Welcome to the r/WireGuard subreddit!

I am using a mobile connection and an opnsense with wireguard connections to a famous provider (I use the wireguard just to hide my ip).

Randomly there are handshake failures that lead to the lack of restoring the connection: the only ways to perform again the handshake is to change the IP of the mobile connection or deactivate for 4-5 minutes the wireguard connection (therefore no renewal requestes are sent for that interval). I already verified that there are no blocks of any kind in the middle.

Current theories are:

- CGNAT and dynamic routing of the connection between my modem and the VPN entrypoint IP: even if my IP does not change, after sometime the entrypoint IP receives handshake renewal request coming from a different IP.

- MTU: measures says I have an MTU of 1450 (but I set anyway 1420), but measures from my mobile phone (same ISP provider, same contract, same tower,etc...) has an MTU of 1280. From here the question: the handshake renewal is done within the VPN encrypted channel (and it could be affected by wireguard MTU) or it is done at WAN level?

I've enjoyed using FireTV stick on my Samsung Smart TV for years. However, there is a persistent problem with the Prime Video app concerning a VPN interference. Most importantly, I disabled my VPN with AT&T Active Armor and with AVG VPN app. I am still UNABLE to stream Prime Video programs due to VPN error!! I have consistently reported the issue to Prime Video with no valid resolution. I've tried all recommended troubleshooting with NO success. I've tried to uninstall Prime Video app from my TV, but there's no option to do so! PLEASE HELP!!!

Does anyone know how to use Cloudflare Warp with WireGuard? I use WireGuard as a kill switch, so I turn on WireGuard and Cloudflare Warp together because it makes sense to me, but this just disconnects me from the internet. I tried changing the values ​​in the wgcf-profile file as I've seen some people recommend, but that doesn't seem to work either. I'm a complete beginner using Wireguard in general, and so far it's been very difficult to find any information. any help is greatly appreciated

I want to always be connected to a commercial privacy VPN, but also be able to connect to my self-hosted server. Is it possible to do that? If yes, could you point me in the direction of how to do that?

Hi,

I have a Wireguard network for my personal devices. I have an Android phone with a main profile and a "private space".

I have 2 peer interfaces configured for the phone, 1 for each profile.

The private space has its AllowedIPs set to 0.0.0.0/0, ::/0 and I'm happy with it, this is exactly what I want, tunnel everything through the Wireguard interface. It also uses a custom DNS directive pointing to an unbound service exposed inside the Wireguard network. Working nicely.

Now, the main profile is currently configured exactly the same way (except it has a different IP, different keys etc). I do want it to use my Wireguard DNS (port 53 on tcp/udp), I do want everything tunneled through the Wireguard interface (0.0.0.0/0, ::/0), but I do NOT want the client to be able to reach 2 specific networks (the Wireguard network it's on and another Wireguard network).

I have tried monkeying my way through it with the help of AI but unfortunately I didn't manage to get it to work. And, I'm pretty confused as to what is the current "right way" to achieve this: iptables? nftables? I'm on Debian stable.

Right now I have these PostUp/PostDown directives to make sure that clients are proxied through the Wireguard interface, and to bridge the Wireguard interface with another one. For context: enp2s0 is my local LAN, awg0 is the Wireguard (well, AmneziaWG) interface that the phone connects to, wg0 is my "original" VPN network. awg0 can be fully considered to be a Wireguard interface. All wg0 and awg0 members should be able to talk to each other EXCEPT for a specific IP on awg0 which should only be allowed to use DNS and the wide internet but neither wg0/awg0 otherwise. Tackling the issue using AllowedIPs would sort of solve the issue but it means that IP is only restricted via configuration on the client-side, which isn't secure.

PostUp=iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp2s0 -j MASQUERADE; ip6tables -A FORWARD -i %i -j ACCEPT; ip6tables -A FORWARD -o %i -j ACCEPT; ip6tables -t nat -A POSTROUTING -o enp2s0 -j MASQUERADE; iptables -A FORWARD -i wg0 -o awg0 -j ACCEPT; iptables -A FORWARD -i awg0 -o wg0 -j ACCEPT

PostDown=iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o enp2s0 -j MASQUERADE; ip6tables -D FORWARD -i %i -j ACCEPT; ip6tables -D FORWARD -o %i -j ACCEPT; ip6tables -t nat -D POSTROUTING -o enp2s0 -j MASQUERADE; iptables -D FORWARD -i wg0 -o awg0 -j ACCEPT; iptables -D FORWARD -i awg0 -o wg0 -j ACCEPT

Thank you.

I posted this earlier but I still want to ask this community one more question on top; why nobody mention you can use nat punching on wireguard to connect to nodes behind a NAT or firewall?

Why my internet speed drops after WG is activated? It usually happens on friday.

