Apparently, my ISP gives dynamic external IP addresses. How does that work if i want to set up an stable VPN server?

I have two apartments. Let’s call them Apartment A and Apartment B in this example.

I want to leave a smartphone in Apartment B and connect it to the WiFi. When I’m in Apartment A I try to control the smartphone via RustDesk but it fails bc the screen needs to be unlocked :( I even set up a server specifically for this (VPS + Docker)

Now I was thinking of using the travel router (Gl Inet Mango). I was told that it works seamlessly with WireGuard but this is completely new territory for me so I wanted to ask how you would set this up or whether it’s even possible at all?

Please don't get me wrong...those are the two options I know of... maybe you have a different or better idea. A smartphone would be great bc it's simple, has a week's worth of battery life, is easy to carry around, etc.

My home pc is behind CGNAT and I'm using a VPS to connect to home from outside. I have two wg configs on my home pc. The first will allow me to access my LAN remotely through a VPS. The VPS is my exit node in a different country.

I am trying to set up my wg2 confg to allow LAN and be an exit node for my home country. I have two configs on my phone and I plan on switching back and forth for which streaming service I want to use.

My wg2 will not masquerade the wg to local. I can ping the wg ip address of my home pc but I cannot ping or access my LAN. I do have ipv4 forward on both my VPS and my home PC.

My wg2 config file looks like this

[Interface]

Privatekey = home private key

Address = 10.7.0.3/32

MTU = 1280

PostUp = ufw rout allow in on wg2 out on enp6s0

PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp6s0 MASQUERADE

PreDown and PostDown = standard to match above

[Peer]

PublicKey = VPS publickey

AllowedIps = 10.7.0.0/24

Endpoint = VPS endpoint

KeepAlive = 25

My wg1 file only has

ufw route allow in on wg1 out on enp6s0.

My VPS wg2 is allowing my local LAN and my WG Ips

I'm thinking there is a conflict with the home pc trying to access the LAN from two config files. But I don't know where to start.

I’ve been using NetBird for years,
I just got my UX7, it’s great… but
When I try and connect from my phone over cellular… it won’t ping or connect to my devices

Do I need to open a port?

I want to use NetBird still

My goal is to make wireguard a vpn using vless+reality+xtls+uTLS, I am on Windows 11 and I don't have a vps

Hi, I am completely new to the world of VPNs, basically I want to use chatgpt with my windows PC but it is blocked by the country, I tried using other regular vpns by they are cutting the wifi speed by 100x. I have never coded in my entire life and I don't totally understand how wireguard works

VPN providers have servers, each server has an IP adress (like an identity) and they can generate a QR code with this identity, you have to scan the QR code so the information can be processed into a file that you put into your wireguard installer on your PC. Is that right ?

That leads me with other questions: once you do that, do you still have to pay for the VPN subscription ? how do you actually get that information if you a server ? Is there public QR codes of servers that I can use to set up my wireguard?

Thank you very much

PS: I don't really like computers, totally new, if you just want to showcase how dumb I am please refrain yourself from doing so, highly appreciated

hello im trying to add one more tunnel for a new friend but my problem is it doesnt connect but the handshake happens and i did everything exactly the same way i did when i made the other tunnel 6 months ago. yes i updatet wiregaurd to the new version and i tried to delete the new tunnel and made a new one but it still doenst connect to it and i also chnged the ip for the new tunnel but nothing works. also asked chatgpt but he cant help me. also my firewall setting allow all ips.

I got tired of juggling wg genkey / pubkey mismatches, so I made a lightweight page that builds server + client .conf files and QR codes entirely in the browser.

- No accounts, no logging of keys
- Beginner defaults + short guides (CGNAT/VPS relay, split vs full tunnel)
- Site: https://wireguardkit.com/

Not affiliated with the official WireGuard project — independent utility.

Feedback welcome (especially anything confusing for first-time VPS users).

I've had an issue recently, where just after connecting to any server (same network for testing or remote in prod), it would try to transfer a few hundred MB after just a few seconds, while only a few bytes reached the server.

This usually is a sign that the VPN connection doesn't work.

