r/WireGuard

Hey ! I run a server with *arr and Transmission and others. I would like for transmission only to get routed through my VPN (Proton VPN), for which I downloaded the Wireguard config file. But I really don't understand how it works, like genuinely. Stumbled on stuff like changing authorizedAddress to 10.0.0.0/24 instead of 10.0.0.0/0, but I don't know why, and then I don't know how it would forward Transmission !

Transmission shares on an array of ports. Is there a way to forward anything between, say, port 50000 to 60000 ? Or maybe a way to forward anything under a specific PID or UID or GID ?

And I did look up tutorials. All of which basically say « oh just change to 10.0.0.0/24 » without ever saying how I then choose which apps get forwarded.

Any help appreciated, thanks !

(Oh and running linux)

Всем привет, кто подскажет с помощью какого сервиса я могу добавить конфигурацию WireGuard на свой роутер кинетик, попробовал protonvpn, но судя по всему роскомнадзор там уже все заблокировал

en el servidor cliente tiene esa configuracion no se que me falata para que me enrute todas las redes o que estoy haciendo mal

[Interface]
PrivateKey = 
ListenPort = 51820
Address = 10.1.1.2/32

[Peer]
PublicKey = 
AllowedIPs = 192.168.1.0/24
Endpoint = 177.74.204.229:51820
PersistentKeepalive = 25

Hi guys,

Is someone getting into troubles when trying using wireguard Android app on Xiaomi 14 T smartphone? I got very low rx data (tx seems good), and the phone does not answer to anything. Config files are ok (different ips, different private keys, same subnet range...) because working on my Samsung smartphone.

I use mobile data network outside of my home (fai router hosting wireguard server).

Do you have any idea of what's wrong with Xiaomi?

This issue has been solved! Thank you all for the suggestions 😄

Hi,

I have been struggling for the past few days to configure a WireGuard tunnel so that devices on the LAN of the WireGuard server (Computer A) are accessible remotely. I tried to compare my setup with multiple guides on remote LAN access via WireGuard and searched for similar issues, but nothing has resolved my problem.

Setup:

• Computer A acts as my homelab and WireGuard server on my domestic LAN.
• The existing WireGuard tunnel works fine—I can SSH into Computer A from my laptop (WireGuard client) using either its WireGuard subnet IP or its actual LAN IP.

Problem:

• I cannot access other devices/services on Computer A’s LAN remotely, nor can I make them discoverable.

Solution:

After trying to ping and traceroute the devices and the domestic LAN i noticed that the problem was not on the wireguard connection side. So after checking with possible firewalls:

sudo ufw status
sudo firewall-cmd --list-all

I realized that i had in past installed firewalld and forgotten about it. It was superseding my system ip forwarding and iptables. That is why the access was not working. Disabling it fixed the issue!

----------------------------------------------------

Troubleshooting:

Using GPT to troubleshoot, it was that suggested my Docker/iptables rules might be the issue. I tried:

Adjusting the order of the rules:

sudo iptables -I FORWARD 1 -i wg0 -o enp3s0 -j ACCEPT

sudo iptables -I FORWARD 2 -i enp3s0 -o wg0 -j ACCEPT

and also flushing all iptables rules and reapplying only the WireGuard-related ones.

All these attempts were unsuccessful.

I’d appreciate any guidance—since I’m fairly new to homelab setups, I might be overlooking something obvious.

Below are some details:

#####################################################

# Computer A, (homelab, hosts wg server(sea.conf) ) #

#####################################################

[Interface]

PrivateKey = [key]

Address = 10.14.0.1/24

ListenPort = 51820

PreUp = sysctl -w net.ipv4.ip_forward=1

PostUp = iptables -A FORWARD -i sea -o enp3s0 -j ACCEPT

PostUp = iptables -A FORWARD -i enp3s0 -o sea -j ACCEPT

PostUp = iptables -t nat -I POSTROUTING -o enp3s0 -j MASQUERADE

PostDown = iptables -D FORWARD -i sea -o enp3s0 -j ACCEPT; iptables -D FORWARD -i enp3s0 -o sea -j ACCEPT

