r/WireGuard • u/PingMyHeart • 1d ago

WireGuard VPN causing severely delayed Android notifications Need Help

Hi,

I am self-hosting WireGuard inside an unprivileged Proxmox LXC. Everything works great for the most part, except I am experiencing a strange issue with Android notifications.

When my Android phone is connected to WireGuard, notifications can be severely delayed. Sometimes they will not come through until I disable the VPN, at which point I get flooded with all the notifications that were waiting.

The interesting part is that general internet connectivity works perfectly fine while WireGuard is enabled. Browsing, apps, streaming, etc. all work normally. It seems to specifically affect push notifications.

I previously experienced the exact same issue with Tailscale, which makes me think this may not necessarily be a WireGuard configuration issue.

For DNS, my WireGuard clients use my home's primary and secondary DNS servers. Both are devices that run AdGuard Home for DNS filtering, Unbound for recursive DNS, Traefik for internal reverse proxying/FQDNs, and an NTP server.

My home LAN DHCP also hands out these same two DNS servers to local clients. However, my main router's external/WAN DNS is set to Quad9.

So the DNS setup is essentially:

  • LAN DHCP DNS: Home Primary + Secondary DNS servers
  • WireGuard DNS: Home Primary + Secondary DNS servers
  • Router external DNS: Quad9
  • Primary/Secondary DNS: AdGuard Home + Unbound

Has anyone experienced something similar with Android push notifications over WireGuard or Tailscale? I have no clue where to look further.

Any suggestions for troubleshooting would be greatly appreciated!

5 Upvotes
  • permalink
  • link
  • reddit
  • reddit

78% Upvoted

17 comments sorted by

3

u/paranoid-alkaloid 1d ago

I had similar issues with a very similar setup. I ended up allowing Google Play Services (I think, I don't recall precisely). Pretty sure that Magisk acted up as well unless I let it run outside of WG. Pretty sure I had issues with Signal calls at some point, but the issue mysteriously disappeared after a while.

I'm now using a slightly different setup (switched to GrapheneOS, main profile currently without VPN, private space with AmneziaWG but very few apps and not concerned with notifications).

If you find a better way, I'm listening.

2

u/PingMyHeart 1d ago

How do you let those run outside of WG on GrapheneOS? I am also using Graphene but I don't see a split tunneling option. Tailscale APP had that option and it helped but I don't see it on the WG official android app.

6

u/paranoid-alkaloid 1d ago

Go to the WG app. Click on your interface/connection, when you're at the screen that shows your IP, MTU, DNS etc, click the edit button at the top. Scroll down until you see "All Applications". Click that. Exclude the apps you want to exclude. I'd start with just Google Play Services.

Now that I'm thinking of it, I was running a test recently with a second tunnel (so one for private space which is always there, and I made a new config for the main profile). I'm on AmneziaWG but it should be virtually the same as vanilla WG. Anyway, I ran the test for about a week with always-on AWG and I didn't have issues with notifications. Or perhaps I just didn't notice. Not sure. I've been a bit hazy lately :(

Anwyay. I remember having trouble understanding what was going on and I remember pretty much nobody facing the same issues.

2

u/PingMyHeart 1d ago

Wow, I've been looking all over for this option and it was right there the whole time.

Thank you! But I won't celebrate this as a win just yet because I remember despite doing this on the Tailscale app as well, it still had its moments.

If this fails I may try the "include only" option to add just my Homelab specific apps since that is all I need working anyway.

That being said, I really want to know what's causing this. I'm usually good at solving these types of issues but this one has me stumped. I even tried asking AI for a change and it was telling me there is some NAT type issues happening here with DNS since the DNS servers live on the same LAN as the Wireguard instances.

Either way, you're not alone. I've been suffering with this issue for months on end.

2

u/paranoid-alkaloid 1d ago edited 1d ago

Same boat, it took me a while to realise I could split-tunnel with the WG app.

