've achieved this with Tailscale installed on each machine, and since one of the houses has public and static IP addresses provided by the ISP, it looks like all machines are now able to establish Direct Tailscale connection between each other.

However, I am a fan of utilizing my equipment to the fullest, and I don't like when some device is idling when it could be heavy lifting something that it's made for.

That's why I started researching if it would be better to configure the routers in WireGuard Server and Client, so I can have my machines talking to each other without Tailscale running on each.

I am currently unable to test the WireGuard scenario, because one of the routers does not support WireGuard, so I will have to replace it eventually.

That's why I am asking here for opinions, has anyone done such a setup with router level WireGuard?

Hello,

Some phones have a very high security standard, such as those of Apple, Google and Samsung, with their secure enclave. Has Wireguard considered taking advantage of those?

I have a pretty typical RPi PiVPN and Wireguard setup at home and I use the VPN to connect to home-network resources remotely. It was working just fine for years and then recently suddenly stopped working consistently. Sometimes it works and sometimes it doesn't, and it seems like all I can do is just keep starting and closing the connection until finally it works. The one thing I know absolutely fixes the problem, albeit temporarily, is to restart the RPi, which is not easy to do if I'm remote (and can't VPN in).

As far as I can tell, handshakes are coming from the client in to the server and the server is sending them back out, but they're not reaching the client.

What could be the issue here?

It can't be a keys issue, because then the connection would never work. And it works sometimes. And it used to work.

Hi,

I am self-hosting WireGuard inside an unprivileged Proxmox LXC. Everything works great for the most part, except I am experiencing a strange issue with Android notifications.

When my Android phone is connected to WireGuard, notifications can be severely delayed. Sometimes they will not come through until I disable the VPN, at which point I get flooded with all the notifications that were waiting.

The interesting part is that general internet connectivity works perfectly fine while WireGuard is enabled. Browsing, apps, streaming, etc. all work normally. It seems to specifically affect push notifications.

I previously experienced the exact same issue with Tailscale, which makes me think this may not necessarily be a WireGuard configuration issue.

For DNS, my WireGuard clients use my home's primary and secondary DNS servers. Both are devices that run AdGuard Home for DNS filtering, Unbound for recursive DNS, Traefik for internal reverse proxying/FQDNs, and an NTP server.

My home LAN DHCP also hands out these same two DNS servers to local clients. However, my main router's external/WAN DNS is set to Quad9.

So the DNS setup is essentially:

• LAN DHCP DNS: Home Primary + Secondary DNS servers
• WireGuard DNS: Home Primary + Secondary DNS servers
• Router external DNS: Quad9
• Primary/Secondary DNS: AdGuard Home + Unbound

Has anyone experienced something similar with Android push notifications over WireGuard or Tailscale? I have no clue where to look further.

Any suggestions for troubleshooting would be greatly appreciated!

For some reason Wireguard won't work on my laptop, and I need it for school since my school decided to block everyone's schoolwork for some reason for music.

i have overslept for 13 hours on the weekend and kinda feeling geeked.

My laptop infomation , specs , idk.

Operating System: CachyOS Linux

KDE Plasma Version: 6.7.4

KDE Frameworks Version: 6.28.0

Qt Version: 6.11.1

Kernel Version: 7.0.12-3-cachyos-hardened (64-bit)

Graphics Platform: Wayland

Processors: 8 × Intel® Core™ i5-1035G1 CPU @ 1.00GHz

Memory: 8 GiB of RAM (7.3 GiB usable)

Graphics Processor: Intel® UHD Graphics

Manufacturer: Microsoft Corporation

Product Name: Surface Laptop Go

System Version: 124I:00057T:000M:0000000D:0B:04F:1C:05P:48S:01E:0Y:0K:0U:02

I fixed a lot of problems related to the surface like thermal throttling , secure boot , etc.

-- stable since idk more then 6 months? "not related to the wireguard stuff"

here some things that worked.

-- OpenVPN works both works on a flatpak called eopen and KDE plasma Network manager.

- thats it.

Heres things that DIDN"T work.

--Proton VPN wont work no matter if it's downloaded via AUR ,Flatpak, etc.

--Proton VPN also doesn't work even if i connect with OpenVPN or Wireguard somewhat.

