wireguard stopped working

tam

I have had wireguard installed (via F-Droid) and working on my Pixel 5a since I got it. I don't use it often, but when I do, it's usually via ssh/rsync running under termux. On 21 September 2023, I was able to use the wireguard/termux/ssh/rsync combination to do what I wanted. Today, I am not. I have not changed the configuration---either on the phone, the network it's connected to, or the wireguard VPN server---for literally years. Running wg on the wireguard server reports no handshake with the wireguard client on the phone; running tcpdump on the wireguard server reports no packets received to the wireguard port from the phone; tcpdump does report packets from the phone that aren't associated with wireguard (I have "send everything through the VPN" disabled); other wireguard clients on the same network are working just fine.

I would appreciate any guidance on how to debug this. Thanks!

lcalamar

tam I'm running GOS on my 8p. No issues with Wireguard - but i did update the app.

de0u

I am not at all an expert, so all I can provide is a random suggestion... if your phone updated to Android 14, and your WireGuard client hasn't also been updated, that could be a problem. Or maybe they don't have an A14 version yet -- some apps don't.

RazorSix

Using Pixel 4 XL w/ Android 13 GOP

Wireguard stopped working some days ago.

It shows the VPN-key symbol in the infobar, but is not connected to my (personal) VPN node. The internet connection is working still and silently, which is quite dangerous, as you're not aware of the not working VPN. There are no error notifications. WG app's log tells about "Sending handshake initiation" over and over again, mixed with some successful keep alive packets both ways.

I updated the app, as it was stalled at an older version. F-droid seems to have dropped the app, so no updates with that signing key anymore. I had to uninstall it and reinstall from the wireguard.com website using their APK-file. Version is now v1.0.20231018, userspace backend 2163620.

Same observations. It's a real show stopper for me.

Other devices (Laptop, 4G-router) do work without issues with the same VPN node.
I can use two mobile networks with that device, both fail the same way.
Using wifi fails as well.

I'll try another phone with the same SIM card and same WG setup tonight.
I expect that to be a success.

other8026

RazorSix I had a (maybe) similar issue a long time ago. I ended up messing up my VPN connection somehow, and the only way I could fix it was by doing the following:

remove the app
remove the VPN in Settings > Network & internet > VPN
(since the issue was in the Owner profile) reset network settings in Settings > System > Reset options

After doing all that, I set up the VPN again and it worked fine. I don't know what happened or why, but it seemed like the OS no longer associated the VPN app I was using with the VPN in Settings.

DeletedUser115

RazorSix The internet connection is working still and silently, which is quite dangerous, as you're not aware of the not working VPN

Do you have "Block connections without VPN" toggle on?

rufus

Wireguard v1.0.20231018 working on a Pixel7a without any problems since it was installed on 12.8.2023
I do get updates through droid-ify (IzzyOnDroid F-Droid Repo)

RazorSix

rufus I do get updates through droid-ify (IzzyOnDroid F-Droid Repo)

Hm, I'm unsure about using a random F-Droid repo. Wireguard can be downloaded as an APK from the founding project website, so that's the best source I bet. I'm not telling, that IzzyOnDroid's repo is not trustworthy, but I'm somewhat reluctant adding new APK sources. ;-)

Thanks for the hint anyways, I'll look into that!

RazorSix

I haven't tried another phone yet, but I have an idea, what the root problem might be (in parts at least). Powermanagement. Right now things work, as I can access my routed home network through VPN. Yesterday, when the device was below 10% battery, I had the aforementioned issues. Maybe the network stack goes nuts, when the device is going below a certain battery level.

From now on I'll keep an eye on the battery level in relation to the issues I have.

But "whatsmyip.com" is still telling me my mobile providers IP, not the VPN endpoint one. So default route for non-endpoint traffic is not "fully" set by "allowed ips 0.0.0.0/0 ::/0" directive. For some reason I can still reach my 192.168.x.x network at home through VPN.

Using Termux/TermOne Plus to gather more information is no help, as we have no access to anything.

DeletedUser115 Both settings are active, the "permanent VPN" one and the "blocking connections w/o VPN" one.

other8026 I'll try that!

Thank you guys, for the suggestions so far!

For now I cannot trust the VPN symbol, that angers me the most. That should be fixed by additional "quality control" routines, which is out of GOS's scope I guess.

RazorSix

@other8026 On removing the app, the entry in VPN disappears on its own. I've reset the network settings. My issue with still having direct internet access is still there... BUT

Whatsmyip using the business profile Vanadium shows the mobile providers IP.
Whatsmyip using the non-business profile Vanadium shows the VPN endpoint IP.
Wireguard is installed using the non-business profile.

OMG, all my business apps are bypassing the VPN setup? Is that by design?
So we actually have two network stacks here!?

Now things make sense at a point, but this is awkward. Do we have to install Wireguard on both profiles actually utilizing two tunnels to cover both profiles apps?

Do GOS users know about that?

I didn't.

other8026

RazorSix So we actually have two network stacks here!?

I don't use a work profile, so I don't actually know, but it would make sense since they're different "users" on the phone and that's also how secondary user profiles work.

It would make sense because some companies protect their internal network from the internet, so the only way to use some internal services is by using a VPN. If a company has a BYOD thing going on, then it would make sense that employees can have apps for personal use go through a VPN of their choosing or none at all, while work-related things go through the work VPN.

RazorSix

other8026

I don't use a work profile, so I don't actually know, but it would make sense since they're different "users" on the phone and that's also how secondary user profiles work.

Not necessarily regarding the network stack, but it makes sense indeed, if that kind of complete independence was in mind.

It would make sense because some companies protect their internal network from the internet, so the only way to use some internal services is by using a VPN. If a company has a BYOD thing going on, then it would make sense that employees can have apps for personal use go through a VPN of their choosing or none at all, while work-related things go through the work VPN.

Yes, I agree now, when thinking about it. But it came never to my mind to check, that the other apps are not covered by the VPN we have a proper sign in the status bar for. Lesson learned, so the single VPN sign alone doesn't distinguish between those two profiles and we don't know which sides VPN (or both) is active.

I use the business profile for closed source apps, keeping them away from my personal data. Nevertheless I like them to use the Wireguard VPN as well.
I'll try to do a second VPN setup on the other profile, we'll see how that looks like...

RazorSix

RazorSix I'll try to do a second VPN setup on the other profile, we'll see how that looks like...

A VPN profile at the 'work' side works as intended. Unfortunately there's no extra key symbol nor a control option via tile menu.

rufus

RazorSix Hm, I'm unsure about using a random F-Droid repo.

probably you are right and it is better not doing things like this.
maybe one day optainium is not beta anymore and includes all the apps we want.