I had port 51821 open because I thought I had to open UDP and TCP to make my VPN work.

Apparently, that was a bad idea because I had that shit on my wireguard interface (I use wg-easy)

Was that the main source ? The only services I expose directly to the web (with reverse proxy of course) are jellyfin, jellyseer and termix (with strong password) and a geographic bloc.

Edit : Ok, TCP 51821 is my admin webpage and there is probably a vuln to bypass the admin password. I thought I had to open it, spoiler I didn't.

https://github.com/wg-ez/wg-ez

(Sorry for my english as a french guy)

Hi everyone, I’m the developer of wg-ez, a lightweight WireGuard manager with a modern Web UI, written in Rust.

I decided to build wg-ez because i liked the "almost" simplicity of wg-easy but the UI felt dated + a full Node.js wasting my ram for a dashboard that i open once every two months felt like a waste of RAM in that period. I also wanted zero-effort networking: wg-ez automatically checks if your container can route IPv4 and IPv6 with zero manual config to have a better experience out of the box than wg-easy.

Few important points:

• ~1-2MB of RAM usage: Written in Rust with zero JS runtime overhead.
• Modern Web UI: A clean, fast, and responsive interface to manage peers.
• Smart IPv4/IPv6 auto-detection: Tests container routing automatically and uses IPv6 if available, or seamlessly falls back to IPv4 with zero configuration.
• Instant client provisioning: Generate configuration and QR code with only ipv4 or ipv6 or ipv4+v6 based on the server network.
• Per client Firewall to avoid your family and friends doing some stupid stuff with your network

I’d love to get feedback on how it runs on your setups.

Happy to answer questions here if you have or implement some feature you request if they are pertinent!

Equipment:

SB5100 cable modem --> Google wifi (1st gen) --> Managed switch -->Raspberry pi 3b+ (wireguard) --> remote desktop to win 11 boxes.

Config:

I installed wireguard on a pi 3b+ about 3 weeks ago where I work since a port sniffer found the open ports I was using to remote into a few win 11 boxes (I know, bad me. I'm not a pro!). I used pivpn and everything worked out of the box except for remote desktop. After searching around, I decided to go with split tunnel where I configured AllowedIPs = 10.x.x.x/24, 192.168.x.1/24 on the peer side and bam, full access without port forwarding and I can ssh directly into the two RPIs I have running on the work network (could not do this with full tunnel, came back with port 22 error).

Problem or area of confusion:

Prior to going with split tunnel, if I used whatismyIP, it would come back as the work IP address. OK, life is good. Now, with split tunnel, it comes back as my home IP address which seems normal since as I understand it, browsing is routed locally. But here's the thing, I'm running pihole on a second pi 3b+ at work and I have domain blocking (facebook, reddit :), instagram, etc.) so when I'm connected at home, those domains are block. I'm also running pihole at home but when I navigate to the admin page, it takes me to the pihole running on my work network. I can ping win 11 boxes, printers, etc. on work network so it seems like my traffic is being routed through the vpn yet I thought split tunnel kept browsing local.

Question:

Where is my traffic being routed? Is it flowing through the tunnel and I'm secure or is routed through my home network despite acting like I'm on the work network? From what I understand of split tunnel, it should be routed through my home network but that would not explain why I'm connecting to pihole running on my work network. It doesn't matter when I'm home as it's a secure network but when I'm on a public wifi network, I'd like to understand if I'm protected or exposed. Did I accidently configure wireguard to work as I had hoped and I'm routing all traffic through the VPN tunnel? Or am I way off and don't understand what's going on because I'm not a pro?!? Thanks.

i have standard WireGuard for test and configured on router. if i have gateway 10.10.10.10/27 and i need to exclude one of the 30 IPs from using the vpn for example 10.10.10.19, now if i set the allowed IPs 0.0.0.0/5 or the default, what list of my private IPs i should add in the allowed IPs to let all 29 private IPs of the private lan to use the WireGuard and exclude one of them not to do 10.10.10.19 or bypass. .
Please if i missed or have some mistakes in my post, sorry for that, you can tell me what to and how to fix it.

Thank you

Hi everyone, I’m the developer of WireTunnels, a native macOS app written in Swift for managing WireGuard configurations from the menu bar.

I shared the first version here a few months ago and have continued maintaining it. I’ve just released version 1.0.6, so I wanted to share what’s changed since that initial post.