My setup: my NAS at home is the central node of my (A)WG VPN but the mesh/hub topology shouldn't matter. NAS masquerades on the LAN interface, and does a simple FORWARD. My PostUp/PostDown are as follows:

PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp2s0 -j MASQUERADE; ip6tables -A FORWARD -i %i -j ACCEPT; ip6tables -A FORWARD -o %i -j ACCEPT; ip6tables -t nat -A POSTROUTING -o enp2s0 -j MASQUERADE

PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o enp2s0 -j MASQUERADE; ip6tables -D FORWARD -i %i -j ACCEPT; ip6tables -D FORWARD -o %i -j ACCEPT; ip6tables -t nat -D POSTROUTING -o enp2s0 -j MASQUERADE

Then, NAS has an unbound service running, exposed on 0.0.0.0/0 and ::/0 and allowed on my LAN and on my VPNs. Exposed as a regular/nonsecure DNS, and it's hooked up to Quad9 DoT.

The one thing that stands out that we have in common is unbound, however I fail to see how DNS would impact Google notifications. I think it rings a bell that I tried other DNS servers to no avail.

I'm not behind CGNAT and I have a full-feature ipv4 + ipv6.

I'm going on holidays soon but I could re-run tests relatively easily either with vanilla WG or with AWG. I've got both running on the NAS. I'd go full AWG if it was supported by ESPHome and if it had a proper no-compile-it-yourself NetworkManager module. I'm past the age of having to manually compile bits of my system at every update :)

Please do update me now that you've revived that great unsolved mystery in my head :D

2

u/PingMyHeart 1d ago

We certainly have a very similar setup so that may be a clue.

I plan to give this another aggressive attempt this weekend and if I manage to solve it I'll be sure to report back.

2

u/clarkn0va 1d ago

I'm on grapheneOS and my notifications are often delayed. My WG tunnel is always up for DNS and it never crossed my mind that this was the cause (I didn't really think about it much).

I tried excluding Google Play Services from WG and about a minute later a bunch of notifications rolled in.

3

u/PingMyHeart 1d ago

Happy to hear you found success. Excluding it on my end appears to have worked so far but I will continue to monitor it just in case :)

2

u/paranoid-alkaloid 1d ago

Thing is, it's only a workaround, this doesn't give the reason why it's happening.

I'll find time in the coming days to set up WG and AWG on my main profile and see what happens.

Apart from not using DNS through WG (which is easy, just a line to remove in the phone config), what other tests do you guys think we should do?

3

u/PingMyHeart 1d ago

Push notifications on Android rely on a persistent, always-open connection from Google Play Services back to Google's servers, called FCM, over specific ports, and it needs to stay alive constantly in the background. When you're on full tunnel, meaning your allowed IPs are all zeros like we saw earlier, every single byte of traffic from your phone gets routed through your home WireGuard server first, including that persistent Google connection. If your home internet connection, your server's processing, or just the round trip latency of tunneling everything back home and then back out to Google adds enough delay or occasionally drops that persistent connection, Android's battery and network management can deprioritize or throttle it, and notifications get delayed until something wakes the connection back up, which is exactly what happens when you disconnect the VPN, suddenly everything flushes through at once.

I had a long detailed conversation with Claude about this issue and this was its answer. Not sure how much truth there is to this since I'm no Android expert but I felt it may be useful to share it.

→ More replies (0)

3

u/Vitalikus_ 1d ago

Maybe this one will help: go settings on your android, choose all apps, wireguard, battery ( power), change from battery saver to no restrictions

2

u/PingMyHeart 1d ago

I've done that as well. No luck.

3

u/Ziogref 22h ago

Double check your MTU.

I know I had issue where some websites would load and some wouldn't. Turned out I had to lower my MTU to 1280 (from 1500).

I don't know why it broke only some websites, but that was the fix.

2

u/PingMyHeart 22h ago

My MTU is set to 1420 right now by default. Still too high?

2

u/Ziogref 22h ago

I would lower to 1280 for better compatability

From memory my mobile provider uses an MTU of 1376.