Skip to main content
Share Your Experience: Take the 2024 Developer Survey
20 votes
Accepted

Why is my LAN cable opening an UDP port on my computer?

From OP's comment: @A.B Yes I use wg. When I disable wg the unconn socket is gone. Why wg does this? It appears the system is configured to bring a WireGuard (tunnel) interface whenever the main ...
A.B's user avatar
  • 36.9k
10 votes

Make local resources available when connected to Wireguard VPN

When you want to connect individual external hosts to a LAN via WireGuard, the three key things you need to do are: Include the LAN's IP block (or at least the IP address of each individual LAN-side ...
Justin Ludwig's user avatar
8 votes

Wireguard not able to connect after a few minutes

Try using PersistentKeepalive = 25 option in [Peer] configuration block on both sides, for example: Server: [Peer] PublicKey = _REDACTED_ AllowedIPs = 10.0.0.4/32 PersistentKeepalive = 25 Client: [...
bdzkv's user avatar
  • 181
7 votes

Connect 2 sites (networks) with Wireguard

Both the sites have the same local network (192.168.1.0/24). This is a problem -- if you have 192.168.1.2 (say Device A1) in Site A wanting to connect to 192.168.1.3 (say Device B1) in Site B, 192....
Justin Ludwig's user avatar
6 votes
Accepted

Wireguard Multiline Config Value

The wg-quick command is a bash script. The loop reading keys (such as the PostUp key) is using read -r which prevents any use of \ to separate lines. But reading this same script shows: POST_UP=( ) ...
A.B's user avatar
  • 36.9k
6 votes

SSH fails to start when ListenAddress is set to Wireguard VPN IP

Systemd will wait for the interface to be ready if sys-devices-virtual-net-XXX.device is listed as a dependency. So to have sshd wait for the wg0 interface, add these lines to the [Unit] section of /...
ki9's user avatar
  • 413
5 votes
Accepted

Wireguard connection between two LANs with wireguard boxes behind routers

The solution to this is pretty straightforward, however, I have not found any description on internet how to make such site-to-site VPN. Therefore, I decided to post a solution that works for me, here....
nobody's user avatar
  • 1,700
5 votes
Accepted

Wireguard specify listen address

WireGuard's Linux kernel module has no option to choose the IP address the interface will use for the tunnel. In particuliar, following OP's comment about wanting it not to bind with IPv4 but only ...
A.B's user avatar
  • 36.9k
4 votes
Accepted

wireguard on Debian impossible to install

Packages available on buster backports: echo "deb http://deb.debian.org/debian/ buster-backports main " | \ sudo tee /etc/apt/sources.list.d/buster-backports.list sudo apt update sudo apt ...
GAD3R's user avatar
  • 67.1k
4 votes

libvirt QEMU/KVM guest cannot connect to network (NAT)

The problem was using a VPN without enabling an "allow local network sharing" setting. Enabling that made it work.
Stahls's user avatar
  • 81
4 votes

Run Wireguard as a client on Win10 with WSL2

Credits to https://www.reddit.com/r/bashonubuntuonwindows/comments/jk4x24/is_there_a_way_to_run_wireguard_within_wsl2/gah860j/ The culprit is that WSL2 kernel isn't compiled with necessary netfilter ...
Tin Nguyen's user avatar
4 votes

Linux router with traffic forwarding over a wireguard tunnel

If you've already set up the WireGuard connection between your home WireGuard server and the remote WireGuard server to send all your home WireGuard server's Internet traffic through it, the WireGuard ...
Justin Ludwig's user avatar
4 votes

WireGuard: one of the peers can’t ping other peers, but handshake works and other peers can ping each other

The connection started working after a few days without my intervention, so I'm unsure of how to solve this, but to not leave this question without some suggestions as to what others can do to find ...
Pic's user avatar
  • 171
3 votes
Accepted

mount smb share after wireguard with fstab or systemd

I suspect the interface setup by wireguard isn't ready just because the service started. Your issue may be related to this in which case the solution is to wait for the virtual device. After=network....
A. Que's user avatar
  • 643
3 votes

No route to host with routing to interface for specific port

The "no route to host" error is likely due to trying to connect to a host (1.1.1.1) not included in your WireGuard AllowedIPs setting. Assuming you're using wg-quick, do this: As step 1, in ...
Justin Ludwig's user avatar
3 votes
Accepted

wireguard does handshake, but ping does not get through

The issue appears to be a missing route both on client and on server, rather than a WireGuard problem. When the server is given 192.168.177.4/32 there's no provision for the route to 192.168.177.5/32. ...
A.B's user avatar
  • 36.9k
3 votes
Accepted

How to share wireguard with namespace?

