From 2a0543bed03a338940b40c22d035fc7ee2597181 Mon Sep 17 00:00:00 2001 From: dfosterj Date: Fri, 11 Sep 2026 16:03:13 -0500 Subject: [PATCH 1/4] fix: prefer WireGuard UDP 51820 over advertised udp[0] NM activates proton0 with no handshake when the peer is :443. Prefer 51820 when the server list includes it. Co-authored-by: Cursor --- .../networkmanager/protocol/wireguard/wireguard.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/proton/vpn/backend/networkmanager/protocol/wireguard/wireguard.py b/proton/vpn/backend/networkmanager/protocol/wireguard/wireguard.py index 4d37e77..ef1b5c5 100644 --- a/proton/vpn/backend/networkmanager/protocol/wireguard/wireguard.py +++ b/proton/vpn/backend/networkmanager/protocol/wireguard/wireguard.py @@ -236,13 +236,20 @@ def _configure_dns( nm_setting.add_dns(wg_config.get_dns_ip_for_protocol_version(ip_version)) nm_setting.add_dns_search(wg_config.get_dns_search_for_protocol_version(ip_version)) + def _wireguard_udp_port(self) -> int: + """Prefer 51820 when advertised; udp[0] is often 443 and fails to handshake.""" + ports = list(self._vpnserver.wireguard_ports.udp or []) + if 51820 in ports: + return 51820 + return ports[0] + def _set_wireguard_properties(self): peer = NM.WireGuardPeer.new() wireguard_config = NM.SettingWireGuard.new() peer.append_allowed_ip(wg_config.ipv4.allowed_ip, False) peer.set_endpoint( - f"{self._vpnserver.server_ip}:{self._vpnserver.wireguard_ports.udp[0]}", + f"{self._vpnserver.server_ip}:{self._wireguard_udp_port()}", False ) From 8ee738a5f3ade31956247d30a92c5f6759fba0dc Mon Sep 17 00:00:00 2001 From: dfosterj Date: Fri, 11 Sep 2026 16:03:19 -0500 Subject: [PATCH 2/4] fix: set WireGuard persistent-keepalive to 25 Match exported Proton nmcli profiles so NAT mappings stay open. Co-authored-by: Cursor --- .../vpn/backend/networkmanager/protocol/wireguard/wireguard.py | 1 + 1 file changed, 1 insertion(+) diff --git a/proton/vpn/backend/networkmanager/protocol/wireguard/wireguard.py b/proton/vpn/backend/networkmanager/protocol/wireguard/wireguard.py index ef1b5c5..3b2e01d 100644 --- a/proton/vpn/backend/networkmanager/protocol/wireguard/wireguard.py +++ b/proton/vpn/backend/networkmanager/protocol/wireguard/wireguard.py @@ -254,6 +254,7 @@ def _set_wireguard_properties(self): ) peer.set_public_key(self._vpnserver.x25519pk, False) + peer.set_persistent_keepalive(25) if self.enable_ipv6_support: peer.append_allowed_ip(wg_config.ipv6.allowed_ip, False) From 9186bd63bdcfd2e3a531a473ada6fcfc5772a59d Mon Sep 17 00:00:00 2001 From: dfosterj Date: Fri, 11 Sep 2026 16:03:27 -0500 Subject: [PATCH 3/4] fix: disable IPv6 on the WireGuard NM profile IPv6 DNS 2a07:b944::2:1 is routed via the kill-switch dummy. Match working exported profiles that leave IPv6 off. Co-authored-by: Cursor --- .../backend/networkmanager/protocol/wireguard/wireguard.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/proton/vpn/backend/networkmanager/protocol/wireguard/wireguard.py b/proton/vpn/backend/networkmanager/protocol/wireguard/wireguard.py index 3b2e01d..473668d 100644 --- a/proton/vpn/backend/networkmanager/protocol/wireguard/wireguard.py +++ b/proton/vpn/backend/networkmanager/protocol/wireguard/wireguard.py @@ -100,6 +100,11 @@ class Wireguard(LinuxNetworkManager, LocalAgentMixin): connection: Optional[NM.SimpleConnection] = None FWMARK: int = FWMARK_VALUE + @property + def enable_ipv6_support(self) -> bool: + # IPv6 DNS follows the kill-switch dummy and blackholes Local Agent. + return False + def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) LocalAgentMixin.__init__(self, self._user_tier) From be2d0187bcb6888c7851f9ee7458b3ca392e627d Mon Sep 17 00:00:00 2001 From: dfosterj Date: Fri, 11 Sep 2026 16:05:54 -0500 Subject: [PATCH 4/4] chore: record 5.6.11 WireGuard handshake fixes Co-authored-by: Cursor --- versions.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/versions.yml b/versions.yml index f82e6e5..64fc20e 100644 --- a/versions.yml +++ b/versions.yml @@ -1,3 +1,12 @@ +version: 5.6.11 +time: 2026/09/11 16:02 +author: dfosterj +email: dfosterj@pm.me +description: +- "fix: Prefer WireGuard UDP 51820 over advertised udp[0]" +- "fix: Set WireGuard persistent-keepalive to 25" +- "fix: Disable IPv6 on the WireGuard NM profile" +--- version: 5.6.10 time: 2026/08/21 15:28 author: Luke Titley