Welcome to the r/WireGuard subreddit!

Is it possible to get dynamic TCP fallback like with tailscale? Some of the networks I use block UDP traffic completely, so this would be really helpful.

I don't know a lot about tech but I've tried every vpn, just doesn't work. I do know that my school uses secure2w and they made all the students install a 'wrapper' of some sort - could anyone give any information on how I could potentially bypass this?

Hello!

I've set up WireGuard server on my Asus GX-11000 router & installed the Android client on my Samsung smartphone, hoping to log in & watch sports & movies while away from home.

Both setups appear successful. I'm away from home & my phone is shaking hands with the router like a nervous freshman at a fraternity rush party.

But none of my phone apps seems to care; they all show my location is where I am, not where my router is, regardless of whether I'm on hotel WiFi or mobile data.

Clearly I'm not as smart as I once was or think I am. What am I doing wrong?

Hey everyone!

I've been using WireGuard on Linux and wanted a more convenient way to manage my existing VPN profiles without constantly switching between configuration files and terminal commands.

So I built **WG Deck**, an open-source desktop application written in Python and PySide6.

The idea is simple: provide a desktop interface for native WireGuard configurations while keeping WireGuard itself in control.

**What it currently does:**
- Discover and manage native `/etc/wireguard/*.conf` profiles.
- Connect and disconnect tunnels with explicit authorization.
- Display interface status, traffic counters and available handshake information.
- Create, edit, import, export and back up configurations.
- Provide read-only diagnostics, system tray integration and light/dark themes.
- Offer a demo mode with synthetic data for safely exploring the interface.

**A major design consideration was security.**

The GUI runs without root privileges. Privileged operations are delegated to narrowly scoped, root-owned helpers using separate Polkit permissions for reading, connecting and managing configurations.

WG Deck doesn't implement its own VPN protocol or replace WireGuard. It works with the native Linux tools and configuration files.

**Current release:** v1.0.0, with a Debian package targeting Ubuntu 26.04.

**GitHub:** https://github.com/matteodurso88/wg-deck

**Release:** https://github.com/matteodurso88/wg-deck/releases/tag/v1.0.0

The project is GPL-3.0-or-later licensed, and the source code and technical documentation are available in the repository.

I'd really appreciate feedback from people who regularly use WireGuard on Linux.

**Would you find a native desktop manager like this useful? What would you improve, particularly around configuration handling, permissions or diagnostics?**

I'm interested in real-world use cases and constructive criticism. Thanks

I've been trying to set up Wireguard so I can remote into the admin dashboard of my TrueNas Scale server. I've set it up in a way that should work, but no matter what I do it fails to work.

I set up a port forwarding rule from 51820 external to x.x.x.x:51820 where the x's are my server IP address.

On the TrueNas Scale, I installed wireguard. The IP range I set to 192.168.1.0/22. my endpoint is (public IP):51820. I updated the interface from eth01 to eno1 whic is the ethernet adapter with an address.

I downloaded and loaded the config on the client laptop. But no matter what I do I can't ping my TrueNas.

I don't even know where to begin to trouble shoot this, so any ideas? I'm sure this is user error I just don't know WHERE

(First things first, sorry for my english i'm french)

Last week I shared my project here and it temporarily became the #2 most viewed post on the sub for the last week. A huge thank you to everyone using it, upvoting, and especially those who starred the repo on GitHub 🥹️, it gives the project real long-term credibility.

To clear up the heated debate around security and "vibe coding": nothing is more important to me than security. I would never accept a PR or push code without strict input verification and multiple security reviews. I just ran Cloudflare security skills on it, with 0 confirmed vulnerabilities. That said, if you ever spot a potential flaw, please report it directly to my PM or through GitHub.

Looking ahead, I am completely open to your feature proposals and ideas, as I am running out of things that would be genuinely useful to implement. Even without new features, I will maintain the project by updating dependencies and rebuilding the image at least once a month.

One quick note: Amnezia VPN is on hold for now. Constant Linux kernel updates keep breaking its kernel side, and I'd much rather give you something rock-solid than a setup that breaks after a routine system upgrade.

Thanks again for the incredible support you give to my project.

Edit : https://github.com/wg-ez/wg-ez

Hi,

I'm looking for a way to allow connections to computers in a LAN while a Wireguard tunnel is active.

I know this is probably extremely easy but, unironically, I can't find an actual guide on how to do it. I'm using the default "wireguard-tools" which I installed using

sudo dnf install wireguard-tools

And then something called Wireguird to set up the tunnels. The OS is Fedora Workstation 43.

For the tunnel and keys I signed up for the Proton VPN service which has its own guide on how to set it up with Wireguard.

My problem is whenever the tunnel is active I can only access the internet, and the rest of the LAN is cut off, for example I'm not able to connect to a file server, use LAN Messenger, or see things like scanners or printers.

Is there a way to do both at once? problem is my internet is extremely slow and it takes its sweet time to open even the least bloated websites, and hours to download a file IF it's stable and the download isn't cut.

I read I need a special router to do that, that can't be truth, right? there's no way to get "high end" routers in my country and all I have is an ancient ISP modem wired to a probably equally older Cisco router.

Thanks.

Hello,

I am looking for beta testers for a project I have been working on that allows you to steer network traffic on Windows while running multiple network interfaces. For example, you can run the official WireGuard, Tailscale, OpenVPN etc. clients in parallel and Rouler will allow you to decide which app or app + IP goes though which network interface. As long as your VPN client sets up a network interface, Rouler can steer traffic through it. So your setup may look like this:

Chrome -> WireGuard VPN

Firefox 10.0.0.0/20 -> Tailscale

CS2 -> OpenVPN

Everything Else -> Ethernet

If you have a use case for this sort of setup and are comfortable with VPN configs, route tables, IP's and subnets, please take a look at https://rouler.io for further details and a beta key.

If you have any questions please contact me through the websites email or reply here.

Thank you

Hallo, ich hab jetzt viel rum gesucht aber nicht mein Problem und demnach auch nicht Lösung gefunden. Vllt kann mir hier jemand helfen.

Fehlerbild:
Sobald ich mich innerhalb eines WLAN (Hochschul-WLAN oder das meiner Unterkunft) befinde und mich mit meinem Heimatnetzwerk (Fritzbox-Gegenstelle) verbinden will, kommt die Meldung "DNS-Hostname kann nicht aufgelöst werden.

Sowohl mein Notebook, Smartphone und Tablet, haben verschiedene WG-Peers. Die meisten haben eine direkte IP-Adresszuweisung sodass keine DNS auflösung nötig ist. Der Peer der zu mir nach Hause in die Fritzbox geht muss allerdings über DynDNS aufgelöst werden.

Die Auflösung Mittels DynDNS funktioniert auch einwandfrei und nslookup abfragen geben auch immer direkt die richtigen Adressen zurück. Wenn mein Handy oder andere oben genannten Geräte im mobilen Netzwerk hängen, dann wird die WG-Verbindung ebenfalls ohne Probleme hergestellt.

Befinde ich mich aber jetzt in einem WLAN und versuche den WG-Peer mit der DynDNS-Adresse aufzubauen, dann kommt wieder der Fehler ausgegeben. Nehme ich zum testen einen anderen Peer mit direkter IP Zuweisung, wird dieser Tunnel wieder Problemlos etabliert. Es hakt also an der Namensauflösung.

Hab schon versucht an den DNS, Allowed IP´s etc. rumspielen aber ich komme nicht hinter, wo das Problem liegt, weswegen ich in öffentlichen WLAN Umgebungen keine VPN Verbindung aufbauen kann.

Hat da jemand das gleiche schonmal gehabt und Lösungen gefunden?

I have a TV at my daughters, its wireless and she has internet via wireless (ATT Home), and I have Startlink with wifi in home.

I would like her to be able to access my network to use plex, netflix, etc from my network.

My confusion comes in that her device would need to connect to a router via wifi, and then connect to her internet via wifi. The vpn server at my house would connect via wireless as well.

I was thinking 2 of these?

ax1500 travel router

https://www.amazon.com/AX1500-Portable-Travel-Router-Dual-Band/dp/B0GLP6QL6R/ref=sr_1_11?crid=39KF4T3QSGCTS&dib=eyJ2IjoiMSJ9.MFGCy_vso6nmjxgaaRCHIj5LbFQP7c082rgIRRYGawXw2znWYrozsW14fgvNMGMXjM35Cdyi_6dnHuDBwXLOqq9AcR43JEgQPfWFqBoOdKHlxWiqqoA5kDVi_YIhrmfLi51CckPwh_JyosuZb9lX5pS_nM9-bswqzGoenqT5owQgRdYf_RMxAYx7TwsSSw8QKnW8i8G0tUIaFAyQ3WX261SEBYv-G3CQPoRC8n5xXXs.3wU1oZ2iisuiVWeRtMQ_64MtGB75XureUUqNG-DTemY&dib_tag=se&keywords=wireguard&qid=1792186849&sprefix=wireguar%2Caps%2C207&sr=8-11