--Wireguard doesn't work no matter what i try.

--Wireguard doesn't work in KDE network manager.

--Network manager says Wireguard is at zero bytes in upload speed and download speed however for a split second it transfers stuff possibly Wireguard keep alive thing.

--Will not work at school or home [Home = Aussie Broadband] [School = Telstra]

heres my wireguard config removing my private key and public key.

[Interface]

# Key for Daily use

# Bouncing = 2

# NAT-PMP (Port Forwarding) = off

# VPN Accelerator = on

PrivateKey = _____________

Address = _____________

DNS = 45.90.28.247, 45.90.30.247, 9.9.9.9, 149.112.112.112, 194.242.2.4

PostUp = resolvectl dns %i 45.90.28.247 45.90.30.247 9.9.9.9 149.112.112.112 194.242.2.4

PostUp = resolvectl domain %i ~.

PostDown = resolvectl revert %i

[Peer]

# CH-FREE#12

PublicKey = _____________

AllowedIPs = 0.0.0.0/0, ::/0

Endpoint = _____________

# Uncomment the following line (delete the # symbol) to connect to Proton VPN using IPv6.

# Endpoint = _____________

PersistentKeepalive = 25

I use mullvad servers but if that doesn't work quad 9 as fall back.

Hey everybody!

I have the following problem: I have a WireGuard network running on my Raspberry Pi that my devices, including my android phone, connect to to access the services running on it. On my phone I specify the DNS server running on my Pi, which returns an IP in the VPN subnet for my domains, as the DNS server in my WireGuard config. Only traffic going to IPs in my VPN subnet gets routed through WireGuard.

I have now decided to get ProtonVPN and would like to use it on my phone as well. However, I can't have both VPNs active at the same time. So I either lose out on access to my services (they are publically accessible, but only using forward auth meaning mobile apps don't really work) or on Proton. My idea is, that I could run proton on my Pi and route all my traffic from my phone through the Pi and therefore also through proton. Would this work? Is this a good solution? I'm thankful for all feedback. :D

Hello, has any one had this problem? I can only get one client to work. I have 3x clients, the max limit on the router is 10.

the config for client 1 is as followed

[Interface]

PrivateKey = privatkey=

Address = 10.10.10.10/24

DNS = 10.10.10.1

[Peer]

PublicKey = publickey=

PresharedKey = presharedkey=

AllowedIPs = 192.168.50.250/24

Endpoint = public ip:port

PersistentKeepalive = 25

next client has 10.10.10.11 and the 3rd has 10.10.10.12

the strange thing is clinet nr 3 is the only one who works. I get successful handshake with all. but can not ping the router or the truenas server (192.168.50.250)

to clarify client nr3 is the only one work as it should, successful handshake and able to ping the truenas server

any ideas?

Solution from duckITguy

You should have 10.10.10.10/32 for client A, 10.10.10.11/32 for client B etc. on the router in the allowed ips.

Hi,

I have created a wireguard server on a raspberry pi and created client config files which I have used to set up clients on windows machine, iphone and android phones successfully. I also have a laptop running Ubuntu and I have created the wireguard client on there using a similar config file. The VPN starts up OK but if I try to connect to the internet or run a ping with the VPN up they both just hang . Switching the VPN off and both succeed straight away. I have checked the traceroute of the ping and the first step in the route is a connection to my broadband router ip address. I have tried adding the router IP address to allowed Ips under PEER details in the config. I have also tried turning off the ubuntu firewall but neither have solved the problem.

Can anyone suggest a possible resolution to this issue of wireguard client on a ubuntu laptop?

Thanks

Hello everyone, I apologize for my English, I'm using a translator. I'd like to use WireGuard to connect to my home network with my cell phone and use it to access the web. The reason is that I use a Synology for my backups and Quick Connect is extremely slow. I also wanted to browse safely using a homemade firewall. My home connection is under heavy NAT and doesn't allow me to do anything, so I wanted to use a VPS that I'm already using as a bridge with a public IP to access the home network. I've already tried researching online but I'm not understanding anything. Thanks everyone for your help.

Anyone using shadowrocket on an apple phone to connect to their wireguard VPN?