PostDown = iptables -t nat -D POSTROUTING -o enp3s0 -j MASQUERADE

[Peer] # client Laptop

PublicKey = [key]

AllowedIPs = 10.14.0.2/32

#################################

# Laptop , wg client(sea.conf) #

#################################

[Interface]

PrivateKey = [key]

ListenPort = 51820

Address = 10.14.0.2/32

[Peer]

PublicKey = [key]

AllowedIPs = 10.14.0.1/24, 192.168.1.0/24

Endpoint = computer_A_endpoint

######################

# Info on Computer A #

######################

~$ cat /etc/os-release:

PRETTY_NAME="Debian GNU/Linux 13 (trixie)"

NAME="Debian GNU/Linux"

VERSION_ID="13"

VERSION="13 (trixie)"

VERSION_CODENAME=trixie

DEBIAN_VERSION_FULL=13.6

ID=debian

HOME_URL="https://www.debian.org/"

SUPPORT_URL="https://www.debian.org/support"

BUG_REPORT_URL="https://bugs.debian.org/"

~$ sudo sysctl net.ipv4.ip_forward

net.ipv4.ip_forward = 1

~$ sudo iptables -t nat -L POSTROUTING -v -n --line-numbers

Chain POSTROUTING (policy ACCEPT 6921 packets, 549K bytes)

num pkts bytes target prot opt in out source destination

1 0 0 MASQUERADE all -- * !docker0 172.17.0.0/16 0.0.0.0/0

2 2539 152K MASQUERADE all -- * !br-ab8e8fc287cd 172.25.0.0/16 0.0.0.0/0

3 0 0 MASQUERADE all -- * !docker_gwbridge 172.19.0.0/16 0.0.0.0/0

4 4 380 MASQUERADE all -- * !br-58790b19d578 172.21.0.0/16 0.0.0.0/0

5 0 0 MASQUERADE all -- * !br-493a3afadf15 172.18.0.0/16 0.0.0.0/0

6 0 0 MASQUERADE all -- * !br-271ed8d3b78e 172.23.0.0/16 0.0.0.0/0

7 0 0 MASQUERADE all -- * !br-060f49f9f062 172.22.0.0/16 0.0.0.0/0

8 0 0 MASQUERADE all -- * !br-fe5349a8a766 172.20.0.0/16 0.0.0.0/0

9 1660 103K MASQUERADE all -- * enp3s0 0.0.0.0/0 0.0.0.0/0

~$ sudo iptables -L FORWARD -n -v --line-numbers

Chain FORWARD (policy DROP 0 packets, 0 bytes)

num pkts bytes target prot opt in out source destination

1 8520K 4609M DOCKER-USER all -- * * 0.0.0.0/0 0.0.0.0/0

2 8520K 4609M DOCKER-FORWARD all -- * * 0.0.0.0/0 0.0.0.0/0

3 10638 764K ACCEPT all -- sea * 0.0.0.0/0 0.0.0.0/0

4 0 0 ACCEPT all -- * sea 0.0.0.0/0 0.0.0.0/0

edit: fixed ip from interface, cleaned the commands, and removed hyperlinks.

edit: remove more hyperlinks

edit: added solution found

Trying to achieve: VLAN behind UniFi gateway routed through slate 7 and out its isp(cgnat).

The reason I chose a gl.inet device was because I have heard nothing but fantastic things about them and their products and wanted to see for myself.

I have my current residence with UniFi gateway and a second residence with slate7 behind cgnat but I want traffic on a vlan behind the UniFi gateway to come out the isp of the slate 7.

I have tried multiple things including vlan>unifi wgs>slate7 wgc>isp which resulted in I couldn’t get routing correct on either end they both want to route the opposite direction.

I have tried vlan>unifi wgc>remote wgs>slate7 wgc>isp but again started running into problems with being able to add the ip rules, iptables to slate 7 wg client config.

Unless im missing something please shed some light I have been banging my head against a wall for days now. If there is not light to be shed what would my options be to get this working?

