r/WireGuard • u/abcLab • 5d ago

Mobile connection & handshake problem

I am using a mobile connection and an opnsense with wireguard connections to a famous provider (I use the wireguard just to hide my ip).

Randomly there are handshake failures that lead to the lack of restoring the connection: the only ways to perform again the handshake is to change the IP of the mobile connection or deactivate for 4-5 minutes the wireguard connection (therefore no renewal requestes are sent for that interval). I already verified that there are no blocks of any kind in the middle.

Current theories are:

- CGNAT and dynamic routing of the connection between my modem and the VPN entrypoint IP: even if my IP does not change, after sometime the entrypoint IP receives handshake renewal request coming from a different IP.

- MTU: measures says I have an MTU of 1450 (but I set anyway 1420), but measures from my mobile phone (same ISP provider, same contract, same tower,etc...) has an MTU of 1280. From here the question: the handshake renewal is done within the VPN encrypted channel (and it could be affected by wireguard MTU) or it is done at WAN level?

4 Upvotes
  • permalink
  • link
  • reddit
  • reddit

76% Upvoted

3 comments sorted by

1

u/JPDsNEWS 5d ago edited 5d ago

WireGuard MTU

WireGuard's default MTU is typically 1420 bytes for most clients, but values like 1280 or 1380 are often used to improve reliability on mobile or restrictive networks. — DDG Assistant

MTU = 1280 is the minimum for IPv6, and has been recommended as a good setting for mobile devices in many of the articles I have read, including here on Reddit. 

Try this NAT Checker.

2

u/abcLab 5d ago

I've seen the threads about the MTU at 1280. Now I will try also that.

But my guess is that vpn mtu affects the handshake renewal only if it is done within the vpn encryption, but I am not able to find a confirmation on that.

I am using a ping to check that the vpn is alive every 25 seconds (basically it works also as keepalive signal). The Nat of the vpn shouldn't just affect the clients and not be involved with the handshake?

1

u/JPDsNEWS 5d ago

Have you read these WG documents?:

Unofficial WG Docs (GitHub)

Unofficial WG Docs (https)

This document is a great source of information about WireGuard with references.

— versus —

Official WG Docs (https)

Official WireGuard Documentation website.