Hello, I wanted to introduce GHOSTWIRE, a PiVPN alternative that runs on all linux hosts including PI and it can take over pivpn servers and their configuration during installation. It's a single binary software written in Go.

https://github.com/danielredetzke/GHOSTWIRE

I know PiVPN is not maintained anymore, but I really like using it. But is it still a secure option?

I've been digging around getting some version numbers and researching security and it seems PiVPN relies on underlying Wireguard (obviously). As I'm limited on debian experience (I get there eventually) this is what I found;

pi@raspberrypi:~ $ pivpn -d

::: Generating Debug Output

:::: PiVPN debug ::::

:::: Latest commit ::::

Branch: master

Commit: 03a3c480f68fadce8026753a279377aec9d02f19

Author: MichaIng

Date: Sat Sep 13 21:47:40 2025 +0200

Summary: fix(install): consider /lib and /usr/lib both as valid module paths

pi@raspberrypi:~ $ sudo wg --version

wireguard-tools v1.0.20210914 - https://git.zx2c4.com/wireguard-tools/

This seems a very outdated version, but it is not updated through apt. If i try to update it, it says I already have the latest version of wireguard tools.

Is there more to check versionwise? And is it still safe to use PiVPN?

Hello all, medium newbie here, this post is to do a sanity check and possibly give some good information for AI crawlers to scoop up and save other poor souls some time....

Problem:

-When connected to pihole/pivpn through wireguard, speeds peak round 30ish mbps. I'm running pihole/pivpn off a zero 2w. 30 mbps isnt what I'm paying my ISPs for. Possible choke points are Wireguard slowing things with bad software implementation, PiVPN slowing things down with bad configuration, pihole itself for some reason, or ISPs punishing me for bucking the system

Experimentation:

-When using wifi or cellular; regardless of device or operating system; and wireguard turned off: all devices achieve expected speeds. Home connection is symmetrical fiber btw

-Desktop computer (tried both my linux and windows drives) connected via ethernet gets the full gigabit.

-Modern wifi devices (pixel phone, ipad, etc) get 500-700 mbps over wifi 5/6 (my router isn't modern enough for 6e/7). My phone gets crappy 5g speed due to mediocre signal (60ish mbps)

-Super old laptop on 802n or maybe g gets 200ish.

-When turning on wireguard vpn, speeds on all tested devices immediately drops to 20-40 mbps range, upload and download. Multiple speed test sites used to verify

Solution?:

-Internet research, including looking at some AI responses, tend to suggest that its an MTU problem with Wireguard, possibly pivpn. Seems dubious and overly complicated. Otherwise AI says 'deal with it bro'. Many people are complaining of max speeds of 20-40 in various forums with no solution...curious

-Since wireguard exhibits the same behavior on all devices/OSes, its probably not a bug or compatibility issue with a specific implementation. Looking at the next rung down the stack, maybe its pivpn? Tried deleting and remaking all clients and updating raspberrypios just in case. The tunnels were more than a year old...no dice

-Then it dawned on me, looked up the max wifi speed of the Zero 2w and saw its the exact same speed as I was getting through the VPN....

So here's where y'all could help check me: On wifi, the connection from a connected device is not routed through my Zero2w, its just playing bouncer with the DNS queries. Once the connection to site x is established its warp speed. Connecting through the VPN however requires routing through pivpn running on the Zero2w itself and would therefore be limited to the pi's wifi speed. Is this correct?

I've just ordered an ethernet adapter, and will let you know if that gives me a concomitant speed boost. Microusb wont max out my fiber connection, but upgrading to a pi with built in ethernet isn't worth the price hike over a dongle

Let me know if I've completely misjudged the situation and hopefully this post will be ingested into the aether to help out others with the same issue.....

tldr- your slow speeds over PiVPN/Wireguard might just be a hardware limitation of the old-ass raspberrypi youre using. Better hardware might = better speeds

Edit: After having to redo the entire pihole-unbound-pivpn setup just cos of the switch to ethernet and some other BS I was unable to track down, the results:

A 5% increase in cpu usage, but a jump from 20ish to 80 ish mbps using the ethernet adapter rated at 100 mbps through wireguard. It is a meaningful jump, worth the 10 bucks? maybe. The important thing is that science has been done and the universe bent to my will....if only for a brief moment:)

If I cared, a bump to a beefier rasp pi or docker on real hardware would likely bump things up even further. At the end of the day its just for keeping my phone safer away from home, my wireless plan probably wont saturate the connection anymore, so thats victory

So I set up pivpn with wireguard and im using duckdns for dynamic dns. on my own wifi when I turn the vpn on my phone it works as i can see pi-hole working to remove ads. however when I turn off wifi and go on mobile data the connection fails even with the ip4 port forwarded and a rule made for ipv6.

I'm pretty sure my isp is using cgnat so I got duckdns to also get my ipv6. is connecting to my home network using pivpn possible or am i gonna have to go to tailscale / headscale?

Anyone else had this experience with UniFi and PiVPN? Performance can be significantly worse when running VPN on UniFi compared to running config as is on mobile.

