Hello there, I'm writing here because I tried everything and I can't wrap anything up. Please bear with me while I explain the problem and all the steps I tried. Thank you in advance for your patience!
PROBLEM:
I have a PiVPN (Wireguard) server, which I use to access my LAN services.
I configured many clients, including Android, Ubuntu, Raspberry OS, Windows, iOS, MacOS, GliNET travel routers, and all work flawlessly in every condition like under WiFi, 5G, 5G hotspot, etc.
Now it gets strange: since I often need to use my LAN services from my brother's house, I take my PC with me and connect to my VPN from his WiFi.
It always works with everything EXCEPT Linux systems using kernel Wireguard implementation. Ubuntu, Raspberry OS and OpenWRT all fail to handshake when I'm connecting from his WiFi.
MY CONFIGURATION:
– I use a standard Wireguard conf, let's call it wg-personal.conf, put inside /etc/wireguard/
“`
[Interface]
PrivateKey = <PRIVATE KEY HERE>
Address = 10.21.181.14/24
DNS = 10.21.181.1 <– That's because I have the DNS on the same server as Wireguard
[Peer]
PublicKey = <PUBLIC KEY HERE>
PresharedKey = <PRESHARED KEY HERE>
Endpoint = <ENDPOINT HERE>:51820
AllowedIPs = 0.0.0.0/0 <– Full tunnel
“`
– I use wg-quick up/down wg-personal
– kernel modules are present and used
NOTE:
– The same configuration works on the same PC with Windows installed, or other PCs with MacOS, iOS, Android, and the same WiFi net
– Another friend of mine also has a Wireguard server, configured with WG-Easy instead of PiVPN, and it works flawlessly from Linux Systems under my brother's WiFi (we checked every line of the conf, all is configured the same)
– Mullvad Wireguard conf files work like a charm
– The endpoint is resolved correctly
– Tried several different routers, all with same ISP (my brother has the same ISP and router as mine – Vodafone WiFi 6 Station, Italy), under all routers it works except my brothers
STEPS I TRIED AND CHECKS:
– Checked Keys, both manually and copying again from the pivpn generated config
– Tried the config on other non Linux devices, they work
– No IP overlap between my VPN net, my services and the WiFi net
– Tried different MTU values
– Tried KeepAlive
– Changed Wireguard ports on server to ports like 443
– Changed listening ports on clients
– Added a travel router that worked on other WiFi networks, nothing, same problem since the router is itself Linux
– Tried activating the Guest Wifi net on my brother's router, IT WORKS FOR 5 MINUTES, then it fails again the handshake
– With tcpdump no packets are received by the server, but on the client side I see packets sent but not received, hence no handshake
– Tried wireguard-go, installed from GitHub on a local folder, IT WORKS, but requires a script, since if I install the wireguard-go package, it doesn't work (maybe just some mistake on my side, but I'm forced to use the script at my brother's house, and use wg-quick from outside)
– Tried opening the port 51820 on my brothers net just in case
– Reset the router
– Installing firmware updates
– Checked EVERY SINGLE configuration between my router and my brothers, no differences
– Checked a lot of websites, forums, etc
– Etc, etc, I surely have forgotten a ton of others things
Have you ever encountered something similar? I keep trying everything only to always return back and ultimately abandoning Linux when I'm at his house, and like that I cannot use linux continuously.
Thanks for reading until the end!
TL;DR: WireGuard works everywhere except Linux kernel WireGuard on my brother’s Vodafone Wi-Fi. Windows/macOS/iOS/Android, Mullvad, and another WG server all work fine on the same network. Linux sends packets but the server receives nothing/no handshake. I’ve tried different keys, MTUs, ports, KeepAlive, routers, firmware, Guest Wi-Fi, etc. wireguard-go works, but kernel WireGuard doesn’t. Seems like a bizarre router/ISP ↔ Linux kernel WireGuard incompatibility.
Source: r/WireGuard · by /u/yugotennouji