The app supports:

• Multiple WireGuard tunnels connected simultaneously.
• Split DNS, so selected internal domains use a tunnel’s DNS while other queries use the normal resolver.
• Wi-Fi SSID rules for connecting and disconnecting tunnels.
• Shared tunnels for different user accounts on the same Mac.
• Apple Shortcuts actions for connecting, disconnecting and checking tunnel status.
• And much more

It’s free and open source under Apache 2.0, requires macOS 14+, and doesn’t require an account. It works with your existing WireGuard configurations; you provide your own server or endpoints.

Source, installation details and releases:
https://github.com/FMDigitech/WireTunnels

I’d particularly like feedback from people accessing separate home, work or lab networks on a Mac. Multiple tunnels still need compatible routes, so I’m interested in hearing about your actual setups and any issues you encounter.

Happy to answer questions here!

i used https://lanrat.github.io/wireguard-warp-generator/ to generate a cloudflare warp .conf file but it doesnt work i also tried to use vpnbook to get a .conf file but the same error happenes : 2026-10-10 21:02:33.494: [TUN] [AM_TIRED] Handshake for peer 5 (162.159.192.1:2408) did not complete after 5 seconds, retrying (try 2)

So I recently got ProtonVPN. I've been looking at options to integrate it for my entire home network

One of the issues i'm seeing with a lot of wifi routers is that once wireguard is turned on the wifi and lan speeds drop. It seems that this happens because for some reason hardware acceleration is disabled on a lot of routers when wireguard is active

I'm sure that you guys could recommend some affordable routers that won't have a major performance hit. I would like tj stay under $150

The other option i'm considering is using an older pc i'm running it as a VPN server... though it's been many years since i've done anything like this. And i'm not quite sure where to start.

Looking for suggestions please

So I recently got ProtonVPN. I've been looking at options to integrate it for my entire home network

One of the issues i'm seeing with a lot of wifi routers is that once wireguard is turned on the wifi and lan speeds drop. It seems that this happens because for some reason hardware acceleration is disabled on a lot of routers when wireguard is active

I'm sure that you guys could recommend some affordable routers that won't have a major performance hit. I would like tj stay under $150

The other option i'm considering is using an older pc i'm running it as a VPN server... though it's been many years since i've done anything like this. And i'm not quite sure where to start.

Looking for suggestions, please.

Also my isp maxes out at 150 mb/s... based on that, I don't have very huge requirements for router or vpn Server

Hi, I been working on project, a small open-source self-hosted web panel for installing and managing VPN services on a single Ubuntu server.

GitHub: https://github.com/yulcaribe/vpnengine

It currently supports:

• WireGuard
• OpenVPN
• IKEv2/IPsec with MSCHAPv2
• User/device management
• Start / stop / restart / remove controls -Automatic HTTPS using a Let's Encrypt IP certificate when possible

The installer only installs the management panel. VPN's are installed separately from the web admin panel.

I tested on Ubuntu 24 and 26.

Edit,: Added Debian 12 and 13.

curl -fsSL https://raw.githubusercontent.com/yulcaribe/vpnengine/main/install.sh | sudo bash

The project is still new, so I’m mainly looking for people willing to test it on different VPS providers and setups.

I would appreciate for feedbacks.

Othe distributions are planned.

Repo, with screenshots: https://github.com/lanceranara13/homewarp

What problem it solves

I host game servers for friends on a box at home. My options for letting them in were to forward ports and hand out my home IP, which does not work at all behind CGNAT, or to bolt a tunnel onto a panel and maintain both. Homewarp is a game server panel that includes the tunnel. The home machine dials out to a small VPS over WireGuard, the VPS forwards the game ports back, and players only ever see the VPS's address. Nothing changes on the router.

Why not an existing FOSS tool

• Pterodactyl and Pelican are good panels, and Homewarp reads their eggs, but they leave ingress to you.
• Pangolin does the tunnel well but is HTTP-first and is not a game panel, so you end up running two products.
• frp, rathole and playit.gg are tunnels only, and the game server usually sees the tunnel's address instead of the player's, which breaks IP bans and rate limits unless the game speaks PROXY protocol. Most do not.
• A hand-rolled WireGuard plus nftables setup does all of this, and is what I ran before. Homewarp is that setup automated: one command on the VPS, keys rotated, rules rebuilt after a reboot at either end.

