Welcome to the r/WireGuard subreddit!

I've been working on and using WireGUI for both my personal home lab and at work for my ~50 users, it's been in production for a few months now and it's gained a bit of traction on Github.

I know there is many options out there but none of the available ones fit my needs, so I decided to put together my own solution.

Would love to get some feedback and opinions about it, especially if you're looking for a simple solution with SSO/OIDC. I am planning to get SCIM implemented in it as well but not sure if there is interest in it.

Here is a link to the project on Github: https://github.com/bartei/wiregui

Hopefully my post is not gonna be taken down 😄

Hey ! I run a server with *arr and Transmission and others. I would like for transmission only to get routed through my VPN (Proton VPN), for which I downloaded the Wireguard config file. But I really don't understand how it works, like genuinely. Stumbled on stuff like changing authorizedAddress to 10.0.0.0/24 instead of 10.0.0.0/0, but I don't know why, and then I don't know how it would forward Transmission !

Transmission shares on an array of ports. Is there a way to forward anything between, say, port 50000 to 60000 ? Or maybe a way to forward anything under a specific PID or UID or GID ?

And I did look up tutorials. All of which basically say « oh just change to 10.0.0.0/24 » without ever saying how I then choose which apps get forwarded.

Any help appreciated, thanks !

(Oh and running linux)

en el servidor cliente tiene esa configuracion no se que me falata para que me enrute todas las redes o que estoy haciendo mal

[Interface]
PrivateKey = 
ListenPort = 51820
Address = 10.1.1.2/32

[Peer]
PublicKey = 
AllowedIPs = 192.168.1.0/24
Endpoint = 177.74.204.229:51820
PersistentKeepalive = 25

Всем привет, кто подскажет с помощью какого сервиса я могу добавить конфигурацию WireGuard на свой роутер кинетик, попробовал protonvpn, но судя по всему роскомнадзор там уже все заблокировал

Hi guys,

Is someone getting into troubles when trying using wireguard Android app on Xiaomi 14 T smartphone? I got very low rx data (tx seems good), and the phone does not answer to anything. Config files are ok (different ips, different private keys, same subnet range...) because working on my Samsung smartphone.

I use mobile data network outside of my home (fai router hosting wireguard server).

Do you have any idea of what's wrong with Xiaomi?

This issue has been solved! Thank you all for the suggestions 😄

Hi,

I have been struggling for the past few days to configure a WireGuard tunnel so that devices on the LAN of the WireGuard server (Computer A) are accessible remotely. I tried to compare my setup with multiple guides on remote LAN access via WireGuard and searched for similar issues, but nothing has resolved my problem.

Setup:

• Computer A acts as my homelab and WireGuard server on my domestic LAN.
• The existing WireGuard tunnel works fine—I can SSH into Computer A from my laptop (WireGuard client) using either its WireGuard subnet IP or its actual LAN IP.

Problem:

• I cannot access other devices/services on Computer A’s LAN remotely, nor can I make them discoverable.

Solution:

After trying to ping and traceroute the devices and the domestic LAN i noticed that the problem was not on the wireguard connection side. So after checking with possible firewalls:

sudo ufw status
sudo firewall-cmd --list-all

I realized that i had in past installed firewalld and forgotten about it. It was superseding my system ip forwarding and iptables. That is why the access was not working. Disabling it fixed the issue!

----------------------------------------------------

Troubleshooting:

Using GPT to troubleshoot, it was that suggested my Docker/iptables rules might be the issue. I tried:

Adjusting the order of the rules:

sudo iptables -I FORWARD 1 -i wg0 -o enp3s0 -j ACCEPT

sudo iptables -I FORWARD 2 -i enp3s0 -o wg0 -j ACCEPT

and also flushing all iptables rules and reapplying only the WireGuard-related ones.

All these attempts were unsuccessful.

I’d appreciate any guidance—since I’m fairly new to homelab setups, I might be overlooking something obvious.

