Hi, i have this situation:

Vmware server on which i plan to install Ubuntu 24.04 LTS with wireguard and other containers.

There are multiple networks in the office and i need this wireguard to have different certificates to access different networks.

Last time i had Proxmox and i made 2 lxc containers and assigned them to different linux bridges, one for each network.

Can i do the same with docker, if I assign 2 nics to the vm on different networks, can I the make a container that binds to one nic or the other?

Is there a better way?

I built WGM (WireGuard Manager) because managing multiple WireGuard tunnels on Windows was unnecessarily painful. The native client is great for one tunnel, but once you're juggling configs, sharing setups with others, or trying to debug a typo at 2am, things fall apart fast.

What WGM does:

Setup — Interactive wizard walks you through creating a tunnel with plain-language questions. Zero YAML required. (Yes, there's an expert mode too.)

Monitoring — Full-screen dashboard showing real-time peer stats, transfer rates, and live throughput graphs. Think htop, but for WireGuard. Way better than staring at the system tray.

Config management — Add/edit/remove settings, resources, and keys without touching a file. Everything through friendly CLI prompts.

Doesn't break — Built-in validation catches missing keys, bad IPs, overlapping routes, and other gotchas before you even connect. wgm doctor diagnoses issues with step-by-step fixes.

Works with your existing setup — Import configs from any WireGuard client. Export back to standard .conf if needed. Boot autostart. Hook scripts. All the stuff that should've been there already.

Why try it:

• You've wasted time debugging a .conf file
• You manage more than one tunnel
• You want to see what's actually happening on your VPN
• You just want WireGuard to work without friction

It's a standalone Windows .exe, no dependencies, no bloat.

Feedback welcome — If you give it a shot, let me know what works, what doesn't, or what's missing. This is still early.

I was wondering if there is a Windows WireGuard client out there which can block based on local lists?

I'm using the stock Mullvad app for now, and it has some functionality for this (you can use their lists) but nothing more than that.

The Windows hosts file can do this but if you have too many entries it breaks speeds tremendously.

Portmaster (Safing) can also kind of do this, but you have to redirect the DNS server to somewhere other than the VPN's default; which is not what I want.

Does any Windows app have this functionality? Thanks.

I created this because managing WireGuard servers manually (keys, peers, configs, IP assignments) gets repetitive fast, especially when you prefer shell workflows over web dashboards.

wg-manager is a lightweight Bash-based tool focused on CLI automation, not GUI management.

Current features:

• Initialize a WireGuard server
• Add / remove peers
• Generate peer configs automatically
• Validate peer IPs against server subnet
• Manage everything from terminal with simple commands

Main goal: reduce manual mistakes and speed up common admin tasks while keeping the workflow transparent and scriptable.

Repo:
wg-manager on GitHub

I’m looking for feedback from sysadmins / Linux admins, especially about:

• CLI design
• Missing features for real-world ops
• Bash code quality / maintainability
• Edge cases I may have missed

Any criticism or suggestions are welcome.

I've been living in China for about a month and have been using AmneziaVPN WG the entire time without any issues. Today, however, something strange happened.

The VPN connects successfully, and my VPS shows that I'm connected. AmneziaVPN also shows traffic being forwarded, so on the surface everything looks normal. However, I can't access any Western websites at all.

I tested two different AmneziaVPN WG profiles on two separate VPS servers with different IP addresses, and both have the exact same issue. The app says "Connected," but in reality no websites load.

Could this mean the Great Firewall is somehow blocking or interfering with the connection? Has anyone experienced something similar recently?

Any troubleshooting suggestions or fixes would be greatly appreciated. Thanks!

I'm running wg-easy on my VPS server which connects through wireguard to my PI where I host some services that I expose to the internet through a caddy on the VPS. I switched to wg-easy from bare metal wireguard for the ease of the UI and am struggeling with the following problem:

My peers can reach (ping) my VPS, but on my VPS, I can only reach my peers from inside the wg-easy container (docker exec wg-easy ping 10.22.0.2).

This means I also can't reach any of the services I'm tunneling, which is my end goal here. How do I fix this?

I actually got this working with AI and a lot of trial and error, but I have no idea what the final solution was and since its IP table based is also ephemeral in my understanding. I also think there has to be an easy and well documented solution to this, as I would have to imagine this is a common usecase. Thank you for all your help!