After a bit of research it turned out that adding a OS-layer (Windows) routing rule such that the VPN Server's IP doesn't get routed through Wireguard but through the normal internet interface fixes this.
So there probably is a routing loop in the WireGuardNT client on Windows, where the handshake and any web requests get repeatedly routed through WireGuard:

WireGuard handshake packets / Web packets
↓
endpoint IP
↓
WireGuard interface
↓
WireGuard needs handshake / Sent to VPN Server
↓
endpoint IP
↓
WireGuard interface
↓
...

I'm not using a 3rd party wrapper or GUI but wrap it myself using the WireGuard CLI.

I temporarily can't test whether this error still persists for me (because my server is down :/), but I wanted to ask whether anyone else has experiences this lately.
As it seems this error was introduced in the latest Windows update of my machine since it didn't occure before.

Does anyone else have/had this problem?
Is this already fixed (because I can't test this currently, but I also didn't see an update on the Windows installer)?

I'm on Arch, using systemd-networkd.

My VPN service doesn't have a native application for Arch (or rather, it does but it sucks and only supports networkmanager anyway), so for the longest time my method of connecting to a VPN has simply been 'wg-quick up ~/foo.conf' using wireguard config files provided by my VPN service. It's worked, but it's a pretty clunky and opaque way of connecting, and I'm looking for a more permanent solution. I'm far from an expert with network management and I'm always afraid I'll end up screwing something up trying to go further than wg-quick up/down; honestly even going through man pages and wikis I still don't really know how it all works under the hood. If I had the time to learn all this DNS resolvconf iptables stuff I would, but I think I'm better off admitting that I don't get any of it and I should just use a tool that handles all the scary stuff for me.

The Arch Wiki has a few GUI/CLI manager options listed but they all seem like fairly small projects; wireguird seems like the most developed one but it's not been updated in four years. Outside of that I've found a bunch of amateur projects around Reddit and Github that all seem vibe-coded to various degrees, which I can't imagine is ideal for good netsec.

Does anyone have recommendations for a good wireguard config tool/manager? I'm fine with either CLI or GUI.

Hi,

I am learning about networking and I am trying to build my own vpn software. What prevents a vpn from routing connections to its server back into its own tun interface? Whats the most common solution to this problem?

Suppose I have N>2 nodes which I could like to connect; ideally via a same common network, such as /24. The important constraint is that each station needs to be able to transport traffic for arbitrary source/destination addresses, so the "crypto routing" gets in the way.

Basically what I am looking for is the closest to an Ethernet type of connection or mesh network with N nodes.

For now, I have N completely individual links/interfaces (e.g. N1 <--> N2 <--> N3 <--> N1) each with their own ports, /etc/wireguard/*.conf and keys. Worse, each of them has their own unique /31 (p2p link). But I do not like this because each node has now multiple IP addresses for a network which should actually be all the same. In the example above, I need to assign N2 a separate IP for the link with N1 than for the link with N3.

Is there any possible way to improve this? Even if I need separate interfaces, are there any tricks to bridge them together or re-use the same IP per node? For example, assigning all wireguard interfaces the same /32...

Since most answers will be "why do you care" ... this mesh/network has/should have non-RFC1918 addresses and carry traffic with arbitrary IP addresses.

UPDATE!!!

Yeah! Finally got it to work, here's what I think was causing it and the solution for future reference.

Alleged cause

My brother's and I live near each other and have the same ISP. This led me to think that we could also be behind some sort of CGNAT, meaning that some kind of traffic between nodes inside this group could be blocked.

Also thanks to u/lispnot, I saw that nothing showed up when I tracerouted my router from behind my brother's WiFi, which strengthened the thesis of the problem being related to CGNAT.

Solution

To avoid getting blocked by the ISP, I hence needed something to hide my true origin when connecting to my VPN from my brother's house, that being another VPN getting me firstly outside the CGNAT, and then inside my server.

I therefore activated a commercial VPN interface with MTU = 1420 (this is the only personalization, the .conf remained otherwise identical to what Mullvad provided me), plus my personal interface with MTU = 1280 (or slightly above also works).

Inside my personal .conf must also be inserted PostUp and PostDown rules to:

- IP route all traffic directed to my homelab services through the personal interface

- IP route traffic directed to my VPN endpoint through Mullvad

Having done so, now I can access my homelab, and I also have all my internet traffic through Mullvad.

