WireGuard: one of the peers can’t ping other peers, but handshake works and other peers can ping each other

Question

I’ve recently set up WireGuard on a server using wg-easy (so the config files are generated, not typed out by hand) and I successfully connected a couple of peers, including Linux computers. The last one to set up is my laptop with EndeavourOS and I just can’t figure out why this single device is not able to ping other peers (or reach http services hosted on those peers). Let’s say I’m trying to connect to a PC. The four most important bits (I think):

1. The ping actually reaches the PC and the PC does respond (verified using tcpdump), but the response is never received by the laptop. I’m no expert but to me it suggests it’s not an issue with the wg config (ip route get PC-IP returns the correct interface).
2. I disabled firewalld and it still didn’t work (tried looking at the logs before I did that but it also didn’t seem like it was blocking anything). There's no rules in iptables.
3. The handshake with the server (where wg-easy is set up) works.
4. I am able to ping the PC via it’s non-WireGuard IP.

I also tried some other common-sense solutions like restarting the interface with wg-quick, rebooting, switching to another network, nothing helps. I’ve no idea what could be the issue here, so any help would be appreciated.

EDIT: Here are the configs of the peers in question:

wg-easy server config:

# Server
[Interface]
PrivateKey = (a key)
Address = 10.8.0.1/24
ListenPort = 51820
PreUp = 
PostUp =  iptables -t nat -A POSTROUTING -s 10.155.129.0/24 -o eth0 -j MASQUERADE; iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT; iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; 
PreDown = 
PostDown = 


# Client: PC
[Peer]
PublicKey = (a key)
PresharedKey = (a key)
AllowedIPs = 10.155.129.2/32

# Client: laptop
[Peer]
PublicKey = (a key)
PresharedKey = (a key)
AllowedIPs = 10.155.129.6/32

PC's config:

[Interface]
PrivateKey = (a key)
Address = 10.155.129.2/24
DNS = 1.1.1.1


[Peer]
PublicKey = (a key)
PresharedKey = (a key)
AllowedIPs = 10.155.129.0/24
PersistentKeepalive = 25
Endpoint = (server's public IP):51820

and finally the laptop's config:

[Interface]
PrivateKey = (a key)
Address = 10.155.129.6/24
DNS = 1.1.1.1


[Peer]
PublicKey = (a key)
PresharedKey = (a key)
AllowedIPs = 10.155.129.0/24
PersistentKeepalive = 25
Endpoint = (server's public IP):51820

Thanks!

Answer 1

The connection started working after a few days without my intervention, so I'm unsure of how to solve this, but to not leave this question without some suggestions as to what others can do to find out where is the issue, here are some steps:

1. Check if the ping reaches the peer. Run the following command on the peer you're trying to ping: sudo tcpdump -tttnei wg0 icmp (where wg0 is the name of the WireGuard interface). If it does, this same command will tell you whether the peer responds to the IP you're expecting: it should be the same IP as in the Address field of the WireGuard conf file of the pinging peer (in my case 10.155.129.6).
2. Check if the connection passes through the VPN server. Even if you're running wg-easy in docker, you can run tcpdump directly on the host machine: sudo tcpdump -ttttni any 'udp port 51820', where -i any means it listens on all of your interfaces (if, like me, you're unsure through which interface the packets will go through) and 51820 is the port you've bound to 51820 in docker for wg-easy. If you've already got a bunch of peers then you'll probably see quite a bit of noise in there. If possible, you could try disconnecting from the VPN on those other peers while you're debugging.
3. Double check what is the firewall on your distribution, for EndeavourOS it's firewalld. Make sure it's not blocking your packets.

Good luck!

Answer 2

On the wireguard server, add this rule:

sudo iptables -A FORWARD -i wg0 -o wg0 -j ACCEPT