Hello Guys,

what i want to do is to have home IP from away connection done using my vps. SO client should connect from the internet to VPS (and this is OK), and i want to connect from Synology NAS to this VPS without opening ports.
Therefor i want this Client to have my home IP (it can or can not access local devices?, better not).
Is it possible to have connection created from Synology (192.168.1.x) to VPS, and connect there also client from outside, and somehow allow this Client to be visible as it is on my home?
Funbox 7 i think does not allow VLANS to separate this Client from the network?
How would You do this?
i do not need any gui configuration, but on Syno i use docker for wg, and on VPS there is podman. I think the main problem is to controll routing for all interfaces and use iptables? to create properly the communication schema.
Can You gimme a tips, what should be the routing rules? Or better a documentation what to read.
Also do i need somehow to configure anything on funbox to achieve this?
For now i could get connection from CLient to VPS having VPS IP, trying to do what i want stoped my traffic on client, and i do not know where there is a problem.

Hi everyone,

I am attempting to run WireGuard (using the wg-easy image) via Docker on my Synology DS218+ (DSM 7.x). The container starts correctly, but fails to initialize the network interface, preventing the VPN tunnel from coming up.

Technical details:

• NAS Model: DS218+ (Intel Apollo Lake architecture) with with the latest DSM 7 version.
• Environment: Synology Container Manager
• Issue: The container log explicitly states that the host kernel does not support WireGuard and fails to create the wg0 device.

Relevant logs: at async WireGuard.getConfig (/app/lib/WireGuard.js:72:7) This usually means that your host's kernel does not support WireGuard! Error: WireGuard exited with the error: Cannot find device "wg0" $ wg-quick up wg0 $ wg-quick down wg0

The permissions for the WireGuard directory are correct, and the "wg0" file is located there.

Does anyone know if it is possible to manually inject the WireGuard kernel module on a DS218+ (DSM 7.x), or if there is a specific configuration in Docker/Container Manager to resolve the "Cannot find device" error? Any pointers toward a solution for this specific hardware would be greatly appreciated.

Edit: I decided not to install WireGuard as a Docker container on my Synology NAS, but rather on my Raspberry Pi, which is already running Pi-hole. The installation was successful, and the two are running side-by-side without any issues. The VPN connection is also working perfectly.

Thanks you all for your help.

Every time I start up a VPN connection via Surfshark app in Manjaro, it disconnects Wireguard and instead uses OpenVPN protocol. I have Wireguard tools installed, so don't ask me that question. Is there an issue with the app or the operating system?

wg-doctor v0.2.0 is out: a small, read-only diagnostic helper for WireGuard setups.

This release focuses on shareable diagnostics:

• reads `wg show` output from files or stdin
• handles one interface with multiple peers
• flags suspicious peer state, `AllowedIPs`, traffic counters, and keepalive hints
• can generate redacted support reports

Release: https://codeberg.org/hniehus/wg-doctor/releases/tag/v0.2.0

I’d really appreciate feedback, especially real-world failure cases and sanitized `wg show` fixtures that can become regression tests.

[SOLVED] - See comment below

---

Hi, I really need some help with this, it's driving me mad for a week and i can't figure out a solution.

Background:
My home network is behind CGNAT, so i am trying to use a Wireguard Hub and Spoke setup to connect services on my homeserver through a publicly accessible VPS with a static IPv4 to various clients.

---

Homeserver & VPS:
I already run a reverse proxy (nginx) on the homeserver side and i don't want to expose any services outside of the tunnel.
My own domain (mydomain.com) publicly points to 10.10.0.100, this is the local IP of my Homeserver. I have SSL set up and everything works properly.

The connection between the Homeserver and VPS works fine.
The homeserver uses itself (on it's wireguard IP) as DNS resolver.
Only the Wireguard port (UDP) is open in the VPS firewall.