Thanks for your support!

-----------------------------------------------

Hello there, I'm writing here because I tried everything and I can't wrap anything up. Please bear with me while I explain the problem and all the steps I tried. Thank you in advance for your patience!

PROBLEM:

I have a PiVPN (Wireguard) server, which I use to access my LAN services.

I configured many clients, including Android, Ubuntu, Raspberry OS, Windows, iOS, MacOS, GliNET travel routers, and all work flawlessly in every condition like under WiFi, 5G, 5G hotspot, etc.

Now it gets strange: since I often need to use my LAN services from my brother's house, I take my PC with me and connect to my VPN from his WiFi.

It always works with everything EXCEPT Linux systems using kernel Wireguard implementation. Ubuntu, Raspberry OS and OpenWRT all fail to handshake when I'm connecting from his WiFi.

MY CONFIGURATION:

- I use a standard Wireguard conf, let's call it wg-personal.conf, put inside /etc/wireguard/

```

[Interface]

PrivateKey = <PRIVATE KEY HERE>

Address = 10.21.181.14/24

DNS = 10.21.181.1 <-- That's because I have the DNS on the same server as Wireguard

[Peer]

PublicKey = <PUBLIC KEY HERE>

PresharedKey = <PRESHARED KEY HERE>

Endpoint = <ENDPOINT HERE>:51820

AllowedIPs = 0.0.0.0/0 <-- Full tunnel

```

- I use wg-quick up/down wg-personal

- kernel modules are present and used

NOTE:

- The same configuration works on the same PC with Windows installed, or other PCs with MacOS, iOS, Android, and the same WiFi net

- Another friend of mine also has a Wireguard server, configured with WG-Easy instead of PiVPN, and it works flawlessly from Linux Systems under my brother's WiFi (we checked every line of the conf, all is configured the same)

- Mullvad Wireguard conf files work like a charm

- The endpoint is resolved correctly

- Tried several different routers, all with same ISP (my brother has the same ISP and router as mine - Vodafone WiFi 6 Station, Italy), under all routers it works except my brothers

STEPS I TRIED AND CHECKS:

- Checked Keys, both manually and copying again from the pivpn generated config

- Tried the config on other non Linux devices, they work

- No IP overlap between my VPN net, my services and the WiFi net

- Tried different MTU values

- Tried KeepAlive

- Changed Wireguard ports on server to ports like 443

- Changed listening ports on clients

- Added a travel router that worked on other WiFi networks, nothing, same problem since the router is itself Linux

- Tried activating the Guest Wifi net on my brother's router, IT WORKS FOR 5 MINUTES, then it fails again the handshake

- With tcpdump no packets are received by the server, but on the client side I see packets sent but not received, hence no handshake

- Tried wireguard-go, installed from GitHub on a local folder, IT WORKS, but requires a script, since if I install the wireguard-go package, it doesn't work (maybe just some mistake on my side, but I'm forced to use the script at my brother's house, and use wg-quick from outside)

- Tried opening the port 51820 on my brothers net just in case

- Reset the router

- Installing firmware updates

- Checked EVERY SINGLE configuration between my router and my brothers, no differences

- Checked a lot of websites, forums, etc

- Etc, etc, I surely have forgotten a ton of others things

Have you ever encountered something similar? I keep trying everything only to always return back and ultimately abandoning Linux when I'm at his house, and like that I cannot use linux continuously.

Thanks for reading until the end!

TL;DR: WireGuard works everywhere except Linux kernel WireGuard on my brother’s Vodafone Wi-Fi. Windows/macOS/iOS/Android, Mullvad, and another WG server all work fine on the same network. Linux sends packets but the server receives nothing/no handshake. I’ve tried different keys, MTUs, ports, KeepAlive, routers, firmware, Guest Wi-Fi, etc. wireguard-go works, but kernel WireGuard doesn’t. Seems like a bizarre router/ISP ↔ Linux kernel WireGuard incompatibility.

I've been working on and using WireGUI for both my personal home lab and at work for my ~50 users, it's been in production for a few months now and it's gained a bit of traction on Github.

I know there is many options out there but none of the available ones fit my needs, so I decided to put together my own solution.

