Login or Register
FULL AI ANALYSIS

WireGuard peer connects but cannot reach devices on remote LAN — TCP timeouts while ICMP sometimes passes

Generated Oct 3, 2026, 12:35:03 AM

Analysis summary

The packets from a remote client reach the WireGuard server and are forwarded toward the destination LAN, but return traffic from the LAN hosts is not being routed back to the original client IP because the LAN's gateway or the VPS lacks a route for the client's virtual subnet, or the return packets are sent to the server's public IP and blocked by stateful firewalls or reverse-path filtering. When NAT (MASQUERADE/SNAT) is applied on the server, return traffic gets translated to the server address and flows back, indicating lack of symmetric routing or missing route on the LAN side is the issue.

Possible causes

Home gateway lacks route for the client's WireGuard subnet and sends replies to the wrong next-hop.

95%

Missing SNAT/MASQUERADE on WireGuard server, so remote LAN hosts send responses to the server public IP but firewall/NAT rules drop them.

85%

Reverse path filtering (rp_filter) or strict firewall rules on home gateway or VPS dropping asymmetric return packets.

40%

NAT or ACL in the ISP/VPS hosting environment filtering packets with unexpected source addresses.

10%

Suggested fixes

1

Diagnostic step 1

On the VPS/server, add a reversible NAT rule to POSTROUTING that MASQUERADE traffic from the WireGuard subnet when going out to the destination interface, e.g., nftables: add rule ip nat POSTROUTING oifname "eth0" ip saddr <client-wg-subnet> counter masquerade. Test connectivity after adding and can remove rule to revert.

2

Diagnostic step 2

If you prefer no NAT, ensure the remote LAN's gateway (home gateway) has a static route back to the WireGuard subnet via the VPS's WireGuard endpoint IP. Add: ip route add <client-wg-subnet> via <server-wg-peer-ip> dev wg0 on the home gateway.

3

Diagnostic step 3

Check and temporarily disable reverse-path filtering on the home gateway and VPS (sysctl net.ipv4.conf.all.rp_filter=0) to test if rp_filter is dropping replies, then re-enable as appropriate and implement correct routing.

4

Diagnostic step 4

Capture packets on the home gateway (tcpdump on LAN interface) while initiating a TCP connection from the client to see whether the LAN host receives the SYN and where it sends the SYN-ACK. Use tcpdump on the VPS as well to compare flows.

5

Diagnostic step 5

If VPS hosting provider performs anti-spoofing, contact provider or use MASQUERADE at server. If you cannot change routes on the home gateway (ISP-provided device), prefer server-side SNAT as a practical workaround. Escalate to network provider if routing cannot be adjusted from your side.

Contact • Help • API Docs • Careers • Terms • Privacy • Cookies • Ads