WG losing connection after a minut or so

godathuske · July 6, 2025, 3:29pm

When I add a ProtonVPN it works for a couple of minutes and then I get "Connected without internet".
Both RX and TX shows in the interface and it had a handshake. But there are no internet on any of my devices.
I try to restart the VPN interface and sometimes it has TX but no RX and other times it has neither.
I've tried with several different server configs and creating new interfaces for it. But still result for them all.

What is causing this issue?

VPN config:

[Interface]
# Key for openwrt
# Bouncing = 4
# NetShield = 0
# Moderate NAT = off
# NAT-PMP (Port Forwarding) = off
# VPN Accelerator = on
PrivateKey = *****
Address = 10.2.0.2/32
DNS = 10.2.0.1

[Peer]
# DK#70
PublicKey = d3VXpY1SJGxlx8Cq3trvJBkZvilHF6BdSynqphx+iw8=
AllowedIPs = 0.0.0.0/0
Endpoint = 193.29.107.98:51820

In peers "Route Allowed IP's" are checked.

Network configs:

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd57:7177:36a6::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'
	option peerdns '0'
	list dns '10.2.0.1'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

config interface 'wg0'
	option proto 'wireguard'
	option private_key 'GDz/='
	list addresses '10.2.0.2/32'
	list dns '10.2.0.1'
	option metric '2'
	option disabled '1'

config wireguard_wg0
	option description 'dk-18-acc-DK-18.conf'
	option public_key '+QJnc='
	list allowed_ips '0.0.0.0/0'
	option endpoint_host '193.29.107.242'
	option endpoint_port '51820'
	option route_allowed_ips '1'

config interface 'proton0'
	option proto 'wireguard'
	option private_key '+F+='
	list addresses '10.2.0.2/32'
	list dns '10.2.0.1'
	option disabled '1'

config wireguard_proton0
	option description 'Imported peer configuration'
	option public_key '+iw8='
	list allowed_ips '0.0.0.0/0'
	option endpoint_host '193.29.107.98'
	option endpoint_port '51820'
	option route_allowed_ips '1'

config interface 'Guest'
	option proto 'static'
	option ipaddr '10.20.30.40'
	option netmask '255.255.255.0'
	list dns '1.1.1.1'
	option device 'phy0-ap1'

config interface 'IoT'
	option proto 'static'
	option ipaddr '172.16.0.1'
	option netmask '255.255.255.0'
	list dns '1.1.1.1'

config interface 'wgdk113'
	option proto 'wireguard'
	option private_key 'qAp/Ne+='
	list addresses '10.2.0.2/32'
	list dns '10.2.0.1'

config wireguard_wgdk113
	option description 'Imported peer configuration'
	option public_key '+6='
	list allowed_ips '0.0.0.0/0'
	option endpoint_host '185.111.109.1'
	option endpoint_port '51820'
	option route_allowed_ips '1'

config interface 'wgdk98'
	option proto 'wireguard'
	option private_key '++LMAbjBFRRDz2Fc3e0c='
	list addresses '10.2.0.2/32'
	list dns '10.2.0.1'
	option disabled '1'

config wireguard_wgdk98
	option description 'Imported peer configuration'
	option public_key '+xqdmBAf2CB4='
	list allowed_ips '0.0.0.0/0'
	option endpoint_host '149.50.217.161'
	option endpoint_port '51820'
	option route_allowed_ips '1'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config host
	option name 'giraffe-4'
	option ip '192.168.1.160'
	list mac 'DC:1B:A1:A7:BE:E9'

config dhcp 'Guest'
	option interface 'Guest'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'IoT'
	option interface 'IoT'
	option start '100'
	option limit '150'
	option leasetime '12h'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option mtu_fix '1'
	list network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	list network 'wan'
	list network 'wan6'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config include 'pbr'
	option fw4_compatible '1'
	option type 'script'
	option path '/usr/share/pbr/firewall.include'

config zone
	option name 'vpn'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	list network 'proton0'
	list network 'wg0'
	list network 'wgdk113'
	list network 'wgdk98'

config forwarding
	option src 'lan'
	option dest 'wan'

config zone
	option name 'GuestZone'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'Guest'

config zone
	option name 'IoTZone'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'IoT'

config rule
	option name 'Guest DCHP and DNS'
	option src 'GuestZone'
	option dest_port '5333 53 67 68'
	option target 'ACCEPT'

config rule
	option name 'IoT DCHP and DNS'
	option src 'IoTZone'
	option dest_port '5333 53 67 68'
	option target 'ACCEPT'

config forwarding
	option src 'GuestZone'
	option dest 'vpn'

config forwarding
	option src 'IoTZone'
	option dest 'vpn'

config forwarding
	option src 'lan'
	option dest 'vpn'

egc · July 7, 2025, 7:49am

First a few unrelated things
I recommend to add MTU-fix on the vpn zone:

   option mtu_fix '1'

godathuske:

config zone
	option name 'vpn'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	list network 'proton0'
	list network 'wg0'
	list network 'wgdk113'
	list network 'wgdk98'

But you can remove that from the LAN zone

Setting a non public DNS server which is only available after the tunnel is up can get you in trouble especially as there is no route for this DNS server through the tunnel if you disable default routing via the tunnel, for some more info check my notes: .

Now on to your question.
WireGuard is not a chatty protocol if there is no traffic the connection is closed.
It does open rather quickly in well under a second but unless you are on a metered connection just keep the connection open by setting persistent_keepalive
Add to the peer config:

    option persistent_keepalive '25'

Also covered in my notes