I figured this would be a easy cost effective way to handle this but I’m regretfully thinking I should have just setup a minipc instead of using the slate 7 to accomplish this.

For many years I have honed a little homelab which I accessed it via standard Wireguard VPN connection. Some months ago, I had this idea that my homelab should have zero listening ports on the public internet, for the fact that my router was not being kept up to date with all latest patches. I navigated through headscale/tailscale, cloudflare, etc, however I wanted something incredibly lightweight, that could run on my OpenWrt router.

So I built a CLI tool that reverses the connection direction of the hosting server, primarily to create an outbound connection, requiring no listening ports on my homelab gateway. These connection (the server and all clients) needed a rendezvous point where their outbound connections would be tied. I also wanted to avoid issues like complex TLS termination, authentication and possible DDoS attacks on the relay, so it was decided to use WebSockets rather than UDP connections. This provided the possibility to host the relay on the web behind reverse proxies, offloading all other complexities to the battle hardened nginx, while keeping my codebase tiny. Hence BastionRoute was born.

BastionRoute tries to solve one thing and one thing only. To provide a means for a UDP server to initiated outbound connections towards a Websocket relay. In doing so, BastionRoute remains payload agnostic, as long as UDP traffic is flowing, it does not care if its Wireguard traffic or any other software. BastionRoute does not require Wireguard keys to operate, in fact for a Wireguard perspective, only the connection configuration changes, nothing else. Wireguard encryption remains end-to-end. In doing so the relay becomes a blind transport broker.

So as a general problem I tried to solve with BastionRoute is that a minimal, potentially untrusted forwarding fabric (essentially the relay) can provide reachability for an end-to-end secure networking protocol without becoming part of that protocol's cryptographic trust boundary.

I loved working on this project and I wanted to share it with the community. Any feedback is much appreciated.

More info on bastionroute.io

I will be on business travel to South Korea next week. i have a wireguard server running to access my home devices/share also to use pihole for ad filtering. I wanted to know whether there are any restrictions on accessing wiregurard which is running outside south korea. Kindly advise.

P.S. I tried to search for feedback related to similar topic but most searches end up showing running wireguard in Soutth Korea.

I have two houses in different cities, where I have different machines, for which I need to establish direct connection between each other.

So far I've achieved this with Tailscale installed on each machine, and since one of the houses has public and static IP addresses provided by the ISP, it looks like all machines are now able to establish Direct Tailscale connection between each other.

However, I am a fan of utilizing my equipment to the fullest, and I don't like when some device is idling when it could be heavy lifting something that it's made for.

That's why I started researching if it would be better to configure the routers in WireGuard Server and Client, so I can have my machines talking to each other without Tailscale running on each.

I am currently unable to test the WireGuard scenario, because one of the routers does not support WireGuard, so I will have to replace it eventually.

That's why I am asking here for opinions, has anyone done such a setup with router level WireGuard?

For some reason Wireguard won't work on my laptop, and I need it for school since my school decided to block everyone's schoolwork for some reason for music.

i have overslept for 13 hours on the weekend and kinda feeling geeked.

My laptop infomation , specs , idk.

Operating System: CachyOS Linux

KDE Plasma Version: 6.7.4

KDE Frameworks Version: 6.28.0

Qt Version: 6.11.1

Kernel Version: 7.0.12-3-cachyos-hardened (64-bit)

Graphics Platform: Wayland

Processors: 8 × Intel® Core™ i5-1035G1 CPU @ 1.00GHz

Memory: 8 GiB of RAM (7.3 GiB usable)

Graphics Processor: Intel® UHD Graphics

Manufacturer: Microsoft Corporation

Product Name: Surface Laptop Go

System Version: 124I:00057T:000M:0000000D:0B:04F:1C:05P:48S:01E:0Y:0K:0U:02

I fixed a lot of problems related to the surface like thermal throttling , secure boot , etc.

-- stable since idk more then 6 months? "not related to the wireguard stuff"

here some things that worked.

-- OpenVPN works both works on a flatpak called eopen and KDE plasma Network manager.

- thats it.

Heres things that DIDN"T work.

