Need to keep generating new Wireguard profiles

Routers VPN, DNS, Leaks
1

Hi Team.
I have the following: GL-MT300N-V2, Firmware 4.3.25.

I use it to terminate a VPN within my home network using Wireguard. Client runs on an iPhone 16 - to give me access to home DLNA server or just VPN when abroad. Port 51820 is fwd to the static address of the MT300N. I generate a Wireguard client using QR code on the MT300N WebGUI. All works well... for a while. I can switch the VPN on and off successfully on the iPhone and get a reliable connection and speed.

Problem - every few days, the previously-working profile stops connecting (error log below).

If I generate a new Wireguard profile and connect with that - it immediately works fine. For a while - then the fault repeats.

My understanding is that Wireguard profiles do not normally expire - but I think something else is going on.

Any ideas would be most welcome. Thank you in advance.

Working client Log:
NET] Routine: receive incoming v6 - started
2025-07-30 17:45:58.087
[NET] peer(TfL7…52Vo) - Received handshake response
2025-07-30 17:46:02.859
[APP] Status update notification timeout for tunnel 'user10'. Tunnel status is now 'connected'.
2025-07-30 17:46:33.837
[NET] peer(TfL7…52Vo) - Receiving keepalive packet

Broken client log:
[NET] peer(TfL7…52Vo) - Sending handshake initiation
2025-07-30 17:38:25.950
[NET] peer(TfL7…52Vo) - Handshake did not complete after 5 seconds, retrying (try 5)
2025-07-30 17:38:25.951
[NET] peer(TfL7…52Vo) - Sending handshake initiation
2025-07-30 17:38:30.980
[NET] peer(TfL7…52Vo) - Handshake did not complete after 5 seconds, retrying (try 2)
2025-07-30 17:38:30.980

2

You seem to have network connectivity issues or, & more likely, the persist keepalive value (ie: keepalive = 25) is missing in your WG client confs.

Via ssh to your Mango, wg show will confirm the last good handshake, like latest handshake: 1 minute, 9 seconds ago

3

Client requests to connect to a VPN handshake that may not have reached the VPN server, it looks likely to be a network issue.

It is possible that the modem WAN public IP is dynamic, and after a few days, the WAN IP has changed, the server can not be connected.

Did the VPN server enable DDNS? try enabling it, and the profile peer endpoint uses the DDNS domain to connect to the VPN.

1 Like
4

Duh - you are spot on. For some reason I had assumed it was already using a dyn domain - but, no, fixed.

Much appreciated Bruce!

5

Thanks for coming back to me - simple connectivity issue in the end - entirely my oversight!