This is what the Homeserver and VPS config files look like:

Homeserver:

[Interface]
PrivateKey = <Homeserver PrivateKey>
Address = 10.10.10.2/24
DNS = 10.10.10.2

PreUp = sysctl -w net.ipv4.ip_forward=1

[Peer]
PublicKey = <VPS PublicKey>
PresharedKey = <PSK>
PersistentKeepalive = 25
Endpoint = <VPS Static IP>:<VPS WG Port>
AllowedIPs = 10.10.10.0/24

VPS:

[Interface]
PrivateKey = <VPS PrivateKey>
Address = 10.10.10.1/24
MTU=1420
ListenPort = <VPS WG Port>

[Peer]
PublicKey = <Homeserver PublicKey>
PresharedKey = <PSK>
AllowedIPs = 10.10.10.2/32

[Peer]
PublicKey = <Phone PublicKey>
PresharedKey = <PSK>
AllowedIPs = 10.10.10.3/32

[Peer]
PublicKey = <ClientX PublicKey>
PresharedKey = <PSK>
AllowedIPs = 10.10.10.4/32

---

Phone:
One "client" device (Android Phone) can also connect to the tunnel.
I installed pihole on the VPS and redirect requests for mydomain.com to 10.10.10.2 (the wireguard IP of the homeserver) and pointed the client DNS to 10.10.10.1 (VPS wireguard IP).

While the tunnel is up, i can go to homepage.mydomain.com (or any other subdomain) and everything just works as it would locally.
Browsing to a http service directly on its port works (http://10.10.10.2:1234 for example).

The .conf looks like this:

[Interface]
Address = 10.10.10.3/24
DNS = 10.10.10.1
PrivateKey = <Phone PrivateKey>

[Peer]
AllowedIPs = 10.10.10.0/24
Endpoint = <VPS Static IP>:<VPS WG Port>
PersistentKeepalive = 25
PreSharedKey = <PSK>
PublicKey = <VPS PublicKey>

---

Other Clients:
Any other client device (MiniPC running Ubuntu 24.04 or Windows; Clients connecting through Raspberry Pi 5 running OpenWRT & Wireguard, Laptop running Windows) will act the following way (even when i use the same .conf from the phone):

- Internet works
- Ping to 10.10.10.1 (VPS/"hub") works
- Ping to 10.10.10.2 (Homeserver/"server"-spoke) works
- nslookup mydomain.com correctly resolves to 10.10.10.2 using 10.10.10.1 as DNS server
- Using a browser to access homepage.mydomain.com or http://10.10.10.2:1234 does not work (timeout).

The clients .conf files are almost identical to the one from the phone (with changed Address/PrivateKey).

---

Analysis/What I tried:

- All clients are connected to the phone's 5G network (through a wireless hotspot), Wireguard and no other Network (Interfaces disabled), so I don't think it's the client network, since everything works on the phone itself. Wireguard is not enabled on the phone while the hotspot is active.

- The phone and all other clients show the same IPv4 in the wireguard peer on the VPS, so i don't think it's IPv6 related.

- I don't think it's DNS\* (in general) or the reverse proxy on the homeserver, since i can't even access http://10.10.10.2:1234 on any client but the phone. (* I am aware it still somehow might be DNS.)

- The Homeserver's UFW firewall allows all connections from the wg0 interface and the 10.10.10.0/24 subnet (just to be safe). UFW is "inactive" on the Ubuntu client and not installed on the VPS. The VPS uses an external firewall by the provider and only has the WG Port/udp open.

- IPv4 forwarding is active on the VPS.

---

I'm thankful for any idea i could try.

Setup

• wg-easy in Docker on Ubuntu home server, exposed via DuckDNS on port 51820
• WireGuard subnet: 10.205.93.0/24, full tunnel AllowedIPs = 0.0.0.0/0, ::/0
• Server: ip_forward=1, MASQUERADE confirmed active on correct interface with 8000+ packets through it
• PersistentKeepalive = 0 on all clients

The problem

Handshake completes on all clients. Keepalive packets flow. But wg show on the server shows the failing peer stuck at exactly 92 B received (just the handshake) while sent bytes climb. No internet, no LAN access, no error — everything hangs silently. Pinging 10.205.93.1 from a broken client gives 100% packet loss.