or two of these

gl-inet-gl-ar300m16

https://www.amazon.com/GL-iNet-GL-AR300M16-Pre-installed-Performance-Programmable/dp/B0777L5YN6/ref=sr_1_12?crid=39KF4T3QSGCTS&dib=eyJ2IjoiMSJ9.MFGCy_vso6nmjxgaaRCHIj5LbFQP7c082rgIRRYGawXw2znWYrozsW14fgvNMGMXjM35Cdyi_6dnHuDBwXLOqq9AcR43JEgQPfWFqBoOdKHlxWiqqoA5kDVi_YIhrmfLi51CckPwh_JyosuZb9lX5pS_nM9-bswqzGoenqT5owQgRdYf_RMxAYx7TwsSSw8QKnW8i8G0tUIaFAyQ3WX261SEBYv-G3CQPoRC8n5xXXs.3wU1oZ2iisuiVWeRtMQ_64MtGB75XureUUqNG-DTemY&dib_tag=se&keywords=wireguard&qid=1792186849&sprefix=wireguar%2Caps%2C207&sr=8-12

Edit: for some reason I changed the mobile hotspot info on my phone from "Phone MAC" to "randomized MAC". When I reverted the change it started working again...

I have a Wireguard VPN server set up on my Ubiquiti UDM-Pro. I have several clients generated that have all worked flawlessly until a few weeks ago. My laptop on Win11 just stopped working. I just checked my Android app and it's connected and working (UDM dashboard shows 1 client connected and I can access LAN resources from the phone).

I noticed one weird thing... In my troubleshooting, I removed the client entry on the UDM Pro for the tunnel for my laptop and deleted the tunnel on my WG Windows app. I re-created the client tunnel on the UDM pro, downloaded the config, saved, and applied changes on the VPN options page. When I click back into the VPN setup page, the client entry for the tunnel for my phone (correctly) doesn't allow the config file to be downloaded again. But weirdly, I can click back into the client config for the laptop tunnel, and the QR code and download link for the config file is still available... This seems like a very good lead on the problem. Any thoughts?

https://github.com/wg-ez/wg-ez

(Sorry for my english as a french guy)

Hi everyone, I’m the developer of wg-ez, a lightweight WireGuard manager with a modern Web UI, written in Rust.

I decided to build wg-ez because i liked the "almost" simplicity of wg-easy but the UI felt dated + a full Node.js wasting my ram for a dashboard that i open once every two months felt like a waste of RAM in that period. I also wanted zero-effort networking: wg-ez automatically checks if your container can route IPv4 and IPv6 with zero manual config to have a better experience out of the box than wg-easy.

Few important points:

• ~1-2MB of RAM usage: Written in Rust with zero JS runtime overhead.
• Modern Web UI: A clean, fast, and responsive interface to manage peers.
• Smart IPv4/IPv6 auto-detection: Tests container routing automatically and uses IPv6 if available, or seamlessly falls back to IPv4 with zero configuration.
• Instant client provisioning: Generate configuration and QR code with only ipv4 or ipv6 or ipv4+v6 based on the server network.
• Per client Firewall to avoid your family and friends doing some stupid stuff with your network

I’d love to get feedback on how it runs on your setups.

Happy to answer questions here if you have or implement some feature you request if they are pertinent!

I had port 51821 open because I thought I had to open UDP and TCP to make my VPN work.

Apparently, that was a bad idea because I had that shit on my wireguard interface (I use wg-easy)

Was that the main source ? The only services I expose directly to the web (with reverse proxy of course) are jellyfin, jellyseer and termix (with strong password) and a geographic bloc.

Edit : Ok, TCP 51821 is my admin webpage and there is probably a vuln to bypass the admin password. I thought I had to open it, spoiler I didn't.

Equipment:

SB5100 cable modem --> Google wifi (1st gen) --> Managed switch -->Raspberry pi 3b+ (wireguard) --> remote desktop to win 11 boxes.

Config:

I installed wireguard on a pi 3b+ about 3 weeks ago where I work since a port sniffer found the open ports I was using to remote into a few win 11 boxes (I know, bad me. I'm not a pro!). I used pivpn and everything worked out of the box except for remote desktop. After searching around, I decided to go with split tunnel where I configured AllowedIPs = 10.x.x.x/24, 192.168.x.1/24 on the peer side and bam, full access without port forwarding and I can ssh directly into the two RPIs I have running on the work network (could not do this with full tunnel, came back with port 22 error).

