Wireguard kernel debugging (relates to wstunnel)

For Developers
1

Followup from my earlier post since the issue now is no longer basic wireguard configuration but quite possibly working around network blocks (either ISP or Android hotspot), first here is some context:

  • What works: Android client connecting over cellular network
  • What does not work, either at all or just once: laptop connecting either over Android hotspot or via USB tethering. Initially tried mostly Linux, switched to Windows to use the official client and exclude issues with NM, still no luck.
  • What unexpectedly works: a second Android client, connecting to the same hotspot used by the laptop, can connect if I move the server (and firewall and peer config and...) from port 51820 to 1194 or 4500.
  • What I cannot test yet: laptop connecting via "normal" wifi, that is, not an Android hotspot.

In all cases above the client and the server can ping each other on IPv6 and the client can ping the server on IPv4.

Now I am now trying to setup wstunnel:

# openwrt
/mnt/sda1/bin/wstunnel server \
        --log-lvl debug \
        --tls-certificate /etc/acme/redacted_ecc/fullchain.cer \
        --tls-private-key /etc/acme/redacted_ecc/redacted.key \
        --restrict-to 127.0.0.1:4500 \
        wss://0.0.0.0:443

#windows (kept port 51820 in peer config since the important one is the destination)
"c:\Program Files\wstunnel\wstunnel.exe" client -L "udp://127.0.0.1:51820:127.0.0.1:4500?timeout=sec=0" wss://redacted:443

I have moved uhttpd to another port and added an https redirect so I don't have to change bookmarks on clients and the 443 port can be given to the tunnel, whose client / server can reliably talk to each other, keepalive packets are exchanged periodically, all ok. tcpdump on the router shows the udp packets emerging from loopback port 4500 but no reply from the server. "wg show" clearly indicates this peer was never seen.

Now that we have context, my questions are:

  • how do I rebuild the whole image as if it were done via owut changing ONLY the setting for wireguard debugging?
  • considering the setting can be dynamically toggled when built-in, how much of a difference does it make on the binary size? So much that it is better left off?