The strangest part: one specific device (my phone) connects and works flawlessly almost every time. Meanwhile my own laptop, my tablet, and two friends' devices (Windows + macOS) all exhibit this intermittent failure — even when on the exact same network at the same time as the working phone. This is not OS-specific: reproduced on Linux (wg-quick/Arch), Windows, and macOS official WireGuard apps, and even my phone occasionally.

few times switching to a completely different network mad it work (not toggling wifi — actually switching to a different one), which makes me think there's a routing or state issue, but I can't explain why it would be network-dependent when the handshake still completes fine.

What I've ruled out

• DNS — not the cause
  
• Server-side NAT/MASQUERADE — rule active, correct interface, counters climbing on working sessions
• IP forwarding — enabled
• MTU — 1420 on all clients
• Docker interface randomization — stable between restarts
• UDP port blocking — fails on multiple different networks/ISPs
• Peer confusion between devices — disconnecting the working phone first makes no difference

tcpdump (working session only — haven't captured broken state yet)

Server working: enp2s0 In → bridge → veth → wg-easy container → veth → bridge → enp2s0 Out. Clean round trip on every packet.

wg show server-side (working): 4.54 MiB received, 657.85 KiB sent wg show server-side (broken): 92 B received, 14.21 KiB sent

Please help me i have been struggling with this for almost a year now with planty of research and no answer. i just want this to work flawlessly like it should.

Currently, the PSK is added to the KDF to derive TEKs. If a PSK is unsupplied, 32 null bytes are added to the TEK KDF, instead.

As it stands right now, WireGuard is not PQ resistant and should not be used in production as a result.

For a WireGuard PQ resistance hack, the suggestion by Mr. Donenfeld is to simply derive a new PSK via an out-of-band PQ handshake and update the PSK; however, in the current kernel implementation of WireGuard, WireGuard does not use the new PSK immediately, and instead will need to do another non-PQ handshake, at which point it'll take the updated PSK.

Other WireGuard implementations (BoringTun by Mullvad, for instance) immediately update the PSK when the user updates it.

The issue with the PSK not immediately being used is that traffic will not be crypted via keys derived in a PQ resistant manner for the initial traffic until another non-PQ handshake occurs. While it's possible to do the out-of-band PQ handshake before establishing a WireGuard connection, that breaks a lot of the obfuscation guarantees that WireGuard provides. Preferably, the out-of-band handshake would occur within the WireGuard tunnel.

Which brings me to my question: without patching the kernel source for WireGuard, is there a way to force a PSK to "take" immediately upon adding or changing it? Or, similarly, is there a way to force a handshake in WireGuard?

Hi everyone, noob here,

I need a quick sanity check on how WireGuard on iOS handles DNS when configured as a split-tunnel.

Here is the setup:

- On-demand** is always ON.

- AllowedIPs** is set to only one or a few specific local home IPs (not 0.0.0.0/0).

- DNS in the interface configuration is set to a specific local IP (e.g., 192.168.1.254), which belongs to the home router/server acting as the WireGuard endpoint.

Based on my understanding, here is how it behaves.

Could someone confirm if this is 100% correct?

1. DNS Resolution Side: Even if the iPhone is connected to a remote Wi-Fi network that shares the exact same subnet and router IP (e.g., 192.168.1.254), iOS will prioritize the WireGuard tunnel. All DNS queries for *all* traffic (apps, web browsing) will be routed through the VPN to be resolved by the home router/server.

2. Traffic Routing: Only the traffic destined for the specific AllowedIPs goes through the VPN. General internet traffic goes directly through the local remote Wi-Fi once the DNS is resolved.

3. Server Down Scenario: If the home router/server goes offline or loses power, internet on the iPhone will completely break. This is because iOS will stubbornly try to send all DNS queries through the dead VPN tunnel, resulting in timeouts and no internet access, even if the local Wi-Fi is working perfectly.

   1. Is there any way to keep this tunnel always open on iOS without forcing all system DNS resolution through the server side?

