0

I had this exact configuration working for over a year until out of the blue while I was traveling a few weeks ago my wireguard connection stopped working. When I got home I tried to troubleshoot but have run out of ideas.

Home server running on 192.168.1.2, sitting behind a Unifi USG router. 51820/udp port forwarded correctly from USG to server. UFW firewall on server disabled, although there are a bunch of IP tables rules active because of a variety of docker containers running on same server. I can't make heads or tails of IP tables rules unfortunately.

wg0.conf:

[Interface]
# wg0
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = [redacted]

# PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp4s0 -j MASQUERADE
# PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o enp4s0 -j MASQUERADE
# These rules should NOT be necessary according to Arch Wiki and other places I have read since the wireguard "server" sits behind NAT home router. Regardless, it doesn't work with or without these iptables rules uncommented.

[Peer]
# iphone
PublicKey = [redacted]
AllowedIPs = 10.0.0.2/32

iphone.conf:

[Interface]
Address = 10.0.0.2/32
PrivateKey = [redacted]
DNS = 192.168.1.1 #address of my USG router serving dns. Have also tried public DNS like 1.1.1.1 with no luck

[Peer]
PublicKey = [redacted]
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = vpn.mydomain.dev:51820 # DNS records set correctly via cloudflare (no proxying) and I know this works because I can get a handshake with the server, just no internet or LAN access.
PersistentKeepalive = 25

ipv4 forwarding enabled:

[email protected]: ~ ➜  cat /proc/sys/net/ipv4/ip_forward

1

ipv6 disabled on 192.168.1.2 server:

[email protected]: ~ ➜  sudo sysctl -p /etc/sysctl.d/ipv6.conf

net.ipv6.conf.enp4s0.disable_ipv6 = 1
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1

Please let me know where else I can look to troubleshoot. Many thanks in advance!

Edit - additional troubleshooting steps tried unsuccessfully since original post -

I completely stopped all docker containers and then the docker service itself, then flushed all iptables rules while still ensuring all forwarded packets accepted:

#!/bin/sh
ipt="/sbin/iptables"

$ipt -P INPUT ACCEPT 
$ipt -P FORWARD ACCEPT 
$ipt -P OUTPUT ACCEPT 
$ipt -F 
$ipt -X 
$ipt -t nat -F 
$ipt -t nat -X 
$ipt -t mangle -F 
$ipt -t mangle -X 
$ipt -t raw -F 
$ipt -t raw -X

Check to see IPv4 iptables after flush:

sudo iptables -L -v -n

Chain INPUT (policy ACCEPT 3111 packets, 355K bytes)

pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 2087 packets, 156K bytes) pkts bytes target prot opt in out source destination

Then tried the wireguard tunnel and still same situation - handshake but no internet or LAN connectivity.

1 Answer 1

1

The handshake works and bytes are transferred (with PersistentKeepalive = 25 in the configuration). But the connection silently fails with a timeout on anything you try to send over the connection.

If that is your problem, then it is very important to realize that when the Address/AllowedIPs or the PrivateKey/PublicKey configuration does not match between both peers, the connection will indeed simply timeout, even though the handshake could still work (according to wg show).

Fix the problem by:

  • Ensuring that the Address entry of A's Interface-section is within the range of the AllowedIPs entry of B's Peer-section.
  • Ensuring that wg pubkey <<<"<PrivateKey of A's Interface-section" matches the PublicKey entry of B`s Peer-section.

And vice versa (swap A and B).

Then you must reset the interfaces on both peers using (where wg0 is the name of your interface):

wg-quick down wg0
wg-quick up wg0

Note that wg syncconf wg0 <(wg-quick strip wg0) is not enough if you changed Address.


In your specific case, you might change Address = 10.0.0.1/24 to Address = 10.0.0.1/32 or simply Address = 10.0.0.1. I don't think you're supposed to set an IP-range in the Address entry, that is only for AllowedIPs in order to allow multiple IP addresses.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .