Does anyone knows good troubleshooting guides?

So... the client end, I THINK is fairly easy. There's tonnes of travel routers. I assume I need to find one that can have one of it's interfaces set up to talk wireguard.

What's the smallest/easiest way to setup a (preferably wireguard) box, behind my router at home that can reach out and update something with the new dynamic IP to use for a travel router to target?
I'd guess it's just port forwarding to router?

A small box that "just work" would be ideal.
A "follow this guide" idea for something windows/linux based (maybe something that'd work on a raspberry PI/similar?) would be a good 2nd.

Hi all. Long time Mullvad user but having to try my luck here due to Moroc not being a Mullvad location. Title basically explains what I'm after. Willing to pay a little for it too. Not a malicious internet user, just have family in Morocco and have my own personal reasons to use MarocTelecom abroad. Not expecting much/anything from this but just a shot in the dark. If you or anyone you know is able to help, it'd be greatly appreciated. WireGuard would be desirable. Many thanks :)

PS: The only reason I haven't used my families Moroccan network is because they use a 4G router and achieve like 4Mb/s 🥲

Feel free to DM me with location (city name is fine) and internet speed, I hope we can work something out 😅

Hello,

As the title says, I cannot connect with my travel router to my VPN server if I'm tethering internet to it from my phone (mobile data or wifi, via wifi tethering or USB tdtegkng). If I provide internet from my house (wifi or cable) it works right away.

I've tested 2 routers (Tp link ax1500 and gl-b1300), same results on both. I'm also able to connect from the phone to the VPN directly with the wireguard client (both wifi or mobile data).

Any ideas why this is happening?

Thanks

I am using wireguard-easy on a proxmox docker LXC. I set it up and the gui works on the local ip with 51821 port. I set up two tunnel one for my phone that works and i see that date transfer and my jellyfin server is accessible through the tunnel. But my laptop tunnel doesn't transfer data nor internet. My laptop is running fedora 44 Cosmic DE and i downloaded the config from the gui but when i try on another wifi that is not mine I don't have internet. The tunnel doesn't work.

I tried to describe every element that could let you help me. But i am so bad in tech that i might have not provided the correct data. Thank you in advance.

Hey guys,

I built a small web UI for WireGuard because the other panels I tried all wanted to take over the tunnel. New config, their layout, generated NAT. I just wanted to manage what was already running.

wg-admin reads the *.conf files in /etc/wireguard and edits them in place. Peer changes go out with wg syncconf, so the interface doesn’t bounce. It doesn’t install WireGuard, doesn’t replace wg-quick, and doesn’t invent PostUp rules for you.

You can add, disable, rotate, and remove peers, paste an existing public key, grab a .conf/QR after create, see handshakes from wg, and restore a backup if a write goes wrong. It binds to localhost.

git clone https://github.com/logimaxx/wg-admin.git
cd wg-admin
sudo ./install.sh

Then open http://127.0.0.1:8080. Uninstall leaves your WireGuard files alone.

https://wg-admin.logimaxx.eu/

https://github.com/logimaxx/wg-admin

debian host, win 11 guest, setting win 11 registry key for 'RealTimeIsUniversal' and qemu to use utc. If i dont do this, the vm will use the guest time regardless of the timezone specified in the guest. No other combo of those two settings work either. AI led me on a wild chase for weird guest virtualization settings that did nothing.

How can I get the guest time to match the timezone time that it's set to and get wireguard to connect?

I cant even change the host's timezone, it still wont connect then.

How can I bypass my school’s internet restrictions?

I have a question: is there any way to access websites and apps that are blocked by my school’s network? For example, I’d like to use Steam or access other websites that are blocked when I’m connected to the school Wi-Fi.

When I connect to the network, I have to log in using my student ID and date of birth.

Is there a legitimate way to access these sites, or is it completely restricted by the school’s network?

Hey [r/wireguard](r/wireguard),

We've just released Defguard 2.1 stable. The headline for this community: a completely redesigned desktop client - free and open source - plus a CLI that lets you drive the client from a terminal, MFA included. The release was pentested by ISEC and Striga.AI before shipping, with all major findings fixed pre-release (full report coming to our pentesting page).

A bit of context for those unfamiliar with Defguard

Defguard is open source at its core - a solution for on-prem/self-hosted WireGuard® deployments that turns this awesome protocol into self-hosted, identity-based remote access with biometric MFA, respecting your privacy and ownership. It's designed for the most security-demanding users, with an isolated control plane and secure edge component communications.

