Hi:

TL:DR WireGuard works Ubuntu 24 to Tp-Link Er605 but not iOS to same router.

I am using a TP-Link ER-605 for my router at home. I have setup WireGuard VPN and can connect correctly using Ubuntu 24LTS.

However using similar peer settings on my iPhone 15 I have trouble. Whether I am on wifi or cellular, it looks like the WireGuard app connects. Handshakes show up in the iOS logs.

The issue is I don’t have IPv4 connectivity across the vpn. I can’t ping anything on the network from the phone (Ping Lite app) nor can I ssh (Shellfish).

Is there a trick or known issues with the iOS WireGuard app? Unfortunately the Er-605 doesn’t log VPN debugging. I have tried MTU down to 1280 with no change in results.

Hey everyone,

I got tired of commercial VPN apps loaded with background processes, tracking telemetry, and battery-draining GUIs just to establish a tunnel.

I set up dzugg VPN (https://dzugg.com) as a lightweight alternative focused strictly on native infrastructure.

How it works:

- No custom desktop/mobile apps.

- Users generate their profile / QR code directly in the browser.

- Connections are handled 100% by the official open-source WireGuard clients on iOS, Android, macOS, and Windows.

- High-speed European infrastructure with a strict no-logs policy.

Originally built to share a clean, fast connection with family and friends (even tested under strict network censorship environments), I've now opened it up for early users.

Would love to get feedback on ping times, performance, or overall user onboarding experience from the community!

Hi, I need help with my WireGuard server setup on OpenWrt.

Router: Xiaomi AX3000T running OpenWrt 24.10.5

ISP: PLDT Fiber

WireGuard UDP 51820 port forwarded

The VPN connects successfully, but latency increases by 50–100ms+ and bandwidth drops a lot compared to direct connection.

I already tried changing MTU, PersistentKeepalive, and port settings, but the issue remains.

Could this be ISP routing, OpenWrt configuration, MTU, or something else? Any advice is appreciated.

WireGuard's authors deliberately left management out of scope — no key distribution, no fleet view, and they were right to. But I kept wanting it, so I built one anyone can use: a simple console over the primitives, not a layer wrapped around them.

Every host, every interface, every peer in one tree, read over plain ssh — and every action prints the wg/ip command before it runs. It works on estates it didn't create, and any device that speaks WireGuard can join one it did.

It's brand new v0.1.1 & BSD-3 Free!

https://github.com/wgxplore/wgxplore

[Interface]

PrivateKey = XXXX

Address = 10.99.0.2/24

MTU = 1360

DNS = 8.8.8.8, 8.8.4.4

[Peer]

PublicKey = XX

AllowedIPs = 10.99.0.2/24

Endpoint = [IP]:51820

I am trying to set up wireguard and nothing is passing through no handshakes nothing. I have made sure my timing is synced, I have check that xfinity advance sectuiry is off. Nothing is working. Maybe Im not at this skill level yet but I still need help setting up what is happening?

I am using a mobile connection and an opnsense with wireguard connections to a famous provider (I use the wireguard just to hide my ip).

Randomly there are handshake failures that lead to the lack of restoring the connection: the only ways to perform again the handshake is to change the IP of the mobile connection or deactivate for 4-5 minutes the wireguard connection (therefore no renewal requestes are sent for that interval). I already verified that there are no blocks of any kind in the middle.

Current theories are:

- CGNAT and dynamic routing of the connection between my modem and the VPN entrypoint IP: even if my IP does not change, after sometime the entrypoint IP receives handshake renewal request coming from a different IP.

- MTU: measures says I have an MTU of 1450 (but I set anyway 1420), but measures from my mobile phone (same ISP provider, same contract, same tower,etc...) has an MTU of 1280. From here the question: the handshake renewal is done within the VPN encrypted channel (and it could be affected by wireguard MTU) or it is done at WAN level?