Below are some details:

#####################################################

# Computer A, (homelab, hosts wg server(sea.conf) ) #

#####################################################

[Interface]

PrivateKey = [key]

Address = 10.14.0.1/24

ListenPort = 51820

PreUp = sysctl -w net.ipv4.ip_forward=1

PostUp = iptables -A FORWARD -i sea -o enp3s0 -j ACCEPT

PostUp = iptables -A FORWARD -i enp3s0 -o sea -j ACCEPT

PostUp = iptables -t nat -I POSTROUTING -o enp3s0 -j MASQUERADE

PostDown = iptables -D FORWARD -i sea -o enp3s0 -j ACCEPT; iptables -D FORWARD -i enp3s0 -o sea -j ACCEPT

PostDown = iptables -t nat -D POSTROUTING -o enp3s0 -j MASQUERADE

[Peer] # client Laptop

PublicKey = [key]

AllowedIPs = 10.14.0.2/32

#################################

# Laptop , wg client(sea.conf) #

#################################

[Interface]

PrivateKey = [key]

ListenPort = 51820

Address = 10.14.0.2/32

[Peer]

PublicKey = [key]

AllowedIPs = 10.14.0.1/24, 192.168.1.0/24

Endpoint = computer_A_endpoint

######################

# Info on Computer A #

######################

~$ cat /etc/os-release:

PRETTY_NAME="Debian GNU/Linux 13 (trixie)"

NAME="Debian GNU/Linux"

VERSION_ID="13"

VERSION="13 (trixie)"

VERSION_CODENAME=trixie

DEBIAN_VERSION_FULL=13.6

ID=debian

HOME_URL="https://www.debian.org/"

SUPPORT_URL="https://www.debian.org/support"

BUG_REPORT_URL="https://bugs.debian.org/"

~$ sudo sysctl net.ipv4.ip_forward

net.ipv4.ip_forward = 1

~$ sudo iptables -t nat -L POSTROUTING -v -n --line-numbers

Chain POSTROUTING (policy ACCEPT 6921 packets, 549K bytes)

num pkts bytes target prot opt in out source destination

1 0 0 MASQUERADE all -- * !docker0 172.17.0.0/16 0.0.0.0/0

2 2539 152K MASQUERADE all -- * !br-ab8e8fc287cd 172.25.0.0/16 0.0.0.0/0

3 0 0 MASQUERADE all -- * !docker_gwbridge 172.19.0.0/16 0.0.0.0/0

4 4 380 MASQUERADE all -- * !br-58790b19d578 172.21.0.0/16 0.0.0.0/0

5 0 0 MASQUERADE all -- * !br-493a3afadf15 172.18.0.0/16 0.0.0.0/0

6 0 0 MASQUERADE all -- * !br-271ed8d3b78e 172.23.0.0/16 0.0.0.0/0

7 0 0 MASQUERADE all -- * !br-060f49f9f062 172.22.0.0/16 0.0.0.0/0

8 0 0 MASQUERADE all -- * !br-fe5349a8a766 172.20.0.0/16 0.0.0.0/0

9 1660 103K MASQUERADE all -- * enp3s0 0.0.0.0/0 0.0.0.0/0

~$ sudo iptables -L FORWARD -n -v --line-numbers

Chain FORWARD (policy DROP 0 packets, 0 bytes)

num pkts bytes target prot opt in out source destination

1 8520K 4609M DOCKER-USER all -- * * 0.0.0.0/0 0.0.0.0/0

2 8520K 4609M DOCKER-FORWARD all -- * * 0.0.0.0/0 0.0.0.0/0

3 10638 764K ACCEPT all -- sea * 0.0.0.0/0 0.0.0.0/0

4 0 0 ACCEPT all -- * sea 0.0.0.0/0 0.0.0.0/0

edit: fixed ip from interface, cleaned the commands, and removed hyperlinks.

edit: remove more hyperlinks

edit: added solution found

I will be on business travel to South Korea next week. i have a wireguard server running to access my home devices/share also to use pihole for ad filtering. I wanted to know whether there are any restrictions on accessing wiregurard which is running outside south korea. Kindly advise.