--Proton VPN wont work no matter if it's downloaded via AUR ,Flatpak, etc.

--Proton VPN also doesn't work even if i connect with OpenVPN or Wireguard somewhat.

--Wireguard doesn't work no matter what i try.

--Wireguard doesn't work in KDE network manager.

--Network manager says Wireguard is at zero bytes in upload speed and download speed however for a split second it transfers stuff possibly Wireguard keep alive thing.

--Will not work at school or home [Home = Aussie Broadband] [School = Telstra]

heres my wireguard config removing my private key and public key.

[Interface]

# Key for Daily use

# Bouncing = 2

# NAT-PMP (Port Forwarding) = off

# VPN Accelerator = on

PrivateKey = _____________

Address = _____________

DNS = 45.90.28.247, 45.90.30.247, 9.9.9.9, 149.112.112.112, 194.242.2.4

PostUp = resolvectl dns %i 45.90.28.247 45.90.30.247 9.9.9.9 149.112.112.112 194.242.2.4

PostUp = resolvectl domain %i ~.

PostDown = resolvectl revert %i

[Peer]

# CH-FREE#12

PublicKey = _____________

AllowedIPs = 0.0.0.0/0, ::/0

Endpoint = _____________

# Uncomment the following line (delete the # symbol) to connect to Proton VPN using IPv6.

# Endpoint = _____________

PersistentKeepalive = 25

I use mullvad servers but if that doesn't work quad 9 as fall back.

I had the idea to use a WireGuard tunnel in the AWS CloudShell (a web based shell that works inside an AWS account). When I asked Google if it was possible I got a hard "No" with it citing a number of reasons and encouraging me to use an EC2 or container.

As it turns out, WireGuard works just fine in CloudShell with one caveat: DNS blocks in the conf file can't be used (no resolved running). Other than that it works, and seems like a nice way to create a temporary bridge to bring in content from a remote network.

To install it:

sudo dnf install wireguard-tools -y

Then create the config file, and start it up with wg-quick or whatever. I used the demo.wireguard.com server to test. The reason I found the DNS issue is that the client-quick.sh script they provide creates a demo.conf file with a DNS block. With that in place I got an error for the resolveconf step, but removing it resolved it.

Edit: fixed a typo in the package name. Couldn't let that slide.

Hi,

I am self-hosting WireGuard inside an unprivileged Proxmox LXC. Everything works great for the most part, except I am experiencing a strange issue with Android notifications.

When my Android phone is connected to WireGuard, notifications can be severely delayed. Sometimes they will not come through until I disable the VPN, at which point I get flooded with all the notifications that were waiting.

The interesting part is that general internet connectivity works perfectly fine while WireGuard is enabled. Browsing, apps, streaming, etc. all work normally. It seems to specifically affect push notifications.

I previously experienced the exact same issue with Tailscale, which makes me think this may not necessarily be a WireGuard configuration issue.

For DNS, my WireGuard clients use my home's primary and secondary DNS servers. Both are devices that run AdGuard Home for DNS filtering, Unbound for recursive DNS, Traefik for internal reverse proxying/FQDNs, and an NTP server.

My home LAN DHCP also hands out these same two DNS servers to local clients. However, my main router's external/WAN DNS is set to Quad9.

So the DNS setup is essentially:

• LAN DHCP DNS: Home Primary + Secondary DNS servers
• WireGuard DNS: Home Primary + Secondary DNS servers
• Router external DNS: Quad9
• Primary/Secondary DNS: AdGuard Home + Unbound

Has anyone experienced something similar with Android push notifications over WireGuard or Tailscale? I have no clue where to look further.

Any suggestions for troubleshooting would be greatly appreciated!

Hello,

Some phones have a very high security standard, such as those of Apple, Google and Samsung, with their secure enclave. Has Wireguard considered taking advantage of those?

The wall everyone with a fast line hits eventually: you pay for multi-gig, your NICs do multi-gig, iperf across the LAN does multi-gig — and then everything goes through one WireGuard tunnel and sits at <<your measured single-tunnel figure, e.g. ~1.1 Gbps>>. The line isn't the problem and the NIC isn't the problem. One tunnel is one tunnel: one peer, one endpoint, one queue's worth of crypto, and whatever the far end is willing to give a single connection.