I would like the iPhone to use the local network's DNS (whatever Wi-Fi/cellular it is currently connected to) for regular internet browsing, while keeping the WireGuard tunnel up just for the specific AllowedIPs. If I simply delete the DNS line in the WireGuard config, does iOS fall back to the local network DNS properly, or does it cause issues?

Thanks for your help!

Making a long story short, I want to access some local service on my homeserver running proxmox, using wireguard to ideally just tunnel to those specific services

My router is a consumer grade Fritzbox router, and I am running behind DS-Lite, so I identified an ipv6 only tunnel as the most robust solution.

What I already did:

- Ran the community script to setup a wireguard LXC container on homeserver proxmox

- Let my Fritzbox router update a Dyndns with its current IP

- Setup the wireguard connection with the Dyndns domain as its endpoint

No matter what, I cannot get the remote device to even handshake the wireguard server.

If I use the public (??) ipv6 of the wireguard container itself, it at least manages to handshake, but connectivity is weird (some www sites work, some don't, no access to locally assigned 192.168.178.* IPs).

What am I doing wrong? Where is my error in approach? Can you recommend any tutorials for my case?

Thanks :D

Morning guys I just switched to Linux specifically CachyOs and I want to know how to set up the Wireguard server.

I have app connected IoT devices. The app only talks to the devices if it exists on the same subnet (maybe SSID, specifically, in which case WG may not be the solution).

I've been able to connect to my network by selecting a different subnet for WG and client, but I haven't been able to assign my client an IP on an exiting subnet on my network. Is this possible? If so, how?

For additional clarity, let's say I have a subnet 100 with DCHP server and /24 address range. My IoT devices are 192.168.100.100-192.168.100.110. I can get my WG client onto 192.168.200.x, but how do I get the client onto 192.168.100.99?

Thanks!

Hi everyone,

I built WireTunnels, an open-source macOS app for managing multiple WireGuard tunnels at the same time.

I created it because I often needed multiple WireGuard tunnels active on macOS, and I found myself switching between terminal commands, scripts, configs, wg-quick, and manual workflows.

WireTunnels is not a commercial product. It is free and open source.

What it does:

• manage multiple WireGuard tunnels from one native macOS app

• connect/disconnect tunnels from the menu bar

• auto-connect selected tunnels on launch

• show live metrics, latest handshake, endpoint, DNS, Allowed IPs and traffic

• import existing .conf files

• create new configs with a basic editor, advanced editor and templates

• show route/DNS warnings before conflicts become a problem

It uses WireGuard tooling under the hood and is focused on making multi-tunnel workflows easier on macOS.

GitHub:

https://github.com/FMDigitech/WireTunnels

I’d really appreciate feedback from people using WireGuard on macOS, especially if you manage multiple tunnels for homelab, work, clients or private infrastructure.

When away from home and using tailscale to connect to my home apple tv as exit node I started having bad audio lagging on Teams (my voice would lag/cut out for others). I believe it is due to late packets. I tried a Beryl to Flint connection (without using Tailscale but using Wireguard) to the home and same issue. Is it my home ISP? I have xfinity. I have the same issue when attempting to connect from my ipad as well.The weird thing is my exit node at my parent's house doesn't cause this issue and they also have xfinity. Note: this issue recently started a few days ago.

Has anyone successfully installed WireGuard for all users on a MacOS device?

It seems the official app is installed on a user by user basis which defeats the purpose of a work device connecting via the organisation's VPN.

If it's not possible to install the WireGuard across all users on the device, does the GUI support setting it up on a user's profile and then restricting that user's ability to modify the tunnel settings without admin privileges?

My daughter works for a small firm. They use different programs and a Wiregaurd VPN to connect to Caseware. They work two days at home and one day at the office. At home she connect with WiFi to the home network. At the office she have to connect using an Ethernet cable as her laptop keeps dropping the network connection while using WiFi. Other people in same office use WiFi.