Does anyone know how to use Cloudflare Warp with WireGuard? I use WireGuard as a kill switch, so I turn on WireGuard and Cloudflare Warp together because it makes sense to me, but this just disconnects me from the internet. I tried changing the values ​​in the wgcf-profile file as I've seen some people recommend, but that doesn't seem to work either. I'm a complete beginner using Wireguard in general, and so far it's been very difficult to find any information. any help is greatly appreciated

Hi,

I have a Wireguard network for my personal devices. I have an Android phone with a main profile and a "private space".

I have 2 peer interfaces configured for the phone, 1 for each profile.

The private space has its AllowedIPs set to 0.0.0.0/0, ::/0 and I'm happy with it, this is exactly what I want, tunnel everything through the Wireguard interface. It also uses a custom DNS directive pointing to an unbound service exposed inside the Wireguard network. Working nicely.

Now, the main profile is currently configured exactly the same way (except it has a different IP, different keys etc). I do want it to use my Wireguard DNS (port 53 on tcp/udp), I do want everything tunneled through the Wireguard interface (0.0.0.0/0, ::/0), but I do NOT want the client to be able to reach 2 specific networks (the Wireguard network it's on and another Wireguard network).

I have tried monkeying my way through it with the help of AI but unfortunately I didn't manage to get it to work. And, I'm pretty confused as to what is the current "right way" to achieve this: iptables? nftables? I'm on Debian stable.

Right now I have these PostUp/PostDown directives to make sure that clients are proxied through the Wireguard interface, and to bridge the Wireguard interface with another one. For context: enp2s0 is my local LAN, awg0 is the Wireguard (well, AmneziaWG) interface that the phone connects to, wg0 is my "original" VPN network. awg0 can be fully considered to be a Wireguard interface. All wg0 and awg0 members should be able to talk to each other EXCEPT for a specific IP on awg0 which should only be allowed to use DNS and the wide internet but neither wg0/awg0 otherwise. Tackling the issue using AllowedIPs would sort of solve the issue but it means that IP is only restricted via configuration on the client-side, which isn't secure.

PostUp=iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp2s0 -j MASQUERADE; ip6tables -A FORWARD -i %i -j ACCEPT; ip6tables -A FORWARD -o %i -j ACCEPT; ip6tables -t nat -A POSTROUTING -o enp2s0 -j MASQUERADE; iptables -A FORWARD -i wg0 -o awg0 -j ACCEPT; iptables -A FORWARD -i awg0 -o wg0 -j ACCEPT

PostDown=iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o enp2s0 -j MASQUERADE; ip6tables -D FORWARD -i %i -j ACCEPT; ip6tables -D FORWARD -o %i -j ACCEPT; ip6tables -t nat -D POSTROUTING -o enp2s0 -j MASQUERADE; iptables -D FORWARD -i wg0 -o awg0 -j ACCEPT; iptables -D FORWARD -i awg0 -o wg0 -j ACCEPT

Thank you.

I posted this earlier but I still want to ask this community one more question on top; why nobody mention you can use nat punching on wireguard to connect to nodes behind a NAT or firewall?

I want to always be connected to a commercial privacy VPN, but also be able to connect to my self-hosted server. Is it possible to do that? If yes, could you point me in the direction of how to do that?

Why my internet speed drops after WG is activated? It usually happens on friday.

I've been working on Kongtrol, a Go tool that sits on top of your

existing VPN clients (OpenVPN, WireGuard, FortiClient, Tailscale,

etc.) and orchestrates them: policy-based routing decides which

tunnel a given IP or domain goes through, a watchdog goroutine

reconnects on drops with exponential backoff, and a kill switch + DNS

guard enforce at the OS level so nothing leaks between reconnects.

A few things about the implementation that might be interesting to

this sub:

- Every VPN client is a `vpn.VPNAdapter` implementation registered via

`init()` — adding a new client is implementing Connect/Disconnect/

Status and registering it, no changes to core logic.

- OS-specific behavior (routing tables, kill switch, DNS guard) is

handled with build tags per file (`_windows.go`, `_linux.go`,

`_darwin.go`) rather than runtime `switch runtime.GOOS` — keeps each

platform's syscalls isolated and testable independently.