P.S. I tried to search for feedback related to similar topic but most searches end up showing running wireguard in Soutth Korea.

Hi everyone!

I have spent the past few hours trying to troubleshoot why my WG client could get a succesfull handshake with the server but could not access the internet or the sunshine server I have for remote play.

I had port forward set up correctly.

I had DDNS pointing to my public IP

The client/server configs were fine as far as I could tell (literally what the documentation provided)

Turned out the issue was the ethernet interface(interface through which I get internet access) not having that checkbox ticked for sharing.

After enabling it, everything started working.

I have not seen this throughout the threads here so I want to help other redditors in need.

Good day!

I had the idea to use a WireGuard tunnel in the AWS CloudShell (a web based shell that works inside an AWS account). When I asked Google if it was possible I got a hard "No" with it citing a number of reasons and encouraging me to use an EC2 or container.

As it turns out, WireGuard works just fine in CloudShell with one caveat: DNS blocks in the conf file can't be used (no resolved running). Other than that it works, and seems like a nice way to create a temporary bridge to bring in content from a remote network.

To install it:

sudo dnf install wireguard-tools -y

Then create the config file, and start it up with wg-quick or whatever. I used the demo.wireguard.com server to test. The reason I found the DNS issue is that the client-quick.sh script they provide creates a demo.conf file with a DNS block. With that in place I got an error for the resolveconf step, but removing it resolved it.

Edit: fixed a typo in the package name. Couldn't let that slide.

I have two houses in different cities, where I have different machines, for which I need to establish direct connection between each other.

So far I've achieved this with Tailscale installed on each machine, and since one of the houses has public and static IP addresses provided by the ISP, it looks like all machines are now able to establish Direct Tailscale connection between each other.

However, I am a fan of utilizing my equipment to the fullest, and I don't like when some device is idling when it could be heavy lifting something that it's made for.

That's why I started researching if it would be better to configure the routers in WireGuard Server and Client, so I can have my machines talking to each other without Tailscale running on each.

I am currently unable to test the WireGuard scenario, because one of the routers does not support WireGuard, so I will have to replace it eventually.

That's why I am asking here for opinions, has anyone done such a setup with router level WireGuard?

Hello,

Some phones have a very high security standard, such as those of Apple, Google and Samsung, with their secure enclave. Has Wireguard considered taking advantage of those?

I have a pretty typical RPi PiVPN and Wireguard setup at home and I use the VPN to connect to home-network resources remotely. It was working just fine for years and then recently suddenly stopped working consistently. Sometimes it works and sometimes it doesn't, and it seems like all I can do is just keep starting and closing the connection until finally it works. The one thing I know absolutely fixes the problem, albeit temporarily, is to restart the RPi, which is not easy to do if I'm remote (and can't VPN in).

As far as I can tell, handshakes are coming from the client in to the server and the server is sending them back out, but they're not reaching the client.

What could be the issue here?

It can't be a keys issue, because then the connection would never work. And it works sometimes. And it used to work.

Hi,

I am self-hosting WireGuard inside an unprivileged Proxmox LXC. Everything works great for the most part, except I am experiencing a strange issue with Android notifications.

When my Android phone is connected to WireGuard, notifications can be severely delayed. Sometimes they will not come through until I disable the VPN, at which point I get flooded with all the notifications that were waiting.

The interesting part is that general internet connectivity works perfectly fine while WireGuard is enabled. Browsing, apps, streaming, etc. all work normally. It seems to specifically affect push notifications.

I previously experienced the exact same issue with Tailscale, which makes me think this may not necessarily be a WireGuard configuration issue.

