Skip to main content
38 votes

How to see debug logs for WireGuard (e.g. to see authentication attempts)

Assuming you are running a kernel which supports dynamic debugging, you can enable debug logs by executing: # modprobe wireguard # echo module wireguard +p > /sys/kernel/debug/dynamic_debug/...
Henrik Pingel's user avatar
16 votes
Accepted

Wireguard not completing handshake

It might be stupid, but did you try to create new server keys, client keys, and retry? Wireguard can act exactly like this when the profiles are wrong.
setenforce 1's user avatar
  • 1,390
15 votes

Wireguard Client Addition without restart

You can use wg conjointly with wg-quick. wg is a lower-level command, actually the one used by wg-quick to really do WireGuard-specific configuration on the interface (along various ip xxx commands ...
A.B's user avatar
  • 13k
10 votes
Accepted

Make wireguard listen on multiple port

Something like this should do the trick iptables -t nat -I PREROUTING -i eth0 -d <yourIP/32> -p udp -m multiport --dports 53,80,4444 -j REDIRECT --to-ports 15351
user9517's user avatar
  • 116k
9 votes

Cannot setup WireGuard VPN

Use wg-quick instead of wg with the config file and it would work ;-). You wrote you are using directly wg command which uses a different configuration file format, resulting in the error: Line ...
Kamil J's user avatar
  • 1,717
9 votes
Accepted

Wiregurard override wg0.conf

Solved the issue. The magic trick: always stop the Interface with wg-quick down wg0 before editing the wg0.conf File. systemctl stop [email protected] will override the wg0.conf File after the next ...
Gill-Bates's user avatar
9 votes
Accepted

Wireguard Client Addition without restart

I'm working on a similar project, and my conclusion is that you're better off keeping all configuration inside your own database, and completely skipping wireguard config files for the peer setup. You ...
Ben Harper's user avatar
8 votes

Ubuntu 18.04.1, cannot add PPA wireguard/ubuntu/wireguard

Info from https://launchpad.net/~wireguard : This formerly was responsible for producing a PPA for WireGuard on Ubuntu. That functionality has now been folded into Ubuntu itself, so our old PPA has ...
315sps's user avatar
  • 81
8 votes

Wireguard not completing handshake

OK, you mentioned that the client is on VDSL, so I suspect you have an MTU problem. The normal MTU of a wired (and these days, wireless) network connection is 1500 bytes, but on *DSL the PPPoE layer ...
Michael Hampton's user avatar
7 votes
Accepted

Port forwarding with wireguard

Since you're using UFW, first make sure the UFW rule for port 56000 that you added is not a regular input rule, but instead a "route" (aka forwarding) rule, like this (assuming it's for a ...
Justin Ludwig's user avatar
7 votes

Wireguard - How to only tunnel some of the traffic

You can use iptables. Replace eth0 with the network interface that connects to the internet and 10.6.0.1/24 with your client subnet. Insert this somewhere in your Wireguard config below [INTERFACE] # ...
Trigus's user avatar
  • 111
7 votes
Accepted

WireGuard & UFW : UFW blocks traffic on wg0, even if a rule allows it

The log shows two interfaces: IN=wg0 OUT=eth0. That means it's routed/forwarded traffic and not traffic with the node as destination, where OUT= would be empty. It translates in the backend (iptables) ...
A.B's user avatar
  • 13k
6 votes
Accepted

Cannot setup WireGuard VPN

Well, in several of days, nights, and killed servers, I solved all the problems myself :) Firstly, I'd like to mention that wg and wg-quick utilities treats config files differently. So, my wg ...
AivanF.'s user avatar
  • 323
6 votes
Accepted

Wireguard VPN can't access internet and LAN

Needed PostUp and PostDown lines in wireguard.conf: [Interface] Address = 10.0.0.1/24 SaveConfig = true PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t ...
EncryptedWatermelon's user avatar
6 votes
Accepted

Firewalld Forwarding Functionality with Wireguard

From your previous UFW question, sounds like you're using WireGuard for two purposes?: 1) forward traffic from a WireGuard client of your VPS out to the Internet, and 2) forward a few public ports ...
Justin Ludwig's user avatar
6 votes
Accepted

QNAP QTS v5 OpenVPN to Wireguard server migration

In order to switch from OpenVPN to WireGuard, there are a few main differences one has to know: Wireguard is not a "server with users that login" but rather a set of computers that connect ...
uncovery's user avatar
  • 365
6 votes

How to start wireguard client on windows, in the background?