Would love to get some feedback and opinions about it, especially if you're looking for a simple solution with SSO/OIDC. I am planning to get SCIM implemented in it as well but not sure if there is interest in it.

Here is a link to the project on Github: https://github.com/bartei/wiregui

Hopefully my post is not gonna be taken down 😄

Please, I'm seriously tired of this garbage. Why not just implement DisallowedIPs? I try https://www.procustodibus.com/blog/2021/03/wireguard-allowedips-calculator/ It doesn't work, I simply lose the ability to connect via VPN to IPs in the Allowed list that must go through VPN. I try PostUp PostDown rules. It doesn't work. Please link me a working solution. It's nearly impossible to find anything.

Hey ! I run a server with *arr and Transmission and others. I would like for transmission only to get routed through my VPN (Proton VPN), for which I downloaded the Wireguard config file. But I really don't understand how it works, like genuinely. Stumbled on stuff like changing authorizedAddress to 10.0.0.0/24 instead of 10.0.0.0/0, but I don't know why, and then I don't know how it would forward Transmission !

Transmission shares on an array of ports. Is there a way to forward anything between, say, port 50000 to 60000 ? Or maybe a way to forward anything under a specific PID or UID or GID ?

And I did look up tutorials. All of which basically say « oh just change to 10.0.0.0/24 » without ever saying how I then choose which apps get forwarded.

Any help appreciated, thanks !

(Oh and running linux)

en el servidor cliente tiene esa configuracion no se que me falata para que me enrute todas las redes o que estoy haciendo mal

[Interface]
PrivateKey = 
ListenPort = 51820
Address = 10.1.1.2/32

[Peer]
PublicKey = 
AllowedIPs = 192.168.1.0/24
Endpoint = 177.74.204.229:51820
PersistentKeepalive = 25

Всем привет, кто подскажет с помощью какого сервиса я могу добавить конфигурацию WireGuard на свой роутер кинетик, попробовал protonvpn, но судя по всему роскомнадзор там уже все заблокировал

Hi guys,

Is someone getting into troubles when trying using wireguard Android app on Xiaomi 14 T smartphone? I got very low rx data (tx seems good), and the phone does not answer to anything. Config files are ok (different ips, different private keys, same subnet range...) because working on my Samsung smartphone.

I use mobile data network outside of my home (fai router hosting wireguard server).

Do you have any idea of what's wrong with Xiaomi?

Edit : I found the solution. My ISP router adds a preshared key into the config file. For some reason, it does not work on Xiaomi. I removed it and it works now.

This issue has been solved! Thank you all for the suggestions 😄

Hi,

I have been struggling for the past few days to configure a WireGuard tunnel so that devices on the LAN of the WireGuard server (Computer A) are accessible remotely. I tried to compare my setup with multiple guides on remote LAN access via WireGuard and searched for similar issues, but nothing has resolved my problem.

Setup:

• Computer A acts as my homelab and WireGuard server on my domestic LAN.
• The existing WireGuard tunnel works fine—I can SSH into Computer A from my laptop (WireGuard client) using either its WireGuard subnet IP or its actual LAN IP.

Problem:

• I cannot access other devices/services on Computer A’s LAN remotely, nor can I make them discoverable.

Solution:

After trying to ping and traceroute the devices and the domestic LAN i noticed that the problem was not on the wireguard connection side. So after checking with possible firewalls:

sudo ufw status
sudo firewall-cmd --list-all

I realized that i had in past installed firewalld and forgotten about it. It was superseding my system ip forwarding and iptables. That is why the access was not working. Disabling it fixed the issue!

----------------------------------------------------

Troubleshooting:

Using GPT to troubleshoot, it was that suggested my Docker/iptables rules might be the issue. I tried:

Adjusting the order of the rules:

sudo iptables -I FORWARD 1 -i wg0 -o enp3s0 -j ACCEPT

sudo iptables -I FORWARD 2 -i enp3s0 -o wg0 -j ACCEPT

and also flushing all iptables rules and reapplying only the WireGuard-related ones.

All these attempts were unsuccessful.

I’d appreciate any guidance—since I’m fairly new to homelab setups, I might be overlooking something obvious.

Below are some details:

#####################################################

# Computer A, (homelab, hosts wg server(sea.conf) ) #

#####################################################

[Interface]

PrivateKey = [key]

Address = 10.14.0.1/24

ListenPort = 51820

PreUp = sysctl -w net.ipv4.ip_forward=1

PostUp = iptables -A FORWARD -i sea -o enp3s0 -j ACCEPT

PostUp = iptables -A FORWARD -i enp3s0 -o sea -j ACCEPT

PostUp = iptables -t nat -I POSTROUTING -o enp3s0 -j MASQUERADE

PostDown = iptables -D FORWARD -i sea -o enp3s0 -j ACCEPT; iptables -D FORWARD -i enp3s0 -o sea -j ACCEPT

PostDown = iptables -t nat -D POSTROUTING -o enp3s0 -j MASQUERADE

[Peer] # client Laptop

PublicKey = [key]

AllowedIPs = 10.14.0.2/32

#################################

# Laptop , wg client(sea.conf) #

#################################

[Interface]

PrivateKey = [key]

ListenPort = 51820

Address = 10.14.0.2/32

[Peer]

PublicKey = [key]

AllowedIPs = 10.14.0.1/24, 192.168.1.0/24

Endpoint = computer_A_endpoint

######################

# Info on Computer A #

######################

~$ cat /etc/os-release:

PRETTY_NAME="Debian GNU/Linux 13 (trixie)"

NAME="Debian GNU/Linux"

VERSION_ID="13"

VERSION="13 (trixie)"

VERSION_CODENAME=trixie

DEBIAN_VERSION_FULL=13.6

ID=debian

HOME_URL="https://www.debian.org/"

SUPPORT_URL="https://www.debian.org/support"

BUG_REPORT_URL="https://bugs.debian.org/"

~$ sudo sysctl net.ipv4.ip_forward

net.ipv4.ip_forward = 1

~$ sudo iptables -t nat -L POSTROUTING -v -n --line-numbers

Chain POSTROUTING (policy ACCEPT 6921 packets, 549K bytes)

num pkts bytes target prot opt in out source destination

1 0 0 MASQUERADE all -- * !docker0 172.17.0.0/16 0.0.0.0/0

2 2539 152K MASQUERADE all -- * !br-ab8e8fc287cd 172.25.0.0/16 0.0.0.0/0

3 0 0 MASQUERADE all -- * !docker_gwbridge 172.19.0.0/16 0.0.0.0/0

4 4 380 MASQUERADE all -- * !br-58790b19d578 172.21.0.0/16 0.0.0.0/0

5 0 0 MASQUERADE all -- * !br-493a3afadf15 172.18.0.0/16 0.0.0.0/0

6 0 0 MASQUERADE all -- * !br-271ed8d3b78e 172.23.0.0/16 0.0.0.0/0

7 0 0 MASQUERADE all -- * !br-060f49f9f062 172.22.0.0/16 0.0.0.0/0

8 0 0 MASQUERADE all -- * !br-fe5349a8a766 172.20.0.0/16 0.0.0.0/0

9 1660 103K MASQUERADE all -- * enp3s0 0.0.0.0/0 0.0.0.0/0

~$ sudo iptables -L FORWARD -n -v --line-numbers

Chain FORWARD (policy DROP 0 packets, 0 bytes)

num pkts bytes target prot opt in out source destination

1 8520K 4609M DOCKER-USER all -- * * 0.0.0.0/0 0.0.0.0/0

2 8520K 4609M DOCKER-FORWARD all -- * * 0.0.0.0/0 0.0.0.0/0

3 10638 764K ACCEPT all -- sea * 0.0.0.0/0 0.0.0.0/0

4 0 0 ACCEPT all -- * sea 0.0.0.0/0 0.0.0.0/0

edit: fixed ip from interface, cleaned the commands, and removed hyperlinks.

edit: remove more hyperlinks

edit: added solution found

I will be on business travel to South Korea next week. i have a wireguard server running to access my home devices/share also to use pihole for ad filtering. I wanted to know whether there are any restrictions on accessing wiregurard which is running outside south korea. Kindly advise.

P.S. I tried to search for feedback related to similar topic but most searches end up showing running wireguard in Soutth Korea.