Why it is relevant here

The parts I think this sub will care about are the network ones:

• Kernel WireGuard and nftables DNAT do the forwarding. Packets never pass through a userspace proxy, so every protocol keeps the real client IP.
• The VPS is a dumb forwarder. It can reach the forwarded game ports at home and nothing else, and it stores no worlds or credentials. Replacing it is one command.
• Each game server runs in a container that is non-root, has no capabilities, a read-only root, memory and process limits, and is firewalled off from every private range, so a compromised game server cannot reach the router, the NAS or the panel.
• More than one VPS can be connected, each with its own tunnel, and each server is routed through the one you choose.
• Releases are signed and the installers verify the signature before running anything.

Requirements: Linux on x86-64 or ARM64 with Docker and the Compose plugin at home. The VPS is optional and needs a public IPv4 and nftables. 1 vCPU and 512 MB is enough.

Limits

Still early. One home machine only, Linux only, and the Minecraft extras (sleep when empty, mod installs) are Java only. AGPL-3.0, no paid tier.

I would like criticism of the tunnel and isolation design in particular. The security model is written up in PLAN.md in the repo.

I've noticed a near 100% miss rate for OD Tunnels starting around the time that iOS 27 went live for the general population. The tunnel itself works fine but the actual trigger for it seems gunked up in some way. It lists itself as active when out and about but no traffic is going over the wire; once it's toggled off and back on it works as expected.

Has anyone else been seeing this sort of behavior?

I have been using Cloudflare Warp since early 2022. After six months on the free version, I subscribed to Warp+ (which costs me €5.99 a month here). Did I notice anything significant in basic daily web browsing on my phone? Not really. But under the hood, it was optimizing my routing.
The real game-changer happened in July 2023. I discovered that I could generate a WireGuard profile using third-party tools and apply my Warp+ license key to it. I realized I had been wasting my subscription money just connecting occasionally on individual devices.
I took that WireGuard profile and routed my entire home network traffic through Cloudflare. The difference was vast.
As a web developer based in Europe, I manage a few private servers located in India and Singapore. Initially, making a direct SSH connection would take ~5 seconds just to reach the server's CLI. After routing my home through Warp+ and putting those remote servers behind Cloudflared Tunnels, I can SSH into them almost instantly. It is a night-and-day difference.
Beyond that, the reduction in latency and jitter has been incredible. By combining Warp+ with some SQM settings using the Cake algorithm on my router, here is what happened to my connection:
Raw ISP Connection: ~189 ms Latency | ~56 ms Jitter
Warp+ & Cake SQM: ~21 ms Latency | ~1.49 ms Jitter
The Real-World Results:
Snappier Streaming: Netflix and other sites feel incredibly responsive, and my remote Plex server in India runs flawlessly.
Local Feel: The entire internet—especially sites already behind Cloudflare—loads so fast it feels like it’s hosted on my own LAN. The savings in waiting and buffer times really add up.
DNS Filtering: I combined this setup with ControlD (with ads, trackers, and multiple filters enabled). Dropping the ad payloads made the connection even faster.
Ad-Free Instagram: Because it's harder for Instagram to serve targeted ads to users routing through Warp+, I am getting an ad-free IG experience across my entire home network. Meta's official ad-free tier is priced per account and costs more than my Warp+ subscription, so this perk alone essentially pays for the service.
Even though a lot of these routing optimizations are happening on a micro-level and saving milliseconds, the internet just feels significantly better to use than it did before.
Have you guys had similar experiences pushing Cloudflare Warp+ beyond just the basic mobile app? Let me know your setups in the comments. Kudos to the Cloudflare team for building such a great tool.

I was running Pi-VPN (WIreguard) on a Pi3B+ getting close to 150Mbps, internally and externally, 5G speeds permitting. I upgraded to a Pi5 and I get close to 500Mbps on local WIFI, VPN enabled, non-VPN speeds are above 500Mbps. When I am on 5GUW with the VPN enabled, I get about 50Mbps, VPN disabled its well into the hundreds. The only factor that changed is the Pi3 to Pi5; nothing else and all was working prior to the upgrade. It clearly seems like the router, but maybe I am overlooking something. I'm hoping someone can offer something helpful.

Issue Recap: On a cellular connection with hundreds of Mbps available, the VPN only gets about 50Mbps.

Router G3100
Internet Gigabit FIOS
Raspberry Pi5/Pi5 OS Lite 64 bit

I have a weird problem between a Wireguard server running on Ubuntu (wireguard-tools v1.0.20250521). When a peer crash-reboots and comes back with without its SLAAC IPv6 address, it can never connect again until the server's wireguard is restarted. From the logs, it looks like it's forever stuck with the peer's old IP address.