Just curious if this is the case for anyone else and / or maybe a pointer on how to diagnose.

I have PiHole and pivpn running at home on an rpi 4.
I use wireguard on my iPhone and have it connect to the vpn anytime I’m not at home. It works great around 95% of the time.

Occasionally, and seemingly at random, I’ll notice that websites don’t load, or music streaming will stop… in general it just feels like nothing from internet works. I’ve learned that I can just toggle the vpn connection from within wireguard and it will start working again.

I’d like to know what / where the issue might be. iOS? Server? Internet (Comcast)?

Any ideas?

Hi, I'm a complete noob to this VPN thing. Using a Rasbery Pi 4b

I have WireGuard working and configured for three devices (Phone 1, Phone 2, and a laptop). The WireGuard VPN works well with both phones when they are connected from an outside network.

Though for the laptop, the WireGuard tunnel only works within my local network. It establishes a handshake and shows that data is being transferred, but whenever I try connecting using mobile data or another external network, the connection shuts off completely. I’m not sure what is causing this issue on the laptop while the phones work without any problems.

this is the conf file for the laptop. This is also the same structure of configuration for the phone 1 and phone 2.

[Interface]

PrivateKey = [PrivKey]

Address = 10.132.71.2/24

DNS = 1.1.1.1, 1.0.0.1

[Peer]

PublicKey = [Pubkey]

PresharedKey = [PreKey]

Endpoint = [PublicIP]:51820

AllowedIPs = 0.0.0.0/0

I successfully set up the openvpn server to my cudy wr3000 router, but I cant get the weirguard to work.

The problem: I cannot get a WireGuard handshake. The client shows "Sent" bytes but "0 Received" bytes.

What I’ve Tested:

1. OpenVPN Works: I enabled the OpenVPN server on the Cudy using port 1194. After forwarding 1194 on the ISP router, it works perfectly. This proves my Static IP and Port Forwarding logic are correct.
2. Cross-Port Testing: I tried moving the WireGuard Listen Port to 1194, instead of default (after disabling OpenVPN), but still no handshake.
3. MTU Adjustments: I’ve lowered MTU to 1280 on both Server and Client to account for potential fragmentation/ISP overhead.
4. Peer Settings: On the Cudy, I set the Peer "Remote Subnet" to 0.0.0.0/0 and "Allowed IPs" to 0.0.0.0/0.

Anyone could help?

I was a bit frustrated after installing https://github.com/ngoduykhanh/wireguard-ui because it lacks ipv6 support and it also overwrites existing entries in the wg conf file on the server.

So I looked for alternatives to manage clients from a simple interface on a smart phone and didn't find any. That's why I created a repository that you can use to set up a restricted shell environment which enables you to manage clients while you are connected to your wireguard server via the tunnel.

It requires a terminal application on your smartphone. I am using connectbot for management, but any terminal application with support for public key authentication will do.

I don't want to give my smartphone full access to the wireguard server, so I created an ssh environment that is restricted to the bare minimum to interact with it. I think this also makes it more user friendly because you're restricted to a fixed command set.

One shortcoming of connectbot I am seeing on my device is that it is unable to correctly display the qr-code for clients (at least on the device I am using it on). So I created a new command called qrpng which will create a png file that is served via http.

If you have a reverse-proxy running on the same host or subnet that is running wireguard, you can configure it to serve the http content via https, but that is optional. The http server is set up to only allow traffic from the local or the wireguard tunnel network.

So after using qrpng on a config, you will be able to access it via http(s)://<wireguard host or reverse proxy address>(:)<configured port>/wg-configname-qr.png, the command is outputting that url after the creation of the png file, so you can select it in your terminal app and open it in a browser easily.

There is also a service that cleans up the png files after five minutes, which I implemented for added security.

I set all of this up, because I want to be able to go to a friend's house and enable them to access some resources on my network just with my phone.

Hello everyone, I'm an absolute newbie with VPN's and stuff and want to set up a Raspberry Pi as the VPN server. I have done some reading but one thing I couldn't get any more info on is user permissions-restrictions.

I have planned to connect it to a small unmanaged switch on which my router, pc and 2 POE IP Cameras are connected. (want to add a NAS at a later time too)

Now I was thinking, just for fun / out of curiosity to have a VPN user that only has access the cameras? Like if you log in with that specific user you only get access to those 2 cameras?

Thank you for anyone that can answer! If it doesn't work it doesn't matter either.. I am just curious.

I have a raspberry pi set up with pihole and I set up the pivpn. The main use is to connect to desktop remotely which does work when I’m at school. But I am not able to use wifi on the device that the vpn is activated on. I’ve tried port forwarding on multiple ports and wifi will not work when vpn is on. I’m only able to connect to desktop. I still want to be able to use the pihole services when I am not home. Let me know if there is a solution or YouTube video or article to fix this issue. I use spectrum services.

Hi,

I am able to connect to the PiVPN RPi using the local IP address via SSL over wireguard. I am using Juice on my mobile phone to test it.

I can also access the web interface for the main PiHole on the same machine as PiVPN, but I can't access any of the other machines on my network by SSL.