You can't make one tunnel faster from your side. You can run more than one. So I wrote a gateway that runs up to five WireGuard tunnels at once and spreads traffic across all of them with ECMP, and the machines behind it just use it as their default route.

Read this part before you get excited, because it decides whether this is any use to you.

ECMP hashes per connection, not per packet. fib_multipath_hash_policy = 1 puts source/destination ports in the hash, so each TCP connection is assigned a tunnel and stays there for its whole life. Consequences:

• One big single-stream download will never exceed one tunnel. Not a little faster — identical. If your use case is one large file over one connection, stop reading, this cannot help you and neither can anything else short of a provider with faster servers.
• Anything that opens many connections scales. Usenet with 40 connections, a browser, parallel HTTP, several download clients at once, a multi-stream speedtest. Those spread across the tunnels and you get the sum.
• Per-packet striping would fix the single-stream case and is a terrible idea over independent tunnels: different paths, different latency, out-of-order delivery, and TCP reacting to reordering as though it were loss. Per-flow is the correct trade and it's the one every sane multipath setup makes.

The detail that silently wastes the whole exercise: leave fib_multipath_hash_policy at 0 and the kernel hashes on addresses only. Every connection to a given server then lands on the same tunnel, and you get exactly one tunnel's throughput while three tunnels sit up, handshaking and idle, with nothing reporting an error. The daemon sets it, re-checks it, and reports it as a problem if something resets it — that one sysctl is most of the difference between this working and looking like it works.

CPU is the next ceiling, and it arrives sooner than you think. Three tunnels is three times the encryption. Multi-gig WireGuard is genuinely CPU-hungry, and on a low-power box you'll hit the processor long before the line. Mine does <<your aggregate figure and the CPU it's on, e.g. ~2.8 Gbps aggregate on a 12th-gen i5>>. Worth knowing before you buy an N100 for it.

Topology, because this isn't a client you install on your desktop. It's a gateway for a subnet that is not your LAN. The clients get their own network and point at it as their route out. It refuses to start if you point it at your LAN or at the subnet holding the host's own address, because that configuration routes the machine's own replies into a tunnel and it goes silent while looking perfectly healthy. In practice that means containers, VMs, or a dedicated VLAN behind it — not your gaming PC sitting on the main LAN.

The rest is what you'd want if it's carrying everything: with all tunnels down the client subnet has no path out at all rather than a quiet fallback to your ISP, and leak-test proves that from a network namespace on the client bridge instead of asserting it. DNS is redirected in the kernel, so a machine pointed at 8.8.8.8 can't leak its lookups while its traffic stays correctly tunnelled. Tunnels that die get restarted, tunnels that are up but have stopped handshaking get cycled, and the routing rules and their tables are re-checked every pass — a tunnel that drops and returns otherwise leaves one client with a rule pointing at an empty table and no way out, while everything else looks fine.

Before you bother:

• Closed source. Free, single static Go binary, no runtime dependencies, zero third-party modules — but it runs as root next to your VPN keys and you're trusting a binary. Saying it up front rather than letting you find out.
• Linux, root, WireGuard only. You supply your provider's config files. No OpenVPN, no built-in server lists.
• Five tunnels max, three by default. Five WireGuard configs eats an entire Mullvad device allowance, which is the real limit for most people rather than anything technical.
• It checks a signed status file hourly — a plain GET — from a Cloudflare Worker, with the copy in the public repo as fallback. No install ID, no cookie, nothing stored per request; requests ÷ 24 tells me how many installs are still alive. Block the host and yours carries on from the repo copy.
• No port forwarding.

https://github.com/wonderingStars/bondvpn — binaries with SHA256SUMS under Releases, an install.sh, and a SETUP.md that goes from a bare box to a working stack.

Happy to answer topology questions. If you've got a multi-gig line and you've measured your single-tunnel ceiling, I'd genuinely like to hear the number.