All other solutions to this problem are not ideal. The methods I've seen are: Just running as an admin Adding the user account to the Network Configuration Operators Pros: Wireguard gui, works ...
bn-l's user avatar
  • 61
6 votes
Accepted

What does the subnet mask of the tunnel ip in Wireguard do?

The subnet mask does nothing WireGuard-specific. WireGuard itself does not use or care about the subnet masks on its interface addresses (or even use or care about the addresses themselves). However, ...
Justin Ludwig's user avatar
6 votes
Accepted

Enabling wireguard log messages with secure boot / kernel lockdown enabled

To temporary enable wireguard kernel log messages, execute: sudo modprobe -r wireguard && sudo modprobe wireguard dyndbg reference: https://www.kernel.org/doc/html/v5.0/admin-guide/dynamic-...
Saxtheowl's user avatar
  • 1,202
5 votes
Accepted

the wireguard not listening on port after started

I will assume that this is done on Linux, since not told otherwise and because of container context. The description of lsof tells: DESCRIPTION Lsof revision 4.91 lists on its standard output ...
A.B's user avatar
  • 13k
5 votes
Accepted

Is it possible to disable default gateway in WireGuard VPN client?

Instead of specifying AllowedIPs = 0.0.0.0/0 specify an ip address. Ran into this question wondering the same thing. The use case detailed here pointed me in the right direction: https://emanuelduss....
Adam Chasen's user avatar
5 votes
Accepted

How to forward/route packets via wireguard overlay network?

Here is a working configuration. Phew, I actually got it myself, but it took me a while to get things right. Client I had to make sure that the peer (VPN Server) is allowed to use the 192.168.178.0/24 ...
Overbryd's user avatar
  • 533
5 votes
Accepted

wireguard "destination address required" when trying to communicate from client-to-client rather than client-to-server

Let's follow what happens: Client1's routing table tell it that 192.168.64.11 is reachable through wg0. Client1's wg0 cryptokey-routing settings tell that 192.168.64.11 is reachable through 2nd Peer (...
A.B's user avatar
  • 13k
5 votes
Accepted

How to start wireguard client on windows, in the background?

I found instructions for this at https://r-pufky.github.io/docs/services/wireguard/windows-setup.html Start-Process 'C:\Program Files\WireGuard\wireguard.exe' -ArgumentList '/installtunnelservice', '...
Roger Dueck's user avatar
5 votes
Accepted

How can I convert a wireguard vpn config file to openvpn?

You cannot do this, WireGuard is not OpenVPN, OpenVPN is not WireGuard they are different things that are only related by being VPNs.
user9517's user avatar
  • 116k
5 votes
Accepted

"very high" (probably?) MTU being set automatically on wireguard interface

SaveConfig = true directs wg-quick to overwrite a WireGuard interface's config file with the interface's current settings when the interface is shut down (or restarted). This is undesirable behavior ...
Justin Ludwig's user avatar
4 votes

WireGuard user authentication

Each side of the tunnel has its own generated key and derived public key (defined as "peer" on the other side of the connection). To act as you are writing, you would need to share the ...
Kamil J's user avatar
  • 1,717
4 votes

How to configure FreeNAS for a WireGuard VPN?

In addition to WireGuard also enable the FreeBSD packet filter pf using rc.conf tunables: wireguard_enable="YES" wireguard_interfaces="wg0" pf_enable="YES" pf_rules="/usr/local/etc/pf.conf" ...
Adam's user avatar
  • 625
4 votes
Accepted

Wireguard Unable to Complete Handshake on Android only 4G network

MASQUERADE/POSTROUTING rules do not change where certain traffics go. Routes do. The problem is that you have a default route (or what's equivalent) that leads traffics into the pia tunnel. You will ...
Tom Yan's user avatar
  • 1,028
4 votes
Accepted

Routing only the private network in wireguard VPN

Set AllowedIPs to the IP addresses you want to route to/through the peer. In a normal hub-and-spoke configuration, on your hub (S), you'd configure AllowedIPs for each peer like you have, routing ...
Justin Ludwig's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible