Wireguard VPN on GOS device stopped working

rndmE

Hi,

I use several wireguard connections to stay connected to my home network from anywhere over the internet to use protection through my Pihole.

I migrated to the AVM Fritz!Box (my router) as the Wireguard endpoint since it is implemented I guess more than a year ago and it worked perfectly fine so far.
The Wireguard app is up to date.

I have two connections on my Pixel 7 with the latest GOS:
One in my default profile and a second one in my private space where all traffic is forced to connect only through the VPN connection.

Both connections stopped working today.
In both cases, my router as well as the wireguard app say that the connections are established successfully.
The app does display incoming and outgoing traffic. Of course not much because no connections to anywhere become established but there is traffic in general.
I can see arrive the DNS queries in my pihole when the GOS device with activated VPN tries to connect to anything over the IP that the VPN uses.
Since the configuration of a new connection is done in seconds via the Fritz!Box GUI, I have recreated both, but the problem remained identical.

I also tested two other Wireguard connections: One on an iPad, another one on a notebook running Manjaro. Both do work fine, as they ever did.
Even if I connect my iPad with the hotspot of my GOS Pixel and connect the iPad wireguard VPN, it does work.
Not very surprising, but an additional test I've made just because this is a scenario that happens from time to time.

One additional hint:
A few weeks ago, the Wireguard VPNs on my GOS device did also stop working for a very short time. I couldn't figure out where it struggled and as it began to work again, I didn't investigate any further but the behaviour was exactly like i described it above.

Does anyone know how I could troubleshoot from this point?
Is there anything like this known as a currenct issue?
I'm pretty stuck in my troubleshooting right now as I'm not even sure where to look next.

Thanks in advance for everyone who made it through my wall of text.

n3t_admin

rndmE first thing I would try, is to install WGTunnel or RethinkDNS as alternatives for the (mostly deprecated) WireGuard app. Check if the issue persists. With the same config in any of the apps I mentioned. If you are using a domain, make sure that the GOS device resolves properly. Sometimes (with dynamic IPs/dynamic DNS providers) the DNS cache gets stuck for a while. I am assuming here, but from your description it sounds like you are using a residential IP, which is dynamic in most cases.
But really, step 1 is to try a different app and go from there.

argante

rndmE Try: Wireguard -> App Info -> Memory tagging and set this as Disabled.

rndmE

Thank you guys a lot for your replies.

When I read your reply, @argante, I did already follow the first answers ideas so I can't tell if that would have changed anything.

I read @n3t_admin 's reply right after you wrote it and experimented with WG Tunnel.
Thanks for that recommendation first, I didn't know that app.
Finally no more manual VPN (de-)activation when I leave or come back to my local network.

Well - I think I had something like a ghost in the engine room for several hours.
Both apps (main profile and secure space) started to work if I tested in wifi immediately.
A bit of time later, my private space also started working over internet, for my main profile the WG Tunnel apps log showed that it tried to resolve the hostname of my Wireguard endpoint from my local Pihole and couldn't resolve it.
What?! No need to say that every other client (and even my private space) worked like a charm and the hostname was of course resolvable manually locally and on internet dns servers.
I'm not really sure when this dns query gets sent - how can it even relate to a local wifi's dns server anymore? This sounds very wrong and leaves me curious how it should work at all.
In addition, the private space's connection didn't initially work even if it resolved the hostname correctly right from the start.
Anyhow, after trying all kinds of stuff and configurations inside the WG Tunnel app, all problems disappeared and everything works perfectly fine since then. Just in a period of time where I didn't change any configurations.

A hint for anyone who might face a similar curious problem like I did: Change the language of the WG Tunnel to english - my native language brought me into a couple of missunderstandings or at least uncertainties if this or that checkbox does exactly what the translated headline tells me it does.

I'm partly pretty unsatisfied with it now: Of course I solved the technical issue but I still don't really know how. Like I said - a ghost in the engine room. And I also don't know what cause my initial problems and the ones I had weeks ago, especially because I didn't install any updates or patches previously.

Hope this might help anyone who faces problems like this in the future.

n3t_admin

rndmE one thing to note, is that the toggle "Block connections without VPN" will also apply to DNS requests. So if your DNS isn't resolving the hostname your VPN is trying to connect to, it might get stuck in limbo. I know from experience that connections to VPNs can be spotty sometimes. I had entire episodes where my VPN wouldn't connect inside of my private space, although every other profile was working. I never dug deeper, but I assume since every profile has their own (DNS) resolver, the hostname for the private space wasn't resolving properly and my connection would just never establish. So while yes, it is unsatisfactory, it also isn't really worth wasting your time to troubleshoot the issue when it's gone. Only if you encounter it on a regular basis, is it worth investigating.

rndmE

Interesting that you also had problems like that.

What really confuses still me is:
In my case it wasn't the private space's VPN (where I block everything except traffic over VPN), it was the one from the main profile (where I don't block non-VPN-traffic).
Why does my main profile WG Tunnel app try to resolve over my local Pihole?
I mean... I activated the autotunneling feature which means it tries to establish the VPN AS A REACTION to my manual turn off of the wifi which means that the phone is already only connected to the mobile network.
Obviously, there is no way this could ever work.
And: Why does the app from my private space behave like it should (at least that's what I believe because it built the VPN connection right in that moment where the main profile VPN got stuck)?

Yesterday, the connection establishment did struggle again; The log (main profile) said that messages to establish the VPN are sent but no answers were received. This means to me: The DNS resolution must have been already successful. That's weird and I can't imagine why that should happen, but after a couple of minutes sitting in my parked car and reading logs and stuff I activated the private space which instantly connected its VPN properly.
In that moment, the main profile VPN display a successful handshake as well and the connection worked.

I will observe this for the next days and pray...