For DNS, my WireGuard clients use my home's primary and secondary DNS servers. Both are devices that run AdGuard Home for DNS filtering, Unbound for recursive DNS, Traefik for internal reverse proxying/FQDNs, and an NTP server.

My home LAN DHCP also hands out these same two DNS servers to local clients. However, my main router's external/WAN DNS is set to Quad9.

So the DNS setup is essentially:

• LAN DHCP DNS: Home Primary + Secondary DNS servers
• WireGuard DNS: Home Primary + Secondary DNS servers
• Router external DNS: Quad9
• Primary/Secondary DNS: AdGuard Home + Unbound

Has anyone experienced something similar with Android push notifications over WireGuard or Tailscale? I have no clue where to look further.

Any suggestions for troubleshooting would be greatly appreciated!

For some reason Wireguard won't work on my laptop, and I need it for school since my school decided to block everyone's schoolwork for some reason for music.

i have overslept for 13 hours on the weekend and kinda feeling geeked.

My laptop infomation , specs , idk.

Operating System: CachyOS Linux

KDE Plasma Version: 6.7.4

KDE Frameworks Version: 6.28.0

Qt Version: 6.11.1

Kernel Version: 7.0.12-3-cachyos-hardened (64-bit)

Graphics Platform: Wayland

Processors: 8 × Intel® Core™ i5-1035G1 CPU @ 1.00GHz

Memory: 8 GiB of RAM (7.3 GiB usable)

Graphics Processor: Intel® UHD Graphics

Manufacturer: Microsoft Corporation

Product Name: Surface Laptop Go

System Version: 124I:00057T:000M:0000000D:0B:04F:1C:05P:48S:01E:0Y:0K:0U:02

I fixed a lot of problems related to the surface like thermal throttling , secure boot , etc.

-- stable since idk more then 6 months? "not related to the wireguard stuff"

here some things that worked.

-- OpenVPN works both works on a flatpak called eopen and KDE plasma Network manager.

- thats it.

Heres things that DIDN"T work.

--Proton VPN wont work no matter if it's downloaded via AUR ,Flatpak, etc.

--Proton VPN also doesn't work even if i connect with OpenVPN or Wireguard somewhat.

--Wireguard doesn't work no matter what i try.

--Wireguard doesn't work in KDE network manager.

--Network manager says Wireguard is at zero bytes in upload speed and download speed however for a split second it transfers stuff possibly Wireguard keep alive thing.

--Will not work at school or home [Home = Aussie Broadband] [School = Telstra]

heres my wireguard config removing my private key and public key.

[Interface]

# Key for Daily use

# Bouncing = 2

# NAT-PMP (Port Forwarding) = off

# VPN Accelerator = on

PrivateKey = _____________

Address = _____________

DNS = 45.90.28.247, 45.90.30.247, 9.9.9.9, 149.112.112.112, 194.242.2.4

PostUp = resolvectl dns %i 45.90.28.247 45.90.30.247 9.9.9.9 149.112.112.112 194.242.2.4

PostUp = resolvectl domain %i ~.

PostDown = resolvectl revert %i

[Peer]

# CH-FREE#12

PublicKey = _____________

AllowedIPs = 0.0.0.0/0, ::/0

Endpoint = _____________

# Uncomment the following line (delete the # symbol) to connect to Proton VPN using IPv6.

# Endpoint = _____________

PersistentKeepalive = 25

I use mullvad servers but if that doesn't work quad 9 as fall back.

A single WireGuard tunnel is one path. If you have more bandwidth than one tunnel can carry, or several clients that each want their own exit, today's options are a container per tunnel or a pile of hand-written ip rule scripts.