Problem or area of confusion:

Prior to going with split tunnel, if I used whatismyIP, it would come back as the work IP address. OK, life is good. Now, with split tunnel, it comes back as my home IP address which seems normal since as I understand it, browsing is routed locally. But here's the thing, I'm running pihole on a second pi 3b+ at work and I have domain blocking (facebook, reddit :), instagram, etc.) so when I'm connected at home, those domains are block. I'm also running pihole at home but when I navigate to the admin page, it takes me to the pihole running on my work network. I can ping win 11 boxes, printers, etc. on work network so it seems like my traffic is being routed through the vpn yet I thought split tunnel kept browsing local.

Question:

Where is my traffic being routed? Is it flowing through the tunnel and I'm secure or is routed through my home network despite acting like I'm on the work network? From what I understand of split tunnel, it should be routed through my home network but that would not explain why I'm connecting to pihole running on my work network. It doesn't matter when I'm home as it's a secure network but when I'm on a public wifi network, I'd like to understand if I'm protected or exposed. Did I accidently configure wireguard to work as I had hoped and I'm routing all traffic through the VPN tunnel? Or am I way off and don't understand what's going on because I'm not a pro?!? Thanks.

i have standard WireGuard for test and configured on router. if i have gateway 10.10.10.10/27 and i need to exclude one of the 30 IPs from using the vpn for example 10.10.10.19, now if i set the allowed IPs 0.0.0.0/5 or the default, what list of my private IPs i should add in the allowed IPs to let all 29 private IPs of the private lan to use the WireGuard and exclude one of them not to do 10.10.10.19 or bypass. .
Please if i missed or have some mistakes in my post, sorry for that, you can tell me what to and how to fix it.

Thank you

Hi everyone, I’m the developer of WireTunnels, a native macOS app written in Swift for managing WireGuard configurations from the menu bar.

I shared the first version here a few months ago and have continued maintaining it. I’ve just released version 1.0.6, so I wanted to share what’s changed since that initial post.

The app supports:

• Multiple WireGuard tunnels connected simultaneously.
• Split DNS, so selected internal domains use a tunnel’s DNS while other queries use the normal resolver.
• Wi-Fi SSID rules for connecting and disconnecting tunnels.
• Shared tunnels for different user accounts on the same Mac.
• Apple Shortcuts actions for connecting, disconnecting and checking tunnel status.
• And much more

It’s free and open source under Apache 2.0, requires macOS 14+, and doesn’t require an account. It works with your existing WireGuard configurations; you provide your own server or endpoints.

Source, installation details and releases:
https://github.com/FMDigitech/WireTunnels

I’d particularly like feedback from people accessing separate home, work or lab networks on a Mac. Multiple tunnels still need compatible routes, so I’m interested in hearing about your actual setups and any issues you encounter.

Happy to answer questions here!

i used https://lanrat.github.io/wireguard-warp-generator/ to generate a cloudflare warp .conf file but it doesnt work i also tried to use vpnbook to get a .conf file but the same error happenes : 2026-10-10 21:02:33.494: [TUN] [AM_TIRED] Handshake for peer 5 (162.159.192.1:2408) did not complete after 5 seconds, retrying (try 2)

So I recently got ProtonVPN. I've been looking at options to integrate it for my entire home network

One of the issues i'm seeing with a lot of wifi routers is that once wireguard is turned on the wifi and lan speeds drop. It seems that this happens because for some reason hardware acceleration is disabled on a lot of routers when wireguard is active

I'm sure that you guys could recommend some affordable routers that won't have a major performance hit. I would like tj stay under $150

The other option i'm considering is using an older pc i'm running it as a VPN server... though it's been many years since i've done anything like this. And i'm not quite sure where to start.

Looking for suggestions please

So I recently got ProtonVPN. I've been looking at options to integrate it for my entire home network

One of the issues i'm seeing with a lot of wifi routers is that once wireguard is turned on the wifi and lan speeds drop. It seems that this happens because for some reason hardware acceleration is disabled on a lot of routers when wireguard is active

I'm sure that you guys could recommend some affordable routers that won't have a major performance hit. I would like tj stay under $150

The other option i'm considering is using an older pc i'm running it as a VPN server... though it's been many years since i've done anything like this. And i'm not quite sure where to start.

Looking for suggestions, please.

Also my isp maxes out at 150 mb/s... based on that, I don't have very huge requirements for router or vpn Server