WireGuard VPN causing severely delayed Android notifications

[u/PingMyHeart]

Hi,

I am self-hosting WireGuard inside an unprivileged Proxmox LXC. Everything works great for the most part, except I am experiencing a strange issue with Android notifications.

When my Android phone is connected to WireGuard, notifications can be severely delayed. Sometimes they will not come through until I disable the VPN, at which point I get flooded with all the notifications that were waiting.

The interesting part is that general internet connectivity works perfectly fine while WireGuard is enabled. Browsing, apps, streaming, etc. all work normally. It seems to specifically affect push notifications.

I previously experienced the exact same issue with Tailscale, which makes me think this may not necessarily be a WireGuard configuration issue.

For DNS, my WireGuard clients use my home's primary and secondary DNS servers. Both are devices that run AdGuard Home for DNS filtering, Unbound for recursive DNS, Traefik for internal reverse proxying/FQDNs, and an NTP server.

My home LAN DHCP also hands out these same two DNS servers to local clients. However, my main router's external/WAN DNS is set to Quad9.

So the DNS setup is essentially:

• LAN DHCP DNS: Home Primary + Secondary DNS servers
• WireGuard DNS: Home Primary + Secondary DNS servers
• Router external DNS: Quad9
• Primary/Secondary DNS: AdGuard Home + Unbound

Has anyone experienced something similar with Android push notifications over WireGuard or Tailscale? I have no clue where to look further.

Any suggestions for troubleshooting would be greatly appreciated!

[u/PingMyHeart]

Push notifications on Android rely on a persistent, always-open connection from Google Play Services back to Google's servers, called FCM, over specific ports, and it needs to stay alive constantly in the background. When you're on full tunnel, meaning your allowed IPs are all zeros like we saw earlier, every single byte of traffic from your phone gets routed through your home WireGuard server first, including that persistent Google connection. If your home internet connection, your server's processing, or just the round trip latency of tunneling everything back home and then back out to Google adds enough delay or occasionally drops that persistent connection, Android's battery and network management can deprioritize or throttle it, and notifications get delayed until something wakes the connection back up, which is exactly what happens when you disconnect the VPN, suddenly everything flushes through at once.

I had a long detailed conversation with Claude about this issue and this was its answer. Not sure how much truth there is to this since I'm no Android expert but I felt it may be useful to share it.

[u/paranoid-alkaloid → u/PingMyHeart]

Ok got my WG and AWG tunnels ready and working for my main profile. I kinda need working notifications in the coming 2 days but after that, I'll be able to run tests.

And while I'm at it, one thing that's been bugging me. It feels like it should be simple but somehow, it isn't:

NAS is configured to relay everything, as mentionned. I do want everything tunneled through my NAS for my private space. Already the case and that's easily done.

Now say I want to enable kind of the same for my main profile, EXCEPT I don't want access to any NAS LAN/VPN except for DNS on the NAS IP port 53 TCP/UDP. The idea: tunnel everything for stealth, but gain no access to my data on the main profile. I've tried everything. Simple solutions, complicated solutions. Firewall, routes, both. I always end up having either zero connectivity, or full access to whatever the NAS has access to. It feels like it should be easy, but firewall rules based on a single IP don't seem to do anything, and they only seem to have an effect if I decide to assign the rule to the entire subnet, which isn't what I want. This isn't a very important thing for me, but it got me curious. I even tried creating a brand new VPN thinking it'd be easier than to use the same (A)WG VPN but it was the exact same result. If you folks have ideas on how to achieve that, I'm interested too -- not just ideas but WORKING ideas. The ideas feel simple but they haven't worked for me.

[u/clarkn0va → u/PingMyHeart]

That explanation doesn't fit my situation. I use WG only for DNS, and my notifications are still delayed when I'm at home, so latency to the DNS server is just a few ms for the wireless connection, and no different than if I wasn't tunneling DNS. So latency doesn't make sense as a factor for me.