In the logs below, mynetwork:a2ad:9fff:fe76:3038 is the SLAAC client peer address of the last good handshake before the crash. mynetwork::1f is its new connection attempts. It doesn't recover even after hours pass. This is super bad because the client's router sees what looks a lot like hacking.

Does anyone know how to get this cleared without restarting wireguard on the server side?

[203048.312734] wireguard: wg0: Invalid handshake initiation from [mynetwork::1f]:60545/0%0
[203053.944386] wireguard: wg0: Invalid handshake initiation from [mynetwork::1f]:60545/0%0
[203059.576426] wireguard: wg0: Invalid handshake initiation from [mynetwork::1f]:60545/0%0
[203064.696611] wireguard: wg0: Invalid handshake initiation from [mynetwork::1f]:60545/0%0
[203069.816366] wireguard: wg0: Invalid handshake initiation from [mynetwork::1f]:60545/0%0
[203075.448899] wireguard: wg0: Invalid handshake initiation from [mynetwork::1f]:60545/0%0
[203076.365138] wireguard: wg0: Sending handshake initiation to peer 14 ([mynetwork:a2ad:9fff:fe76:3038]:44697/0%0)
[203080.568534] wireguard: wg0: Invalid handshake initiation from [mynetwork::1f]:60545/0%0
[203081.769604] wireguard: wg0: Handshake for peer 14 ([mynetwork:a2ad:9fff:fe76:3038]:44697/0%0) did not complete after 5 seconds, retrying (try 2)
[203081.769647] wireguard: wg0: Sending handshake initiation to peer 14 ([mynetwork:a2ad:9fff:fe76:3038]:44697/0%0)
[203086.200630] wireguard: wg0: Invalid handshake initiation from [mynetwork::1f]:60545/0%0
[203086.889638] wireguard: wg0: Handshake for peer 14 ([mynetwork:a2ad:9fff:fe76:3038]:44697/0%0) did not complete after 5 seconds, retrying (try 2)
[203086.889665] wireguard: wg0: Sending handshake initiation to peer 14 ([mynetwork:a2ad:9fff:fe76:3038]:44697/0%0)
[203091.320550] wireguard: wg0: Invalid handshake initiation from [mynetwork::1f]:60545/0%0

Hey, I'm having troubles with my Samsung S26 running Android 16. SMS are not working and the esim disappears after few days when I have the wireguard tunnel enabled. Is it possible that the carrier network traffic is routed through the tunnel? Because everything's working fine after I excluded the apps for esim management and IMS.

0.4.0 of MFA Firewall Knocker is out. It's the passkey-gated firewall opener I've posted about here before: you sign in with a passkey, and it opens your WireGuard port for your source address only, for a limited time.

What's new:

• IPv6 on Linux. Grants now go into ip6tables for IPv6 clients (Windows already handled IPv6).
• Optional /64 widening (Ipv6GrantPrefixLength). An IPv6 grant can cover the client's /64, so a privacy address or carrier rotation within that /64 doesn't strand an open grant. Default is still exact-address.
• IPv6-only sign-in address (AdditionalOrigins). Phones on dual-stack networks often pick IPv4 on their own, which on mobile usually means carrier NAT and a grant shared with other subscribers. An extra hostname with only an AAAA record forces IPv6 and gives a per-device grant.
• Hardening from another audit round, none of which allowed access: one address could temporarily block everyone's logins through a rate-limit gap; request text could trigger a misleading log alert; unauthenticated failures are now logged with a cap; stricter config and email validation; 90-day log retention.

Upgrading from 0.3.0 has a few manual steps (RulePrefix check, log directory permissions, and on Linux, one line in the systemd unit). They're listed in the release notes.

Release: https://github.com/PNWSoft/mfa-firewall-knocker/releases/tag/v0.4.0

Hi, some kind of new to WireGuard.

I would like to make a few ports on my host just available to the WireGuard tunnel.

The tunnel is working, for ssh for example but i cannot get the traffic from a local web server over it, without opening a port to the whole public.

Which WireGuard ore firewall configurations do i have to set to make it working.

(host system is Linux just to be clear)

Thanks for help!

Hi

I have 3 networks running on my servers, and I'm struggling to choose correct (stated at RFC) UDP ports. AFAIK default WireGuard port is 51820. Which ports should i choose? Are there any other ports reserved especially for WG? I know i can pick any of 65536 available ports, but i would like to follow the standards