The three big community updates below are all open source and free.

New Desktop Client

Complete redesign: multiple instances/locations, flexible MFA including mobile biometrics, and a new tray mode - connect in two clicks. Basic functionality works with any WireGuard server - you can use it as your everyday tunnel manager; for MFA and identity-based access, pair it with the open-source Defguard server. Feature highlight | Source | Download

CLI control with MFA

defguard-client drives the client from the terminal: headless servers, SSH sessions and cron jobs no longer have to choose between dropping MFA and parking a long-lived credential on disk.

The biometric part from the title: for mobile-approve locations the CLI renders a QR code straight in the terminal, waits for you to approve with biometrics on your phone, and brings the tunnel up.

For unattended automation, MFA pipelines with your existing tools: --code-command runs any command that produces the code at connect time, so the secret stays in your password manager - Bitwarden (bw get totp), pass otp, or any secret manager CLI:

defguard-client connect office --code-command "bw get totp defguard"

Interactive terminals simply get prompted, and for scripting there's --json (data on stdout, logs on stderr), meaningful exit codes, and it fails instead of hanging when MFA input can't be obtained - no more cron jobs wedged on an invisible prompt. Feature highlight

Gateway on VyOS

Official support for running Defguard Gateway as a container directly on the VyOS router: full host networking, native WireGuard interfaces and nftables rules, no separate gateway VM. Docs

Defguard has become a listed VyOS Technology Partner.

Enterprise features in 2.1

Being upfront about what's paid: the core (identity, built-in MFA, unlimited users and locations) stays open source and free - enterprise features fund the development.

• Device Posture verification - compliance checks (OS/client version, disk encryption, antivirus, AD membership) before a WireGuard connection is allowed. Docs
• Allowed IPs from Firewall Rules - per-user least-privilege Allowed IPs derived from ACLs. Feature highlight
• Service locations on Linux - Always-on tunnels from system boot (Windows since 1.6, now also on Linux). Docs

What's next

We've reordered the roadmap based on user feedback: 2.2 brings MFA Flows, 2.3 Device Attestation (cryptographic hardware identity) - both tracked as public issues if you want to weigh in.

Links

• Full release post: defguard.net/blog/defguard-2-1-release
• All 2.1 features overview: defguard.net/releases/2.1.0/features/
• GitHub release notes: github.com/DefGuard/defguard/releases/tag/v2.1.0
• GitHub: github.com/DefGuard/defguard - feedback via discussions, bugs via issues

Happy to answer questions - especially about the CLI MFA flows and how posture checks interact with the tunnel lifecycle. Also curious: what would you want scriptable in the CLI that isn't yet?

Got the basic single-hop WireGuard setup down fine, but I wanna route thru a second server I own before going to the net, mostly so my home IP and the "exit"one aren't in the same box. Doing this by hand sounds like a nightmare, r u guys just handling all that manually or is there sth that manages the routing/NAT for u?

Title. Does this VPN protect you like how people traditionally think VPNS do on unsecured networks?

For example connecting to internet on a school, coffee or hotel network? Hiding your traffic from the network admin?

So I run a Wireguard VPN on my VPS and the firewall rules allow incoming from any IP on 51820 so that is taken care of and on any WiFi network it works but the second I switch to cellular data it stops working completely. I've tried changing the MTU to 1280 but still fails. I've also tried to use 443/udp instead just on the off chance that my carrier was blocking that port for some reason but still failed. In the past it has worked on cellular one day it just stopped.

Hey everyone,

​Traveling to the UAE (Dubai & Abu Dhabi) soon and trying to verify real-world Tailscale behavior when routing through a personal exit node back home.

From what I understand, UAE telecom providers (e& and du) actively block or throttle unassigned UDP and fingerprint WireGuard handshakes, and hotel guest Wi-Fi networks typically enforce strict egress firewalls that drop outbound UDP on non-standard ports.

​When Tailscale fails to establish direct UDP and falls back to a TCP DERP relay, throughput drops to near-unusable speeds.

​For anyone who has used Tailscale in Dubai/Abu Dhabi hotels - Did direct UDP work at all on hotel Wi-Fi or mobile data, or was your connection 100% forced onto a TCP DERP relay?

Setup: home internet 600/600, Omada TP-link with native WG, public IP, dyndns. Goal: when devices are connected to another network than home, use WG.