So the question is: what is the best or most canonical way to share a wireguard interface with a network namespace, while still retaining access to wireguard outside of the namespace? IMO, a good ...
user234931's user avatar
3 votes
Accepted

Can't access services on server using it's public IP after starting Wireguard

I figured it out. The problem is of course that the request goes into eth0 but the response is sent over the Wireguard tunnel (wg1) and is reaching the client with a different IP: Request: Client ->...
Trigus's user avatar
  • 53
3 votes
Accepted

Wireguard how make access only to the local network for some clients on centos?

Take a look here: https://unix.stackexchange.com/a/714015/537971 Basically, on server side you need to add your LAN CIDR to AllowedIPs = 10.8.0.2/32 for example: AllowedIPs = 10.8.0.2/32, 192.168.1.0/...
bdzkv's user avatar
  • 181
3 votes
Accepted

Forwarding traffic back through WireGuard (Setting dnat for oif wg0, after processing the application)

The required information to reply correctly: "From which interface did the initial packet come from?" is lost when a different packet is seen in reply coming from a network interface. A way ...
A.B's user avatar
  • 36.9k
3 votes

Does Wireguard postup/predown really work as a "kill switch"?

You are correct that a "kill switch" implemented with PostUp/PreDown scripts will apply only while the WireGuard interface is up, and won't prevent "leaks" while the computer is ...
Justin Ludwig's user avatar
3 votes
Accepted

How can I configure a podman container to use my wireguard interface only?

Background slirp4netns is a network emulator that uses sockets instead of routing: from the container's point of view, routing is done by its gateway, but actually the host isn't routing: slirp4netns ...
A.B's user avatar
  • 36.9k
3 votes
Accepted

How to configure a WireGuard client to interact with two distinct servers?

This VPN is to access private resources, not a way to access Internet anonymously. So split tunneling should be used. Just replace on the client side: AllowedIPs = 0.0.0.0/0 by only the needed ...
A.B's user avatar
  • 36.9k
2 votes

Redirect traffic from VPN server to VPN client

The first problem was that handshake responses were routed to the tun0 interface due to the default route set up by the OpenVPN client. To solve this problem: #adds the default route to respond via ...
Maddocche's user avatar
2 votes
Accepted

Linux equivalent of these BSD-style routes

route is still the command. man route gives me: route [-v] [-A family |-4|-6] add [-net|-host] target [netmask Nm] [gw Gw] [metric N] [mss M] [window W] [irtt I] [reject] [mod] [dyn] [reinstate] [[...
Ljm Dullaart's user avatar
  • 4,768
2 votes
Accepted

Client (Ubuntu 20.04) cannot resolve internet pages while connected to the VPN WireGuard Server

Turns out the problem was somewhere else. I am using Ansible to configure this Server VM and at the end of the configuration process I have to start a SystemD service for WireGuard. The issue was that ...
TPPZ's user avatar
  • 537
2 votes

How to monitor activity of all WireGuard clients connected to a server?

Yes, like with any other network interface, you can observe the wireguard interface with the usual network inspection tools.
Marcus Müller's user avatar
2 votes
Accepted

Wireguard - Clients can ping server but not each other

It started working correctly after having a single peer defined for the server and setting the appropriate subnet instead for the allowedIps instead of an explicit IP. peers = [ # server ...
Chris Stryczynski's user avatar
2 votes

wireguard on debian and commercial provider app problems

~$ modprobe wireguard bash: modprobe : commande introuvable You should run this command as root: sudo apt install -t buster-backports linux-image-amd64 sudo reboot Disable the secure boot as said @...
GAD3R's user avatar
  • 67.1k
2 votes
Accepted

Web server cannot access itself through public ip address on nftables port forwarding

This is a case of NAT loopback handling. Currently the WireGuard server ("WGS") redirects only from eth0, so nothing will happen with traffic received from wg0. On should redirect on WGS ...
A.B's user avatar
  • 36.9k

Only top scored, non community-wiki answers of a minimum length are eligible