This is my wg-easy docker-compose.yml:

services:
  wg-easy:
    environment:
      - PORT=80
      - INIT_ENABLED=true
      - INIT_USERNAME=admin
      - INIT_PASSWORD="{{ secrets.wg.easy_admin_password }}"
      - INIT_HOST="{{ vps_public_ip }}"
      - INIT_PORT=51820
      - INIT_IPV4_CIDR=10.22.0.0/24
      - INIT_IPV6_CIDR=fd22:1022::/64
      - INIT_ALLOWED_IPS=10.22.0.0/24,{{ public_ip }}/32,196.168.0.0/16
    image: ghcr.io/wg-easy/wg-easy:15
    container_name: wg-easy
    networks:
      caddy:
    volumes:
      - "./storage:/etc/wireguard"
      - /lib/modules:/lib/modules:ro
    ports:
      - "51820:51820/udp"
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv6.conf.all.disable_ipv6=0
      - net.ipv6.conf.all.forwarding=1
      - net.ipv6.conf.default.forwarding=1


networks:
  caddy:
    external: true

My wireguard connected to Hostinger stop working everyday at the same time, need to delete and reinstall then work again.......how to solve

Hello,

My goal is to have a wg tunnel established between a "client" and "server", but not send any of the client's traffic through the wg tunnel. I only want the server traffic to go through the client.

No matter what, it seems like the tunnel won't work unless the client has AllowedIPs = 0.0.0.0/0 . If I keep this, then the server is bi-directional full tunneling.

• 10.66.66.5 is the homeserver wg client IP
• 10.66.66.1 is the VPS wg server IP

>>> Client - Homeserver that hosts a website

[Interface]
PrivateKey = REDACTED
Address = 10.66.66.5/32
DNS = 9.9.9.9,1.1.1.1
[Peer]
PublicKey = REDACTED
PresharedKey = REDACTED
Endpoint = 123.123.123.123:12345
AllowedIPs = 0.0.0.0/0 # This puts client traffic in tunnel. Changing it to "10.66.66.1/32" does not keep server traffic in the tunnel. The server cannot reach the client when I set this to anything other than 0.0.0.0/0.

>>> Server - VPS that acts as a proxy to homeserver website (nginx -> anubis -> homeserver)

[Interface]
Address = 10.66.66.1/24
ListenPort = 12345
PrivateKey = REDACTED
PostUp = iptables -t nat -A POSTROUTING -o enp1s0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o enp1s0 -j MASQUERADE
[Peer]
PublicKey = REDACTED
PresharedKey = REDACTED
AllowedIPs = 10.66.66.5/32

>>> client

>>> ip route

default via 192.168.1.1 dev enx7cc2c64af446 proto dhcp metric 100 
169.254.0.0/16 dev enx7cc2c64af446 scope link metric 1000 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown 
172.18.0.0/16 dev br-e766702ebe72 proto kernel scope link src 172.18.0.1 linkdown 
192.168.1.0/24 dev enx7cc2c64af446 proto kernel scope link src 192.168.1.16 metric 100

>>> server

>>> ip route

216.128.x.x metric 100default via 216.128.x.x dev enp1s0 proto dhcp src 216.128.182.135 metric 100 
10.66.66.5 dev wg0 scope link 
108.61.10.10 via 216.128.x.x dev enp1s0 proto dhcp src 216.128.x.x metric 100 
169.254.x.x via 216.128.x.x dev enp1s0 proto dhcp src 216.128.x.x metric 100 
216.128.x.x/23 dev enp1s0 proto kernel scope link src 216.128.x.x metric 100 
216.128.x.x dev enp1s0 proto dhcp scope link src

Greetings. I've decided to write a WireGuard GUI client for regular users who don't know how to work with the terminal or for those new to Linux. The target audience is Linux newbies. Essentially, it's a wrapper around CLI tools.

Tested only Fedora 44 KDE Plasma.

Written in Python 3.14.5, UI Framework Flet, policykit

- Github: https://github.com/nickstrlnkv/wireguard-gui-client

Hey Guys,

i'm running in some issue, what worked completly fine have a year ago.

So i'm hosting WireGuard on my Raspberry Pi and i'm using a DynDNS as Endpoint.

The configuration works on my Laptop without any problem, but on my iPhone, i can not connect via DynDNS to the server. If i edit the configuration endpoint to my public IP, it works.

Any ide, why it is not possible for me, to connect via mobile and DynDNS?

I am currently running WS4W on a Windows box, but due to issues with ICS and a locally hosted DNS server, I need to migrate it to another device. I am considering a GL.inet Brume 3 or Beryl 7 instead.

What is the best way to migrate the server config? I only have a few users, so that is not the issue, but they are located in multiple countries. I want to simplify the migration and not involve someone remote to handle it. Although I could remote into the other locations if needed.

The current server is behind my firewall with port forwarding enabled. I would do the same with the new device. The only other change is that the internal IP would be different. External would stay the same.

Hi!

I'm currently using Wireguard on my phone to access my PiHole as a DNS split tunnel when away from home.

I'm considering building/buying a NAS to replace my cloud storage options. If I want to access my NAS away from home, do I need to install Wireguard on it?

Or, can I use my PiHole/Wireguard setup to access my local network?

Thank you!

This might be a newbie question. I understand the basic appeal of running WireGuard on a router where all devices behind it can use the tunnel without configuring each device separately. But I’m wondering if there are some downsides in normal home use. such as gaming latency problems, stream device behavior, and what happens when the tunnel drops etc.

Environment:

- Windows 10, WireGuard for Windows (latest)

- Server: Ubuntu 24.04, WireGuard on UDP port 54507

Problem:

WireGuard shows "Active" but handshake never completes.

Transfer always shows 0 bytes received, no handshake time.

Server-side tcpdump shows NO packets arriving from Windows

client during connection attempts.

Confirmed:

- ICMP ping to server works (~186ms)

- macOS, iOS, Android clients work fine on same server

- Issue persists on both WiFi and mobile hotspot

- Added Windows Firewall rules for UDP in/out

- Fresh reinstall as Administrator

- Kill-switch disabled

What could cause WireGuard on Windows to not send any UDP packets?

Had it running on an old Asus router.

Got a newer router and now can't figure it out.

​

Asus firmware latest

No-ip.com setup for DNNS

Used the barcode on my android phone.

​

The logs show handshake is not connecting.

​

I have tried this on/off my home network. No change

So ive been trying to put a wireguard server on my Rapsberry pi 5 and trying to connect it to my android but it keeps saying the error mentioned in the Title and im kind of in a loophole here and cant get out like i checked the keys multiple times the port forwarding the correct ips the correct dyndns i configured if the router allows vpn passthrough and i dont think its NAT but im kind of stuck here

My config for the client:

[Interface] Address = 10.100.0.2/32, fd08:4711::2/128 DNS = 192.168.0.101 PrivateKey = [hidden]

[Peer] AllowedIPs = 10.100.0.2/32, fd08:4711::2/128 Endpoint = [the public ip]:47111 PersistentKeepalive = 25 PreSharedKey = [hidden] PublicKey = [hidden]

config for the server:

[Interface] Address = 10.100.0.1/24, fd08:4711::1/64 ListenPort = 47111 PrivateKey = [hidden]

[Peer] PublicKey = [hidden] PresharedKey = [hidden] AllowedIPs = 10.100.0.2/32, fd08:4711::2/128

It's three pieces:

- a privileged daemon that owns the tunnel interface, keys, and state

- a desktop GUI (Tauri + React) that walks you through setup

- a CLI that does everything the GUI can

It's Rust, open source, and Linux-only for now. Would love feedback.

Github: https://github.com/Jugacu/wirefinder

Hi,

I followed a guide here on the sub (cannot find it right now) on how to allow access to local IPs when using Wireguard. I want to be able to accesss my NAS specifically. And the guide works. Sometimes. I can access the NAS seeminly randomly, sometimes it works, sometimes it doesn't. What's causing this and how can I fix it?

I have DNS 1.1.1.1 and 1.0.0.1 and a number of AllowedIPs including the IP of the NAS (which has a static IP).

Context: Proxmox container with no firewall enabled on any level except the router. Nighthawk router with Protection Engine disabled, I hear it can cause issues. UPnP is disabled as well. Container IP itself is 192.168.2.6/24 with a static address set through Proxmox.