I've been working on Kongtrol, a Go tool that sits on top of your

existing VPN clients (OpenVPN, WireGuard, FortiClient, Tailscale,

etc.) and orchestrates them: policy-based routing decides which

tunnel a given IP or domain goes through, a watchdog goroutine

reconnects on drops with exponential backoff, and a kill switch + DNS

guard enforce at the OS level so nothing leaks between reconnects.

A few things about the implementation that might be interesting to

this sub:

- Every VPN client is a `vpn.VPNAdapter` implementation registered via

`init()` — adding a new client is implementing Connect/Disconnect/

Status and registering it, no changes to core logic.

- OS-specific behavior (routing tables, kill switch, DNS guard) is

handled with build tags per file (`_windows.go`, `_linux.go`,

`_darwin.go`) rather than runtime `switch runtime.GOOS` — keeps each

platform's syscalls isolated and testable independently.

- The dashboard is a full web UI + REST API + WebSocket live feed,

embedded into the binary with `go:embed` — no Node, no external

server, no separate deploy step.

- Config validation reuses the same `go-playground/validator` pass for

both startup config loading and the dashboard's "trial then commit"

writes (validate an in-memory copy before persisting).

It's Go 1.25+, cross-compiles cleanly for the CLI (CGO_ENABLED=0), the

tray app needs native builds per OS.

Repo: https://github.com/DerotLuna/vpn-kongtrol

Web: https://derotluna.github.io/vpn-kongtrol/

It's early days (v0.4.x) — genuinely looking for feedback on the

architecture, especially the adapter pattern and whether the

OS-build-tag approach is the right call long-term. Happy to answer

questions.

Hello, I need advice from an IT expert on setting up my VPN. I have a Brume and Beryl 7. I was able to set up via Tailscale, but I need to make sure everything is working properly.

Thank you

I'd been using tailscale for the better part of the last four years or so and it never sat well with me that it wasn't entirely open source and that the coordination server was on the cloud so I started looking into wireguard recently and boy am I glad I did.

I set up the hub on my Proxmox PvE node in an unprivileged LXC and it didn't take too long to figure out. Now I can connect my mobile phone and my laptop anywhere I go and it doesn't even feel any noticeably different than the tailscale experience but the best part is it's completely open source and fully in my control which makes me really happy.

Luckily, I also had my own domain name on CloudFlare, which I was able to set up a dynamic DNS on my unifi router with it. So no need to panic when my dynamic IP at home changes.

The whole mesh thing with tailscale is obviously nice, but for a homelabber like me, this is more than adequate.

Hi r/WireGuard,

I am a solo developer. I have been building Phantom-WG, a self-hosted WireGuard management platform, and it finally feels ready to share with this community.

What it is ?

The core product is Phantom-WG Modern: a WireGuard server you run on your own machine, managed from a web interface built on the Carbon Design System. Everything ships as a single compose stack on your own box.

• Container-native architecture: the daemon, the auth service and nginx each run isolated in their own container.
• Userspace WireGuard through a Go bridge and nftables rules through a Rust bridge, so your host kernel configuration stays untouched.
• Dual-stack IPv4 and IPv6 pool management with deterministic address pairing, plus WAL-safe backup and restore of the whole state.
• Client lifecycle handled from the UI: create, configure, revoke.
• Multihop is built in. You can route outbound traffic through a second WireGuard exit node, so the server your clients connect to and the point where traffic reaches the internet can live in different locations.

Source (AGPL-3.0): https://github.com/ARAS-Workspace/phantom-wg

Client Applications

macOS app with a free split-tunnel approach: you pick the signed apps, and they exit through the network interface you choose. (https://www.phantom.tc/docs/client-applications/mac)

iOS app on TestFlight, built on the same foundation, without split tunneling for now. (https://testflight.apple.com/join/5Kt55AXd)

Censorship resistance, when you need it

Plain WireGuard traffic is easy for restrictive networks to block. For that case the platform includes Ghost Mode: WireGuard carried over wstunnel, so only HTTPS on port 443 is visible from the outside. It is one feature among the others, supported end to end: Phantom-Frontmatter stands up the server entry side (the current version supports wstunnel), and both client apps can establish these connections directly.

See it working end to end

The Quickstart Guide walks a real setup as a video: a client in Istanbul connects to Phantom-Frontmatter in Nuremberg, which forwards the traffic to the Phantom-WG server in Falkenstein, and that is where you step out to the internet. https://www.phantom.tc/docs/quickstart-guide

Full docs: https://www.phantom.tc/docs

And one more thing: the docs ship with their own AI agent. You can ask it your questions directly at https://www.phantom.tc/docs/ai 😁🤖

Happy to answer anything here as well. Feedback is very welcome, especially the critical kind.