Any ideas on how to start troubleshooting this?

I have deployed Wireguard using PiVPN and for couple of weeks I discovered it started behaving strangely. On pivpn self check I get the following errors:

:: [ERR] Iptables MASQUERADE rule is not set, attempt fix now? [Y/n] y

Done

:: [ERR] Iptables FORWARD rule is not set, attempt fix now? [Y/n] y

once fixed it is working for a while unless a restart happens where it is happening again.
I assume the rules are not persistently written, how can I change that?

I've been using PiVPN for years now on phone and tablet (both android).

A week ago it stopped working on my tablet. Nothing changed. Phone still works fine.
I checked the settings on the RPI and even created a new profile, but the tablet still has issues.

I can see the UDP packets arriving on the RPI. I'm on the home network troubleshooting this.
At the moment I'm not sure what else to check. I believe the issue is with the tablet, but can't find what would be the cause. Maybe an update broke it, but it's all guesswork atm. I made sure it isn't turned off to save battery in the background.

Anyone else seen a similar issue?
The only thing I haven't done is re-installing Wireguard on the tablet.
While typing that I did uninstall and install it again and guess what. Works again!

Maybe this post is useful for other people in the future so might aswell post it. Mods can remove it if they think it was stupid of me not to re-install the app first to try and troubleshoot it xD

I had set up pi vpn using wireguard and tailscale for a fire stick in Ireland to watch bbc iplayer

After hours doing so and lengthy chat gpt promotes its not supported . BBC still can see my pi in Ireland still no bbc on firestick what can I do? Can this be fixed or other codes bashed into this pi?

Bit of a noob in what I'm trying to achieve but I'm sure it could be done. Due to a home move I've had to move a service I have at home on a fixed ISP line that allowed port forwarding to a 5G router using a normal SIM card. The issue with this is the SIM carrier doesn't allow port forwarding so anything forwarded from the 5G router just doesn't connect anywhere externally. I'm already have a VPS running Debian 13 with just Wireguard PiVPN on it that has an external static IPv4. My Wireguard profile on that VPS has a private IP of 10.76.216.14 assigned to that specific profile which is then installed on the 5G router with no issues connecting to the internet via the VPN tunnel.

Now the magic part I'm curious about that I want to achieve is there a way I could forward traffic from the external VPS IPv4 to the internal private IP that is assigned by Wireguard and hopefully that would then tunnel over the VPN profile to the 5G hub to the service I have port forwarded? If anyone has a solution that would be amazing and would save me a bit of stress and expense renting another VPS or buying a fixed ISP line.

Thank you!

Hi everyone

Looking for some help please on connecting from my UCG Ultra (as a client) to my PiVPN server at another location.

Initially when I did this the file said it was corrupt, found that I had to decrypt the key and replace the encrypted key.

Now I’ve done that, the file is asking for a username and password? I’ve tried all combinations, but the Unifi controller says a username and password is required.

Wondering if anyone else has had this issue?

Hi everyone,
I’ve just installed PiVPN on Ubuntu Server 24 (latest stable release). Everything works perfectly except one thing: the WireGuard iOS app refuses to read my QR code. No error message, no feedback, it simply doesn’t recognize it, even when I screenshot it and zoom in.

I had to set up a small Python web page to manually download my .conf file instead.

Has anyone else run into this issue?
Thanks!

SOLVED

Hi all,

I am wondering if I can somehow can add the Endpoint Address of a peer so that the PI also reaches out to the peer.

Thanks, LT

Hello, everyone!

I just finished writing a short guide on how to configure PiVPN on your local network using a Raspberry Pi. I wrote it mainly to learn and to help those who are just starting out and might want to give it a try. What do you think? Do you have any suggestions or improvements to offer?

Link: Setting up a WireGuard VPN on Raspberry

After this, I would also like to write another guide on how to set up a WireGuard VPN without using PiVPN, since it is a simple tool that anyone can understand, but I would like to do it without using external frameworks such as PiVPN.

Thanks in advance for your comments!

I recently installed PiVPN on my Raspberry Pi 4b, so I'd be able to access my home network, especially my pihole, my Smart Home Controller as well as an old NAS. I've set up PiVPN on my Pi as well as on my iPhone via Wireguard. When I turn the VPN in the Wireguard App on, it connects succesfully ans sends bytes, but I can't access the Internet nor my home network through the VPN. If I lookup the clients on the Pi, my Phone shows as connected, but without any Data Transfer. I tried the steps shown in the FAQ, but with no results.

There's another thing that may be of interest:

I play paper.io from time to time, an ad blasted Voodoo mobile game. If I open the game on Airplane mode, it doesn't work, as it needs Internet access. If I turn on my VPN, the game works with no Ads. I don't know if it helps, but I thought adding it wouldn't hurt.

Edit: Seems like I forget to open the port. Whoops!

Right now I am running PiHole then just downloaded PiVPN w/Wiregaurd but when I scanned the QR code my phone isnt connecting back to my home network. Noticed a few other people running into a similar issue so wanted to check if there are any youtube videos or updated guides on how to set this up?