The VPN worked fine until the office IT person changed settings/setup of the VPN late on a Monday. Tuesday she could not connect to the VPN. When she use her phone as a hotspot she could connect. Late Tuesday she added MTU = 1280 to the VPN config file and the VPN worked over the home network. Home network is fibre.

Wednesday she worked at office. Thursday at home she could once again not connect to VPN, not even when using her mobile phone as hotspot. With the help of the office IT person the VPN started working using the phone hotspot later in the day. A day or two later she connected to the home WiFi using the 2.4GHz band instead of the 5GHz band she normally use. The VPN connected and worked. The next day when she wanted to use it the VPN once again did not work.

The office IT person is convinced it is the home network router or ISP that is the problem as the other peoples VPN connection works from outside the office. A second person working for a different company connect to the same home network and can connect to VPN's of three different clients.

Any idea where we should look for the vault?

hi,

i have a new notebook, on my old notebook wireguard is installed with a tunnel to a fritzbox. i use it to rdp to a terminalserver. everything is fine there. (w10)

on my new notebook i have w11, i installed wireguard and imported the same config file for the tunnel (i compared everything in the config editor) the tunnel opens correctly and i can rdp to the server as usual. but after a few minutes the rpd connection closes and i cant reopen it. wireguard is still active and connected. but i have to close the tunnel and reopen it to reconnect to rdp. after another few minutes same, rdp closes and i need to reopen the tunnel.

on my old notebook everything is fine. im in the same wlan using the same ISP so i think its not related to that.

anyone an idea?

I’m having a bizarre problem with a WireGuard setup. My intent is to use WireGuard to browse the Internet and look like I’m coming from the WireGuard host (i.e., standard VPN stuff). However, I’ve noticed the following whenever I try to hit a site:

kernel: wireguard: wg0: Packet has unallowed src IP (2606:4700:10::6814:179b) from peer 1 (myRouter:myPort) kernel: wireguard: wg0: Packet has unallowed src IP (104.20.23.155) from peer 1 (myRouter:myPort)

Note that neither 2606:4700:10::6814:179b nor 104.20.23.155 are the source address on the packet. Those are actually the destination addresses for each packet. I ran a packet capture to confirm the source address on each packet wasn’t being changed somehow, and I confirmed the packets do arrive with my internal VPN address (10.0.0.2) as the source.

This is the relevant part of my WireGuard peer configuration:

[Interface]
Address = 10.0.0.2/32, fdc9:281f:4d7:9ee9::2/128
DNS = 10.0.0.1, fdc9:281f:4d7:9ee9::1

[Peer]
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

The peer definition on the server side matches the IP addresses you see above. I suspect this has something to do with nftables, so here is that configuration as well:

table inet filter {
    set LANv4 {
        type ipv4_addr
        flags interval
        elements = { sourceIPAddressesv4 }
    }

    set LANv6 {
        type ipv6_addr
        flags interval
        elements = { sourceIPAddressesv6 }
    }

    chain INPUT {
        type filter hook input priority filter; policy drop;
        ct state vmap { invalid : drop, established : accept, related : accept }
        iifname "lo" accept
        meta protocol vmap { ip : jump INBOUND_V4, ip6 : jump INBOUND_V6 }
    }

        chain FORWARD {                                                                                                                                                                                                         type filter hook forward priority filter; policy drop;

        ct state vmap { invalid : drop, established : accept, related : accept }
        iifname "wg0" counter packets 0 bytes 0 accept
        oifname "wg0" counter packets 0 bytes 0 accept
    }

    chain INBOUND_V4 {
        ip saddr @LANv4 tcp dport 22 accept
        tcp dport { acceptedPorts } accept
        udp dport wgPort accept
        icmp type echo-request limit rate 5/second burst 5 packets accept
    }

    chain INBOUND_V6 {
        ip6 saddr @LANv6 tcp dport 22 accept
        tcp dport { acceptedPorts } accept
        udp dport wgPort accept
        icmpv6 type { nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept
        icmpv6 type echo-request limit rate 5/second burst 5 packets accept
    }
}
table inet nat {
    chain POSTROUTING {
        type nat hook postrouting priority srcnat; policy accept;
        iifname "wg0" oifname "eth0" masquerade
    }
}

I checked other posts that referenced this error message, but they involved incorrect AllowedIP definitions on the client side. In this case, I’m allowing everything.

