Wireguard: No handshake, no traffic from devices.

[leonidas4n6]

Hi team!

I test it all... but still stucked with no connection on my devices.

1º Installed pivpn (wireguard) on Raspbian
Raspy on 192.168.0.10 (static IP), on wlan0 interface , with duckdns domain xxxxxxxxxxxx.duckdns.org, with Google DNS.

/etc/wireguard/wg0.conf

[Interface]
PrivateKey = XXXXXXXXXXXXXXXXXXXXXX
Address = 10.154.172.1/24
MTU = 1420
ListenPort = 51820
### begin ClientPhone ###
[Peer]
PublicKey = XXXXXXXXXXXXXXXXXXXXXX
PresharedKey = XXXXXXXXXXXXXXXXXXXXXX
AllowedIPs = 10.154.172.2/32
### end ClientPhone ###
### begin ClientPC ###
[Peer]
PublicKey = XXXXXXXXXXXXXXXXXXXXXX
PresharedKey = XXXXXXXXXXXXXXXXXXXXXX
AllowedIPs = 10.154.172.3/32
### end ClientPC ###

2º O2 Router :
Added TCP/UDP 51820 forward port

3º Iptables -L :

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     udp  --  anywhere             anywhere             udp dpt:51820 /* wireguard-input-rule */

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             10.154.172.0/24      ctstate RELATED,ESTABLISHED /* wireguard-forward-rule */
ACCEPT     all  --  10.154.172.0/24      anywhere             /* wireguard-forward-rule */

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain f2b-vsftpd (0 references)
target     prot opt source               destination

4º pivn -d

root@raspberrypi:/home/XXXXX# pivpn -d
::: Generating Debug Output
::::            PiVPN debug              ::::
=============================================
::::            Latest commit            ::::
Branch: master
Commit: ececd4ed96b7e16493655131ae734b479aadd117
Author: 4s3ti
Date: Sat Apr 13 16:00:00 2024 +0200
Summary: build: Add automated release actions
=============================================
::::        Installation settings        ::::
PLAT=Raspbian
OSCN=bullseye
USING_UFW=0
pivpnforceipv6route=1
IPv4dev=wlan0
IPv4addr=192.168.1.10/24
IPv4gw=192.168.1.1
install_user=XXXXXX
install_home=/home/XXXXXX
VPN=wireguard
pivpnPORT=51820
pivpnDNS1=8.8.8.8
pivpnDNS2=8.8.4.4
pivpnHOST=REDACTED
INPUT_CHAIN_EDITED=1
FORWARD_CHAIN_EDITED=1
INPUT_CHAIN_EDITEDv6=
FORWARD_CHAIN_EDITEDv6=
pivpnPROTO=udp
pivpnMTU=1420
pivpnDEV=wg0
pivpnNET=10.154.172.0
subnetClass=24
pivpnenableipv6=0
ALLOWED_IPS="0.0.0.0/0, ::0/0"
UNATTUPG=1
INSTALLED_PACKAGES=(wireguard-tools)
=============================================
::::  Server configuration shown below   ::::
[Interface]
PrivateKey = server_priv
Address = 10.154.172.1/24
MTU = 1420
ListenPort = 51820
### begin ClientPhone ###
[Peer]
PublicKey = ClientPhone_pub
PresharedKey = ClientPhone_psk
AllowedIPs = 10.154.172.2/32
### end ClientPhone ###
### begin ClientPC ###
[Peer]
PublicKey = ClientPC_pub
PresharedKey = ClientPC_psk
AllowedIPs = 10.154.172.3/32
### end ClientPC ###
=============================================
::::  Client configuration shown below   ::::
[Interface]
PrivateKey = ClientPhone_priv
Address = 10.154.172.2/24
DNS = 8.8.8.8, 8.8.4.4

[Peer]
PublicKey = server_pub
PresharedKey = ClientPhone_psk
Endpoint = REDACTED:51820
AllowedIPs = 0.0.0.0/0, ::0/0
=============================================
::::    Recursive list of files in       ::::
::::    /etc/wireguard shown below       ::::
/etc/wireguard:
configs
keys
postdown.sh
postup.sh
wg0.conf

/etc/wireguard/configs:
clients.txt
ClientPhone.conf
ClientPC.conf

/etc/wireguard/keys:
ClientPhone_priv
ClientPhone_psk
ClientPhone_pub
ClientPC_priv
ClientPC_psk
ClientPC_pub
server_priv
server_pub
=============================================
::::            Self check               ::::
:: [OK] IP forwarding is enabled
:: [OK] Iptables MASQUERADE rule set
:: [OK] Iptables INPUT rule set
:: [OK] Iptables FORWARD rule set
:: [OK] WireGuard is running
:: [OK] WireGuard is enabled
(it will automatically start on reboot)
:: [OK] WireGuard is listening on port 51820/udp
=============================================
:::: Having trouble connecting? Take a look at the FAQ:
:::: https://docs.pivpn.io/faq
=============================================
:::: WARNING: This script should have automatically masked sensitive       ::::
:::: information, however, still make sure that PrivateKey, PublicKey      ::::
:::: and PresharedKey are masked before reporting an issue. An example key ::::
:::: that you should NOT see in this log looks like this:                  ::::
:::: YIAoJVsdIeyvXfGGDDadHh6AxsMRymZTnnzZoAb9cxRe                          ::::
=============================================
::::            Debug complete           ::::
:::
::: Debug output completed above.
::: Copy saved to /tmp/debug.log
:::

5º Tested TCP dump on wlan 0 --> 0 bytes
6º Ping from Raspy to Internet --> normal traffic.
7º I even purged + installed again Wireguard + flush Iptables + add rules suggested by "pivpn -d"
8º Created new keys...

Getting the following error on my PC:
2024-04-15 17:02:46.032: [TUN] [ClientPC] Handshake for peer 1 (X.X.X.X:51820) did not complete after 5 seconds, retrying (try 2)

Run out of ideas..

Really appreciated any help 🙏 .

[orazioedoardo]

Try the troubleshooting steps: https://docs.pivpn.io/faq/#how-do-i-troubleshoot-connection-issues. Is 192.168.1.1 your only router connected? Do you know whether you are under CG-NAT?

[leonidas4n6]

[orazioedoardo]

So, assuming you still have port forwarding to TCP port 51820 (please verify this before continuing), on your raspberry pi, get the public IP as you saw with curl -s https://checkip.amazonaws.com, then run sudo tcpdump -n -i wlan0 port 51820. While the terminal is blocked, on a different device on a different network like cellular, try to visit on a browser https://public_ip_from_the_curl_command:51820. See any output in the terminal?

[leonidas4n6]

Portforwarding

curl -s https://checkip.amazonaws.com (already did when folloing troubleshooting guide)
output: checked and it's correct.

sudo tcpdump -n -i wlan0 port 51820
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on wlan0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
12:21:23.970938 IP X.X.X.96.30373(public IP of my smartphone > 192.168.1.10.51820: Flags [S], seq 1972929986, win 65535, options [mss 1400,nop,wscale 6,nop,nop,TS val 1776678902 ecr 0,sackOK,eol], length 0
12:21:23.971104 IP 192.168.1.10.51820 > X.X.X.96.30373(public IP of my smartphone: Flags [R.], seq 0, ack 1972929987, win 0, length 0

[leonidas4n6]

Solved:

Compared my Raspb IP and DuckDNS domain associated IP, and that was the problem. Once Updated, all works smoothly.

Thank you so much for your help! I hope this post helps someone else.!