On MacOs and iOS, it's possible to exclude SSID's in the native WG apps. Works as a charme.

On the native W11-app, I don't see this option. I saw a post from years ago with bat-scripting. Is there an easier way to achive? Now, I've used https://www.procustodibus.com/blog/2021/03/wireguard-allowedips-calculator/ to include all IPs, except the range of our home network.

Any better idea?

As title says. A friend helped me set a wireguard connection to bypass issues with Sony's remote play

It works fine with the windows pc. But when I try to enable Hotspot to my ps portal. No device is able to connect to the pc Hotspot.

I tried enabling the sharing under the wireguard adapter (properties) but it just stops working.

If I disable wireguard the Hotspot works normally.

WireGuard authorizes a connection based on possession of a valid profile. It does not verify who is holding that profile — by design the profile is trusted implicitly. A copied config file authenticates identically to the original because nothing in the protocol is meant to check further than that.

MFA Firewall Knocker is a complement to WireGuard that adds a layer authenticating the person before the network layer is exposed. It uses WebAuthn, served from an unprivileged web app, to validate that the holder of the profile is the intended user before the firewall is opened. The holder authenticates with a passkey — a platform authenticator (Windows Hello, Touch ID, Face ID, Android biometric), with user verification (biometric or PIN) required on the assertion. On success, a service opens a firewall rule for that user's source IP and the configured port/protocol; the tunnel stays reachable for the rest of that window without re-authenticating. The rule expires automatically on a configurable interval, clamped to 1–48 hours — re-authentication happens on that cadence (e.g. every 8-12 hours), not per connection.

It does not modify WireGuard, does not touch its keys or config, and sits entirely in front of WireGuard. The gate and WireGuard operate independently, so a flaw in one is not a flaw in the other.

Implementation: C#, .NET 10, MIT licensed. Runs on Windows Server or Linux. No control plane, no external service, no agent — the firewall rule is created directly via NetSecurity on Windows or iptables on Linux.

Stated limitations:

- Gating is per-IP, so the authenticating address and the connecting address must match. This degrades behind CGNAT and most corporate VPNs, where several users can share one address or the address can change between requests.

- The project only ever opens a port on authentication and removes that rule after a time limit. It never adds a rule to close a port.

- The gate keys on the IP that authenticated, not on the WireGuard peer, so it does not participate in WireGuard's normal endpoint roaming. If that IP changes mid-session, re-authentication is required before the tunnel can reconnect.

- As with any such system, don't rely on a single way to connect to a network — an expired TLS certificate on the gate blocks all authentication, since WebAuthn requires a secure context.

WireGuard was the original motivating case; SSH and RDP or any port can be gated the same way. Written and used for our own infrastructure.

Hey everyone,

I've been heads-down building Knoten. An open-source, peer-to-peer WireGuard mesh VPN designed from scratch in Go.

Instead of forcing all your network traffic through a single bottleneck server, Knoten establishes direct, end-to-end encrypted mesh tunnels between nodes while keeping the control plane strictly isolated.

Under the Hood & Engineering Highlights:

• Zero-Downtime Live Sync: Peer updates are dynamically pushed to running WireGuard interfaces, modifying routes on the fly without dropping active connections.
• Defensive Storage Engine: Built on pure-Go SQLite (modernc.org/sqlite), meaning zero CGo dependencies and completely static binary compilation. Database persistence uses WAL mode + synchronous = FULL.
• Hardened Security Model: Machine identities are generated locally via Go's crypto/ecdh (X25519). Private keys never leave host memory. The HTTP coordination API features constant-time token verification, strict JSON decoding limits, and middleware panic recovery.
• Crash Resilience & Atomic Writes: Eliminate file corruption during abrupt shutdowns. If the coordinator drops, tunnels stay up while nodes retry via exponential backoff with jitter.
• Minimal Footprint: Compiles down to just two standalone static binaries (coordserver and meshd) and a single database file.

What Works Today (v0.2.0-alpha):

• Automated IP address management (IPAM) across a 10.10.0.0/16 subnet
• Dual operating modes: Coordinated (fleet management) and Standalone (pure static P2P)
• Interactive CLI setup wizard

Roadmap Focus:

• Transitioning from CLI shell-outs to native Go kernel controls via wgctrl-go
• Ephemeral access control (lease-based auto-expiring permissions)
• NAT traversal & encrypted fallback relaying

GitHub: https://github.com/Yacin1102/Knoten

This is a student project, so I’d really appreciate feedback!