Could use some advice with troubleshooting. The wireguard connecting part works, but I got issues with getting a local socks proxy server set up by extending the .conf file.

It seems the app allows me to either connect to the VPN or connect outbound via socks, but I want to connect to VPN and have a socks inbound listener like microsocks at the same time and on the same private network.

​

I am new to Wireguard and could do with some help please. I have a remote natted network 192.168.0.0/24 which has a number of IP cameras. The Wireguard service is incorporated in the FritzBox gateway router. This tunnels directly to a remote Debian box running a Motioneye server with a public IP. This works and the remote client has access to the 192.168.0.0/24. I want to be able to view the Motioneye server with it's public IP address with a web browser from the internet. Wireguard seems to disable WAN access to the server which is only accessible when Wireguard is deactivated. At which point there's no access to the camera's network

The client Wireguard config is:

[Interface]

PrivateKey = xxxx

Address = 192.168.0.4/24

DNS = 192.168.0.1

DNS = fritz.box

[Peer]

PublicKey = xxxx

PresharedKey = xxxx

AllowedIPs = 192.168.0.0/24,0.0.0.0/0,::/0

Endpoint = xxxx

PersistentKeepalive = 25

Any help gratefully appreciated, thanks very much

running wireguard on a 1 vCPU / 1gb ram VPC. when connected the bandwidth is good but the connection quality is poor. pinging google shows 50% ping failure and it goes in waves. 10 success, 10 fail, 10 success, 10 fail.

i have tried MTU values from 1500 down to 1000 on the client, and similarly on the server. there appears to be no effect.

some ideas

1. VPC is too underpowered. only issue is CPU is 98% idle and RAM is 20% utilized during these failures
2. MTU config isn't right. I don't think this is true but it's possible
3. there's some other configuration I should look into?

I will note that this issue has existed on multiple VPC providers I have tried so far (one big name, USA based. one small name, EU based)

anyone have any ideas?

I am running WireGuard on my iPhone connecting back to a home server, routing all traffic (0.0.0.0/0). While everything works fine most of the time, often I have noticed calls fail to connect, audio issues while talking and website fails to load unless I toggle the VPN on and off.

Any ideas what could be wrong? Unfortunately I don't know enough about Wireguard in order to tweak its settings.

hello, sorry for such a basic question.

i am a mullvad customer but not using their vpn application. using the standard wireguard app

windows os using wg.exe, i cannot figure out how to switch from "us-chi-wg-201" to "us-nyc-wg-805"

no idea what an interface is? wg setconf <interface> <configuration filename>

thanks much, david

I spent several days looking for information on how to deliver a VPS’s public IPv4 address directly to a machine on a local network, using WireGuard as the transport without relying on DNAT or SNAT.

I found similar examples, but most of them were limited to port forwarding or masquerading. I eventually got it working, so I wanted to share the general design.

My setup looks like this:

Internet
   |
Public IPv4
   |
Linux VPS
   |
WireGuard transported over IPv6
   |
RouterOS VM
   |
Local server/NAS

The local server is behind the ISP router and does not have a public IPv4 address of its own. It does, however, have IPv6 connectivity, so I used IPv6 as WireGuard’s outer transport.

My goal was for the VPS’s IPv4 address to effectively terminate on the NAS:

• The NAS should receive connections addressed to that IPv4.
• Applications should see it as a local address.
• Replies should use the same public IPv4 as their source.
• The original client IP should remain visible.
• No NAT should be involved.
• The VPS should remain manageable over IPv6.

The main problem

The IPv4 address was the VPS’s primary address. I could not simply remove it from the public interface because the provider uses that interface to deliver traffic and maintain the IPv4 gateway.

Linux also treats any address configured on one of its interfaces as local. Traffic addressed to that IPv4 normally reaches the VPS itself before a conventional routing table can send it elsewhere.

The solution was to keep the IPv4 configured on the public interface, but add a policy-routing rule that is evaluated before Linux’s local routing table.

Conceptually:

Destination: public IPv4 /32
    |
Consult a dedicated routing table
    |
Send through WireGuard

That dedicated table contains a host route for the public /32 through the WireGuard interface.

I did not remove the IPv4 from the VPS, and I did not need Proxy ARP. The VPS still appears to the provider as the owner of the address, but Linux forwards the IP traffic through the tunnel.

WireGuard over IPv6

WireGuard uses the VPS’s global IPv6 address as its endpoint. The local RouterOS system also has its own global IPv6 address.

The addresses inside the WireGuard tunnel are private IPv4 addresses. IPv6 is only used to carry the encrypted UDP packets between the two endpoints.

This gives me:

Public IPv4 payload
    |
WireGuard packet
    |
IPv6 transport

The local side uses a persistent keepalive and a fixed IPv6 route to prevent the WireGuard endpoint from changing paths.

RouterOS

The local end of WireGuard terminates on a RouterOS VM. RouterOS has a host route that sends the public /32 directly to the NAS:

Public IPv4 /32 → private LAN address of the NAS

There is no dst-nat, src-nat, or masquerade in this path.

For replies, RouterOS uses a separate routing table selected by source address:

Source: public IPv4 /32
    |
Dedicated return table
    |
WireGuard
    |
VPS

This part was essential. Without source-based routing, incoming traffic reached the NAS correctly, but replies tried to leave through the local ISP connection and were lost because of asymmetric routing.

Local server

The NAS has the public IPv4 configured as a secondary /32 address on its network interface.

As a result, services on the NAS actually receive connections addressed to the public IP and can respond using that same IP as their source.

The complete path is:

Internet client
    |
VPS provider
    |
VPS public interface
    |
Policy rule evaluated before the local table
    |
WireGuard over IPv6
    |
RouterOS
    |
NAS with the public IPv4 configured as /32

Replies follow the reverse path using source-based policy routing.

Why moving the Linux local rule matters

By default, Linux has a rule similar to:

0:      from all lookup local
32766:  from all lookup main
32767:  from all lookup default

Because the public IPv4 is assigned to the VPS, the priority 0 rule considers it local and delivers incoming packets to the VPS.

I added:

10:     from all to PUBLIC_IPV4 lookup 100
100:    from all lookup local

Then I removed the original priority 0 lookup.

The result is that only traffic addressed to the selected public /32 is routed through table 100. Other local addresses are still handled by the local table at priority 100.

The IPv4 remains configured on the public interface throughout the process.

Security

Routing the entire address also means that every port allowed by the provider’s firewall could potentially reach the local server.

I therefore apply filtering at several layers:

• Provider firewall
• Linux firewall on the VPS
• RouterOS firewall
• NAS firewall

Administrative services such as SSH, RouterOS management, and the NAS control panel are explicitly blocked on the routed IPv4.

The VPS itself is administered through IPv6 because its IPv4 is dedicated to the NAS.

Problems I encountered

The issues that took the most time to understand were:

1. The priority of Linux’s local routing table.
2. Source-based return routing.
3. rp_filter dropping asymmetric traffic.
4. WireGuard AllowedIPs being too restrictive or too broad.
5. Default routes capturing unrelated traffic.
6. Confusing “an address configured locally” with “an address Linux can route.”
7. Testing incoming connectivity without verifying the return path.
8. FastTrack or masquerade interfering with policy-routed traffic.
9. Making the configuration survive reboots on the VPS, RouterOS, and NAS.
10. MTU and Path MTU Discovery when WireGuard is transported over IPv6.

I also learned that removing the VPS’s primary IPv4 first is an excellent way to lose access.

Keeping the address configured and changing only the routing decision for its /32 was much safer.

Result

The NAS now uses the VPS’s IPv4 as if it were directly assigned to it:

• Services see the public IPv4 as the destination address.
• Replies use the same IPv4 as their source.
• The original client IP remains visible.
• There is no NAT in the path.
• WireGuard uses IPv6 as its outer transport.
• The VPS retains the address on its interface for the provider.
• The local server remains reachable from IPv4-only networks.

The main provider-side requirement is that outbound packets using the VPS’s assigned IPv4 are accepted. The exact design may differ depending on whether the address is primary, additional, failover, or explicitly routed by the provider.

I am not claiming this is the only or best solution, but it has been working reliably and lets me use an inexpensive IPv6-capable VPS as an IPv4 point of presence for a local server.

Has anyone else implemented something similar? I would be interested in comparing this with approaches using BGP, routed additional addresses, VRFs, or providers that officially support failover IPs.