First off: this is not a duplicate. I've tried everything except OpenVPN or IPSec. I'm receiving a handshake between the client and server, and SSH and Ping work between clients, but I cannot access the global internet or even have access to the server's public IP. My config is just the usual, keys, endpoints, I followed the Linode guide exactly. My client is openSUSE but my server is ubuntu, which I'm assuming is the chokepoint.

  • 1
    Does ip route show you have a default route
    – waltinator
    Nov 23, 2020 at 16:59
  • waltinator yeah it does show my default route as my router.
    – kektagen
    Nov 24, 2020 at 2:36

2 Answers 2


This is exactly the situation I had. Does your server have a public IP or is it behind a NAT? If it's behind a NAT, the PostUp and PostDown iptables commands from the Linode guide don't apply.

Try adding the following to your server configuration file, changing eth0 to whatever your computer calls it:

PreUp = iptables -t nat -A POSTROUTING -j MASQUERADE -o eth0
PreDown = iptables -t nat -D POSTROUTING -j MASQUERADE -o eth0

Source: https://unix.stackexchange.com/questions/530790/wireguard-not-routing-traffic-from-client-to-other-servers-on-the-network

Example configuration

Here's an example configuration where the router is at (normal network) and 10.0.0.x is the new WireGuard network, with the server being configured for and the client for The port used is 51820 and the default network interface is eth0. All traffic is routed through WireGuard, but it does not stay within the WireGuard subnet. The client has access to the server's local network (10.0.1.x) and the general internet. Don't forget to forward the 51820 port from your router to your server and to enable ipv4 forwarding on the server (# sysctl -w net.ipv4.ip_forward=1)

Server configuration

Address =
ListenPort = 51820
PreUp = iptables --table nat --append POSTROUTING --jump MASQUERADE --out-interface eth0
PreDown = iptables --table nat --delete POSTROUTING --jump MASQUERADE --out-interface eth0

AllowedIPs =

Client configuration

Address =
ListenPort = 51820

AllowedIPs =, ::/0
Endpoint = YOUR.DYNAMIC_DNS.COM:51820
  • I'm having the same (I think) and the above doesn't seem to work. The client connects and gets 296 bytes of data. Then from the client I can ping the wg0 server ip ( in my case) from (the client). But it can't ping the rest of my network nor anything on the internet. Ideas? Feb 6, 2021 at 6:15
  • Did you set DNS, PreUp, and PreDown? And is DNS set to your router's internal IP?
    – Kyle
    Feb 7, 2021 at 14:48
  • I did. And I just solved this. The clients claim that they're connected when they are absolutely not. It was a firewall issue, but there was no indication in the clients (ios, android, Windows nor mac!) that it didn't actually connect. It shows as connected but isn't.) Once I realized what was happening it was a straight forward fix. Feb 7, 2021 at 19:09

Depending on your Cloud provider you might have to change the MTU, Wireguard default MTU is 1420 while Google Cloud MTU is 1460. So if you are using google Cloud set the MTU to 1460 by adding MTU = 1460 to the interface of both clients and server will solve the problem.

You can check my full tutorial on Github if having any trouble.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.