Update:
After performing remote packet captures and traceroute tests, along with wget tests on several links, we found that there are certain restrictions on the current network. It allows the first few packets to pass when a connection is initially established, and then blocks the traffic shortly afterward.
As a result, the following behavior occurs:
- The router interface shows a green indicator and a Connected status for WireGuard, because communication with the WireGuard server works normally at the very beginning. However, the ISP then blocks the connection, causing WireGuard to stop functioning properly.
- After multiple MAC address randomizations, it’s possible that WireGuard, through repeated retries, manages to take advantage of the brief initial window when the connection is allowed. This allows the handshake to complete, after which subsequent traffic can be transmitted normally over the encrypted tunnel.
Since these restrictions are enforced on the ISP side, there isn’t much we can do to resolve this directly.
You may consider using Amnezia WG with obfuscation enabled, which might help bypass these restrictions.