I'm a digital nomad and I bought one of the UniFi Travel Routers (UTR). I saw an old reddit post about how to generate the Wire Guard file for the UTR, and I felt it was a pain the ass to install the NordVPN program, and the Wire Guard Client to generate the .conf file.

So, I created something much easier, faster- this is a PowerShell script that doesn't require any of the 3rd party apps and works natively in Windows, what's even better is that it also generates a QR code right in the shell, so you don't even have to mess with transferring the .conf file

Here's the GitHub for those interested: digitalcrisis/vpntools/NordVPNWireGuardGenTool

The instructions are in the README.md file

Keep mind it's using ISO 3166 codes so United Kingdom would be gb rather than "uk" when using the -CountryCode switch.

Hello, has any one had this problem? I can only get one client to work. I have 3x clients, the max limit on the router is 10.

the config for client 1 is as followed

[Interface]

PrivateKey = privatkey=

Address = 10.10.10.10/24

DNS = 10.10.10.1

[Peer]

PublicKey = publickey=

PresharedKey = presharedkey=

AllowedIPs = 192.168.50.250/24

Endpoint = public ip:port

PersistentKeepalive = 25

next client has 10.10.10.11 and the 3rd has 10.10.10.12

the strange thing is clinet nr 3 is the only one who works. I get successful handshake with all. but can not ping the router or the truenas server (192.168.50.250)

to clarify client nr3 is the only one work as it should, successful handshake and able to ping the truenas server

any ideas?

Solution from duckITguy

You should have 10.10.10.10/32 for client A, 10.10.10.11/32 for client B etc. on the router in the allowed ips.

I have run a small US-based ISP for more than 15 years. It has extra bandwidth/servers/IPv4 addresses I want to make use of (monetize). But I also like donating / helping communities / builders / tinkerers too.

In the past I have often given away servers and vps service to people running all sorts of projects (mostly non-profits - under different Reddit accounts, not this one). I like building things too, so this has been fun to leverage infra I work with daily and learn new AI tools to build out the service. I actually built another project during the time I worked on the vpn service - a web interface for Claude Code - because nothing else was reliable enough for me or lacked the features I wanted).

Obviously there are lots of companies selling wireguard VPN, so why another one? Because I want to offer it cheaper and easier, and actually quite different. I don't need to really make a profit since other than my time and opportunity cost, my costs are almost non-existent. Also, I have some networks of IPv4 addresses that I can use to give each user their own static ipv4 address - most VPNs use shared addresses which means they end up banned all over the place and try to offer anonymity. This service is very different from a standard VPN because

• each user gets permanent IPs
• can have a vanity reverse dns hostname, and since the address wont change
• it's really good if you are behind cgnat (you get a real ipv4 address) or that * need incoming accesse via the internet.

I've been working on it for 3 months now. It's not 'polished' and I'm sure it has issues, but I tried to build it in a reliable and secure manner. I would appreciate any feedback (pos or neg) and can give out paid accounts to anyone here, just reply or reach out with whatever you want. The site already offers a 100% free account with 100GB of bw per month but what I'm saying is I'll give you credit for up to 6 months of service. At some point I will have to give the free accounts an expiration date, but at this rate I should be able to keep them free for another year or two, or possibly longer?

Currently:

• 75 accounts
• a couple paying clients
• <10 simultaneous sessions.

I wont post the url here but if anyones interested I can post it in a comment reply.

Hey everybody!

I have the following problem: I have a WireGuard network running on my Raspberry Pi that my devices, including my android phone, connect to to access the services running on it. On my phone I specify the DNS server running on my Pi, which returns an IP in the VPN subnet for my domains, as the DNS server in my WireGuard config. Only traffic going to IPs in my VPN subnet gets routed through WireGuard.

I have now decided to get ProtonVPN and would like to use it on my phone as well. However, I can't have both VPNs active at the same time. So I either lose out on access to my services (they are publically accessible, but only using forward auth meaning mobile apps don't really work) or on Proton. My idea is, that I could run proton on my Pi and route all my traffic from my phone through the Pi and therefore also through proton. Would this work? Is this a good solution? I'm thankful for all feedback. :D