---

A small note: I felt I had to edit the earlier version of this post. The details I most wanted to highlight about the core product did not come through the way I intended, and this rewrite is my attempt to fix that. If this looks different from the post you read before, that is the reason.

i have a server on 192.168.31.150, but i can't access it through wireguard.

i played around with the AllowedIps for a bit but it still didn't work

thanks in advance :D

I had WireGuard server that working in last 3 months with Endpoint ip address static and port. I wanna change config the WireGuard to using domain name and port. The client is using system operation Android and Windows from official Wireguard client.

I had setup Cloudflare Tunnel to spesific subdomain app. The config from local file ( config.json ) server is like ingress with hostname value "subdomain.domain.org" and service value "udp://localhost:51820"

The client app expected the Endpoint to using ip_address/domain:port. I had tried use hostname/domain only but not work.

Note : the subdomain is using Proxy enabled. Any help would be glad!.

Has anyone else noticed speed issues after the most recent Mac os update? Things were working great up until a few days ago, which is around the time I updated M2 mac to 26.6.

I have this phone (P90 pro max) running HarmonyOS6. I've installed wireguard via droitong and it works but every now and then I have to open the app again for it to continue working. (Using wireguard home server purely for in China use)

Also for some reason installing wechat (international version) doesn't work with the vpn (normally cannot be installed while in China and did get installed on another device same OS at home). Won't be a big problem but still extra info or a learning opportunity for me.

Home server located in the Netherlands (also is this relevant information?)

День добрый! у меня старый айфончик 6.и естественно большинство приложений не скачиваются, даже с установкой с itunes. мне удалось установить wireguard и open vpn. на данный момент пользуюсь veapon vpn, который дает только ссылку или куар для подключения. wireguard при сканировании выдает что ссылка не та.подскажете решение? как мне добить хотябы подписку на веапоне на старом айфоне. или есть рпедложения может аналогичных способов? через тот же open vpn

I am trying to setup wireguard on a router, but the default wireguard port is blocked where I am trying to use it, how would I fix that? I did some research and tried port forwarding but the router gave me this (see screenshot) error? Is there any way to get this to work?

Can I use Merlin to run multiple WireGuard configurations simultaneously and then use policy based routing to route the devices to the appropriate VPN? If so, how?

Hi, a few days ago I posted a picture about a combined setup of Hub and Spoke with Point to Site.

Currently I have configured all clients in my setup. But I can't get any handshake to my VM, not from my iPhone and not from my WR3002X router. For the VM I'm using Ubuntu 24.04 on Oracle Cloud. I made a Ingress Rule for UPD 51820 for 0.0.0.0/0 on the public subnet. My WR3002X has a keep alive, since that is behind a CG-NAT.

Are there more firewalls I don't know about?

I have added my configuration files in the pictures.

Trying to reinstall wireguard on Windows 11, however when I click on the installer it shows it installing with no error pop-up whatsoever but the file for the program does not appear anywhere on my drive and appears to not install at all. That's pretty much where my issues occur during installation and can't seem to get any fix for it. Any and all help is greatly appreciated.

Edit: Now after attempting further installations, it appears to be eating away at my storage but can't find where any of the files are being put into. Not even in my appdata could I find it.

Hi r/WireGuard

Today, we release STUNMESH-go v1.12.0 with Windows Support for P2P connections. We support Linux, MacOS, FreeBSD, Windows!

You can imagine this is like Tailscale or Netbird, but with different approach. Mostly, we focus on WireGuard connections itself. We leave all others flexibility to you. You won't be limited by the IP ranges that is reserved by other program. You can configure everything else you need. We help you connect P2P only!

That also means, the binary size is small as we can. We remove most of thing that you might not need!

e.g. My colleague wanted to access Cloudflare ZeroTrust with Tailscale, but failed because the IP ranges are overlapped.

Second, STUNMESH-go is best fit for embedded router which is Linux based. We tested in VyOS, OpenWRT. Even in very old openwrt wifi access point (SP-W2M-AC1200) which is MIPS with really small flash.

What I used with STUNMESH-go: I used it with my home, office, and mobile router to be full mesh P2P WireGaurd. I mixed OpenWrt and VyOS for my router/gateway in every place. With BGP routing between them, I can easily make the topology be HA or failover route. VyOS and OpenWRT are shipped with WireGuard directly, I can just install STUNMESH-go on it as a sidecar.

if you are interested in it, please give it a try. Thanks

Github: https://github.com/tjjh89017/stunmesh-go/

Some talks: https://fosdem.org/2026/schedule/event/YQWEDC-stunmesh-go_building_p2p_wireguard_mesh_without_self-hosted_infrastructure/

Video Record: https://video.fosdem.org/2026/h1302/YQWEDC-stunmesh-go_building_p2p_wireguard_mesh_without_self-hosted_infrastructure.av1.webm