WireGuard

AllowedIPs Traps (Most Common Mistakes)

• AllowedIPs means different things on each side — server: what peer CAN send; client: what to ROUTE through tunnel
• 0.0.0.0/0 routes ALL traffic including tunnel endpoint — breaks connectivity, must exclude server's public IP first
• Overlapping AllowedIPs between peers = undefined routing — each IP range must belong to exactly one peer
• Wrong mask silently breaks routing — /32 for single host, /24 for subnet, verify carefully

Connection Failures

• No handshake = wrong public key, firewall blocking UDP, or wrong endpoint — check all three, not just one
• One-way traffic = AllowedIPs misconfigured — packets go out but replies don't route back
• Missing PersistentKeepalive = 25 breaks NAT traversal — peer behind NAT unreachable after ~2 minutes
• Config file permissions must be 600 — wg-quick silently refuses to start with loose permissions

DNS Leaks

• Without DNS = in client config, DNS queries bypass tunnel — leaks real IP to DNS provider
• Full tunnel (0.0.0.0/0) without DNS config = false sense of security — traffic tunneled but DNS exposed