Dear selfhosted community,

I have recently setup Wireguard (WG) and I am encountering some weird behaviour, which I assume is due to my lack of understanding. I’ll describe my current network setup, the devices i’m using in this setup, the issues that I’m facing, and finally my requirements from the WG installation. This might be slightly wrong but I intend to give as much information as possible.

Network setup

I am attempting to use WG from multiple locations. I am using the wg-easy docker image with OOTB settings.

• Location 0 (L0) = My home where WG is hosted (Internal IP 192.168.30.0/24 and ISP A)
• Location 1 (L1) = Using my android phone hotspot (Internal IP 10.19.79.0/24 using ISP B/mobile data plan)
• Location 2 (L2) = My friend’s home (Internal IP 192.168.1.0/24 with ISP C) (Edit 2: My dum friend set /16 instead of /24 after I checked the router. Major problem is fixed)

Devices & Services

For the sake of this example, I have two devices from which I use WG; an Android phone and a Linux laptop.

I have a couple of self-hosted services at L0 which I access using local DNS entries. So if my devices can connect to my DNS server, I can access my local services (https://jellyfin.server.lan/).

All my WG profiles use full-tunneling, i.e., all traffic is sent to my WG server.

Interesting scenarios

Case 1

When I use WG via L1 (both the phone and my laptop), everything works fine. It always reports ISP A which is correct.

Case 2A

When I connect to WG from my phone, everything works fine.

Case 2B

When I go to L2 and use my laptop + WG, the result is mixed. I can use the internet via WG but I cannot access my local services. I observed that I cannot even ping my devices even though I can use the internet. I verified this by checking ifconfig.io and I could see ISP A.

Case 2C

I tried being a bit creative and manually added a route on my laptop

sudo ip route add 192.168.30.0/24 dev laz-wg

Once I did this, I could ping my devices at L0. But the strange thing is I cannot use my local DNS entries; only direct IP connections were working which indicates my DNS queries were answered by someone else.

Case 3

Another funny observation; if I use my phone at L2 but I use the hotspot facility, i.e., I repeat the signal of my friend’s WiFi, and connect my laptop to it AND THEN turn on WG on my laptop, everything works fine (Internet and local DNS entries). I double checked using ifconfig.io and it’s reporting ISP A.

Note: I turned off mobile data on my phone before trying the repeater mode, so ISP B is not in the picture in this example.

Case 4 (Repeat of Case 1)

I used another WG profile on my friend’s Amazon Firestick (at L2) and I could access my Jellyfin server from it

In summary

1. Case 1 => Laptop @ any location + WG + phone hotspot via ISP B = Working
2. Case 3 => Laptop @ L2 + WG + phone hotspot via ISP C = Working
3. Case 2A => Phone @ L2 + WG via ISP C = Working
4. Case 2B => Laptop @ L2 + WG via ISP C = Only internet working, self-hosted services at L0 not reachable
5. Case 4 => Amazon firestick + WG via ISP C = Working

So what do I want?

First of all, why this discrepancy between Android and Linux?

I want a WG setup where if I share a WG profile with anyone, I expect

1. The user does not have to tinker with the setup
2. Local DNS entries should work OOTB
3. Should work the same on Windows/Android/Linux

I am prepared to configure everything server side but with minimal change on the client-side. So what is wrong and what should I do to fix it?

Edit: I fixed the numbering with the Case numbers