Skip to content

fix: WireGuard handshake (51820, keepalive, IPv6 off) #25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dfosterj wants to merge 5 commits into
base: stable
Choose a base branch
from
Open

fix: WireGuard handshake (51820, keepalive, IPv6 off) #25

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2a0543b
fix: prefer WireGuard UDP 51820 over advertised udp[0]
Sep 11, 2026
8ee738a
fix: set WireGuard persistent-keepalive to 25
Sep 11, 2026
9186bd6
fix: disable IPv6 on the WireGuard NM profile
Sep 11, 2026
be2d018
chore: record 5.6.11 WireGuard handshake fixes
Sep 11, 2026
43f2b1e
Merge branch 'stable' into fix/wireguard-handshake
dfosterj Sep 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 14 additions & 1 deletion proton/vpn/backend/networkmanager/protocol/wireguard/wireguard.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,11 @@ class Wireguard(LinuxNetworkManager, LocalAgentMixin):
connection: Optional[NM.SimpleConnection] = None
FWMARK: int = FWMARK_VALUE

@property
def enable_ipv6_support(self) -> bool:
# IPv6 DNS follows the kill-switch dummy and blackholes Local Agent.
return False

def __init__(self, *args, **kwargs):
super().__init__(*args, **kwargs)
LocalAgentMixin.__init__(self, self._user_tier)
Expand Down Expand Up @@ -236,17 +241,25 @@ def _configure_dns(
nm_setting.add_dns(wg_config.get_dns_ip_for_protocol_version(ip_version))
nm_setting.add_dns_search(wg_config.get_dns_search_for_protocol_version(ip_version))

def _wireguard_udp_port(self) -> int:
"""Prefer 51820 when advertised; udp[0] is often 443 and fails to handshake."""
ports = list(self._vpnserver.wireguard_ports.udp or [])
if 51820 in ports:
return 51820
return ports[0]

def _set_wireguard_properties(self):
peer = NM.WireGuardPeer.new()
wireguard_config = NM.SettingWireGuard.new()

peer.append_allowed_ip(wg_config.ipv4.allowed_ip, False)
peer.set_endpoint(
f"{self._vpnserver.server_ip}:{self._vpnserver.wireguard_ports.udp[0]}",
f"{self._vpnserver.server_ip}:{self._wireguard_udp_port()}",
False
)

peer.set_public_key(self._vpnserver.x25519pk, False)
peer.set_persistent_keepalive(25)

if self.enable_ipv6_support:
peer.append_allowed_ip(wg_config.ipv6.allowed_ip, False)
Expand Down