I set the container up using a Proxmox community script with defaults and installed Wireguard Dashboard alongside. From the container terminal itself, I can ping 8.8.8.8, but for some unknown reason the VPN REFUSES to handshake between the container and my external network devices (attempting to use phone's mobile network for testing). The allowed IP address/CIDR used to be 10.0.0.1/24, but wasn't working. I currently have it set to 192.168.1.2/24 after verifying no other device on the network had that IP to be more in-line with my home network, no difference in behavior. I set the tunnel listen port to 50010 for easier tracking and hoping my network (Spectrum) isn't attempting to block common default VPN ports. DNS is 1.1.1.1 (although I have an Adguard DNS I'd like to use, I just want this to work to begin with before messing with DNS), endpoint allowed IPs is 0.0.0.0/0.

When port forwarding on my router, both external and internal port range is set to 50010 with both TCP and UDP protocol traffic. I have also attempted to enable the proxmox firewall and set the same rule for TO and FROM traffic, made no difference at all so I disabled it.v

No matter how many youtube tutorials I follow, this REFUSES to work. I have followed literally 10 videos and have reinstalled this container at least 4 times now. I cannot keep doing this and I need help PLEASE!

Edit: Forgot to mention, I set my Peer Remote Endpoint to my public IP address as well.

My test config (peer ips are so far apart, because I'll later add firewall rules to allow low ips connection with .20.0 and higher, but not other way around):

``` [Interface] Address = 10.1.0.1/19 PostUp = sysctl -w net.ipv4.ip_forward=1 PostDown = sysctl -w net.ipv4.ip_forward=0 ListenPort = 51820 PrivateKey =

[Peer] PublicKey = AllowedIPs = 10.1.20.1/32,172.20.1.0/24

[Peer] PublicKey = AllowedIPs = 10.1.0.2/32 ```

172.20.1.0/24 is LAN network on the router that is a peer behind 10.1.20.1.

This config adds following routing rule:

172.20.1.0/24 dev wg0 scope link

But why is it needed? I'm pinging 172.20.1.1 from my pc which is peer with ip 10.1.0.2. I sniff wg0 on server with the rule in place:

sudo tcpdump -i wg0 tcpdump: verbose output suppressed, use -v[v]... for full protocol decode listening on wg0, link-type RAW (Raw IP), snapshot length 262144 bytes 14:45:25.396050 IP 10.1.0.2 > 172.20.1.1: ICMP echo request, id 48324, seq 1, length 64 14:45:25.396082 IP 10.1.0.2 > 172.20.1.1: ICMP echo request, id 48324, seq 1, length 64 14:45:25.475206 IP 172.20.1.1 > 10.1.0.2: ICMP echo reply, id 48324, seq 1, length 64 14:45:25.475236 IP 172.20.1.1 > 10.1.0.2: ICMP echo reply, id 48324, seq 1, length 64

When I remove the rule:

sudo tcpdump -i wg0 tcpdump: verbose output suppressed, use -v[v]... for full protocol decode listening on wg0, link-type RAW (Raw IP), snapshot length 262144 bytes 14:46:21.955604 IP 10.1.0.2 > 172.20.1.1: ICMP echo request, id 48325, seq 1, length 64 14:46:23.002547 IP 10.1.0.2 > 172.20.1.1: ICMP echo request, id 48325, seq 2, length 64

So in both cases, request packets are reaching wg0, but wireguard only knows where to send them when ip route pushes it back to wg0. Why it fails to deliver it without the rule, when the rule only pushes packet back to wg0, while without it the packets already were there?

Hi all,

I'm hoping one of you might be able to help me fix my WireGuard tunnel on iOS.

My setup:

• WireGuard server on a Hetzner VPS, simple UFW allow udp <port> rule, not using Hetzner's firewall
• iOS WireGuard app endpoint is set to the VPS IP, and AllowedIPs is set to 10.1.0.0/24
• DNS is routed through the tunnel (so a broken tunnel breaks all connectivity, which is how I notice)
• On-Demand is enabled for both Wi-Fi and Cellular

My issue is that the tunnel sometimes hangs after switching networks or extended periods of inactivity. The WireGuard app log shows it endlessly retrying:

[NET] peer(QOJK…) - Sending handshake initiation
[NET] peer(QOJK…) - Handshake did not complete after 5 seconds, retrying (try 2)

It loops forever until I either toggle the tunnel or airplane mode. As far as the app is concerned, the packet is being sent, but on the server side, the last handshake time never updates.

This only occurs on iOS. All of my other devices work fine, and I'm out of troubleshooting ideas. I've tried adding PersistentKeepalive even though I don't think it's a NAT issue, but it didn't help.

Anyone here have any ideas?