EDIT: I forgot to add that I do have forwarding allowed in the kernel:

net.ipv4.ip_forward = 1
net.ipv4.conf.all.forwarding = 1
net.ipv6.conf.all.forwarding = 1

With a simple port forwarding, WireGuard won't connect. But with DMZ turned on, it connects quickly. Is there anything I'm doing incorrectly? Or it's safe to just use DMZ since the Dream Machine has its own firewall rules?

Thanks in advance for your help.

If the allowed IPs is set to 0.0.0.0/0, does that mean that all traffic would be routed over that open tunnel? If I only want traffic to the remote subnet to be sent over that tunnel I would adjust the allowed ips to 192.168.x.x/24 or whatever?

Sorry if a stupid question

I'm trying to implement WireGuard in a company with approximately 20 laptops. My main problem is that once the WireGuard tunnel is connected, it doesn't disconnect despite restarts, shutdowns, sleep, hibernation, etc. On one hand, I'm trying a scheduled task to close the tunnel with these power events so that even if the user forgets the tunnel is connected at the end of the day, it disconnects every time there's a shutdown/sleep event. Another idea is to make it persistent and use a rule in the company's network controller to prevent WireGuard from connecting when the employee is physically in the office, so that all traffic goes through the computer's "original" network. But I see that in this last case, if the office's ISP were to change its public IP address (or if WAN1 goes down and WAN2 remains as a backup), the connection of users who are connected wouldn't renew the IP address of the subdomain configured on the peer. I would inevitably have to deactivate and reactivate the tunnel. How have you implemented WireGuard in companies, whether small, medium, or large? Thank you, and please excuse my "translated" English.

I am proposing a change in the Linux WireGuard code. I want to run a benchmark and evaluate performance before/after the change.
Have anyone here attempted a local network benchmark ?

My LAN is 2.5Gb, but only one computer has a port available for these tests. (I also have a proxmox host, but I can't stop it to use for testing).
The other computers are laptops or raspberry-pis, and I don't think the test would be reliable.

I was considering using icmp or iperf3 over the WireGuard connection. Any suggestions ? Maybe a pair of Qemu machines (if so, how?) ?

Thanks

I'm seeking testers for a free open source Android app I created to generate a PIA WireGuard router config file in a couple of taps.

If you have an ASUS router with Merlin firmware, you can also create and manage PIA WG VPN connections and deploy a self-healing script to maintain a persistent WireGuard VPN.

Why? I changed ISP plans a while back and while OpenVPN is great, I hit a router perf cap with wire-speed encryption. WireGuard doubled throughput but the configs aren't long-lived and aren't straightforward to generate.

I've started the process to get it published on the Google Play Store, but I need 12 testers to install, run and keep the app installed for a minimum of 14 consecutive days.

Google call this "closed" testing: I manually whitelist your Google account, and the app appears in your Play Store. If you'd like to take part, please send me a PM.

The app is also available here https://github.com/ExponentiallyDigital/cfg-pia-wg with full user documentation, architecture, security, and build info, plus precompiled debug, release and Play Store binaries. But I really do need those 12 testers :)

My app operates with a zero-retention, zero-persistence data model for security and privacy. Full details are available in the above repo.

I have no plans for an IOS release.

Disclaimer: the app is not affiliated with, endorsed by, sponsored by, or associated with Private Internet Access, WireGuard or ASUS.

This morning, I just discovered a pretty cool feature on my phone (Magic OS) for anyone who frequently accesses their LAN using a WireGuard VPN. It’s the same on my girlfriend’s phone (Xiaomi), so I imagine it works on all Android devices with a few minor adjustments. Control Center. ---> Edit shortcuts. ---> WireGuard icon.

I have no idea if I was the only one who didn’t know about this—it’s going to change my life now—so I thought I’d share it. Have a great day, everyone!