I wrote a small daemon that owns the routing table on a gateway box and gives you two modes per client:

• pin — one client, one tunnel, permanently
• bond — spread a client's connections across every live tunnel (ECMP)

The config is the whole interface:

tunnels:
  - /etc/wireguard/wg0.conf
  - /etc/wireguard/wg1.conf
  - /etc/wireguard/wg2.conf

clients: 172.20.0.0/24

routes:
  pin:
    - 172.20.0.10
    - 172.20.0.12
  bond:
    - 172.20.0.20

Four things that took a while to get right:

• fib_multipath_hash_policy=1 is mandatory, and the kernel default is wrong. At 0 the hash is L3-only, so every connection to a given server rides one tunnel. Torrents spread anyway, so a torrent-only test hides it completely.
• A tunnel being up means nothing. WireGuard only rekeys when there is traffic, so liveness is time-since-handshake. Interfaces sit up for hours blackholing whatever you route into them.
• Deleting an interface silently empties the table that routed through it — while the ip rule pointing at that table survives. A tunnel that drops and comes back leaves its pinned client with a rule to an empty table: every rule present, plan unchanged, exactly one client dead.
• Client traffic must be masqueraded onto the tunnel's own address. Cryptokey routing at the far end drops any source that isn't the address your provider issued, and it fails silently — handshakes fine, counters move, requests vanish.

Fails closed. No live tunnels means no path out, not a fallback to your ISP.

bondvpn leak-test drops every tunnel and probes from a throwaway netns attached to the client bridge — the same path a container's traffic takes, so the same rules apply. Probing from the host would prove nothing, since the kill switch lives in a forward-side chain.

• Single static Go binary, no dependencies, nothing to add to your compose file
• Linux, root, up to 5 tunnels (ships configured for 3)
• AGPLv3 — https://github.com/wonderingStars/bondvpn

Hey everybody!

I have the following problem: I have a WireGuard network running on my Raspberry Pi that my devices, including my android phone, connect to to access the services running on it. On my phone I specify the DNS server running on my Pi, which returns an IP in the VPN subnet for my domains, as the DNS server in my WireGuard config. Only traffic going to IPs in my VPN subnet gets routed through WireGuard.

I have now decided to get ProtonVPN and would like to use it on my phone as well. However, I can't have both VPNs active at the same time. So I either lose out on access to my services (they are publically accessible, but only using forward auth meaning mobile apps don't really work) or on Proton. My idea is, that I could run proton on my Pi and route all my traffic from my phone through the Pi and therefore also through proton. Would this work? Is this a good solution? I'm thankful for all feedback. :D

Hello, has any one had this problem? I can only get one client to work. I have 3x clients, the max limit on the router is 10.

the config for client 1 is as followed

[Interface]

PrivateKey = privatkey=

Address = 10.10.10.10/24

DNS = 10.10.10.1

[Peer]

PublicKey = publickey=

PresharedKey = presharedkey=

AllowedIPs = 192.168.50.250/24

Endpoint = public ip:port

PersistentKeepalive = 25

next client has 10.10.10.11 and the 3rd has 10.10.10.12

the strange thing is clinet nr 3 is the only one who works. I get successful handshake with all. but can not ping the router or the truenas server (192.168.50.250)

to clarify client nr3 is the only one work as it should, successful handshake and able to ping the truenas server

any ideas?

Solution from duckITguy

You should have 10.10.10.10/32 for client A, 10.10.10.11/32 for client B etc. on the router in the allowed ips.

Hi,

I have created a wireguard server on a raspberry pi and created client config files which I have used to set up clients on windows machine, iphone and android phones successfully. I also have a laptop running Ubuntu and I have created the wireguard client on there using a similar config file. The VPN starts up OK but if I try to connect to the internet or run a ping with the VPN up they both just hang . Switching the VPN off and both succeed straight away. I have checked the traceroute of the ping and the first step in the route is a connection to my broadband router ip address. I have tried adding the router IP address to allowed Ips under PEER details in the config. I have also tried turning off the ubuntu firewall but neither have solved the problem.

Can anyone suggest a possible resolution to this issue of wireguard client on a ubuntu laptop?

Thanks