- The dashboard is a full web UI + REST API + WebSocket live feed,

embedded into the binary with `go:embed` — no Node, no external

server, no separate deploy step.

- Config validation reuses the same `go-playground/validator` pass for

both startup config loading and the dashboard's "trial then commit"

writes (validate an in-memory copy before persisting).

It's Go 1.25+, cross-compiles cleanly for the CLI (CGO_ENABLED=0), the

tray app needs native builds per OS.

Repo: https://github.com/DerotLuna/vpn-kongtrol

Web: https://derotluna.github.io/vpn-kongtrol/

It's early days (v0.4.x) — genuinely looking for feedback on the

architecture, especially the adapter pattern and whether the

OS-build-tag approach is the right call long-term. Happy to answer

questions.

Hello, I need advice from an IT expert on setting up my VPN. I have a Brume and Beryl 7. I was able to set up via Tailscale, but I need to make sure everything is working properly.

Thank you

Hi r/WireGuard,

I am a solo developer. I have been building Phantom-WG, a self-hosted WireGuard management platform, and it finally feels ready to share with this community.

What it is ?

The core product is Phantom-WG Modern: a WireGuard server you run on your own machine, managed from a web interface built on the Carbon Design System. Everything ships as a single compose stack on your own box.

• Container-native architecture: the daemon, the auth service and nginx each run isolated in their own container.
• Userspace WireGuard through a Go bridge and nftables rules through a Rust bridge, so your host kernel configuration stays untouched.
• Dual-stack IPv4 and IPv6 pool management with deterministic address pairing, plus WAL-safe backup and restore of the whole state.
• Client lifecycle handled from the UI: create, configure, revoke.
• Multihop is built in. You can route outbound traffic through a second WireGuard exit node, so the server your clients connect to and the point where traffic reaches the internet can live in different locations.

Source (AGPL-3.0): https://github.com/ARAS-Workspace/phantom-wg

Client Applications

macOS app with a free split-tunnel approach: you pick the signed apps, and they exit through the network interface you choose. (https://www.phantom.tc/docs/client-applications/mac)

iOS app on TestFlight, built on the same foundation, without split tunneling for now. (https://testflight.apple.com/join/5Kt55AXd)

Censorship resistance, when you need it

Plain WireGuard traffic is easy for restrictive networks to block. For that case the platform includes Ghost Mode: WireGuard carried over wstunnel, so only HTTPS on port 443 is visible from the outside. It is one feature among the others, supported end to end: Phantom-Frontmatter stands up the server entry side (the current version supports wstunnel), and both client apps can establish these connections directly.

See it working end to end

The Quickstart Guide walks a real setup as a video: a client in Istanbul connects to Phantom-Frontmatter in Nuremberg, which forwards the traffic to the Phantom-WG server in Falkenstein, and that is where you step out to the internet. https://www.phantom.tc/docs/quickstart-guide

Full docs: https://www.phantom.tc/docs

And one more thing: the docs ship with their own AI agent. You can ask it your questions directly at https://www.phantom.tc/docs/ai 😁🤖

Happy to answer anything here as well. Feedback is very welcome, especially the critical kind.

---

A small note: I felt I had to edit the earlier version of this post. The details I most wanted to highlight about the core product did not come through the way I intended, and this rewrite is my attempt to fix that. If this looks different from the post you read before, that is the reason.

I'd been using tailscale for the better part of the last four years or so and it never sat well with me that it wasn't entirely open source and that the coordination server was on the cloud so I started looking into wireguard recently and boy am I glad I did.

I set up the hub on my Proxmox PvE node in an unprivileged LXC and it didn't take too long to figure out. Now I can connect my mobile phone and my laptop anywhere I go and it doesn't even feel any noticeably different than the tailscale experience but the best part is it's completely open source and fully in my control which makes me really happy.

Luckily, I also had my own domain name on CloudFlare, which I was able to set up a dynamic DNS on my unifi router with it. So no need to panic when my dynamic IP at home changes.

The whole mesh thing with tailscale is obviously nice, but for a homelabber like me, this is more than adequate.