RTSP (TCP 554) not reachable over WireGuard site-to-site — ping works, stream doesn’t

Router VPN, DNS, Leaks
1

Hi everyone,
I have a WireGuard site-to-site setup and can’t get an RTSP camera stream through the tunnel, even though ICMP ping to the camera works fine. Hoping someone can point me at the right setting.
Setup:
• Self-hosted WireGuard server on a VPS (<VPS_IP>:51820)
• Remote site: GL.iNet router as WireGuard client (GL-X3000 over 4G, and a GL-MT2500/Brume 2 for comparison)
• Camera: Reolink RLC-823S2 (PoE, native RTSP/ONVIF) on the remote LAN, e.g. 192.168.30.21
• Server routes the remote subnet to the remote peer (AllowedIPs = 10.8.0.x/32, 192.168.30.0/24)
• ‘Allow Remote Access to LAN’ is ON on the remote GL.iNet router

What works:
• From the server/client I can ping the camera (192.168.30.21) through the tunnel, no packet loss
• With the Brume 2 connected via wired WAN the RTSP stream also works fine

What doesn’t:
• With the GL-X3000 over 4G, the RTSP stream on TCP 554 does not play (rtsp://user:pass@192.168.30.21:554/…). It either won’t open or connects and then shows no video. ICMP still works the whole time.

What I’ve already tried:
• Forcing RTSP over TCP instead of UDP
• Checked ‘Allow Remote Access to LAN’
• Verified the camera works locally on its own LAN

My questions:

  1. Is this a classic MTU / TCP-MSS-clamping issue on the WireGuard interface over 4G?

If so, what MTU do you recommend for a GL.iNet WG client on cellular, and how do I enable MSS clamping on current firmware?

  1. Is there any firewall/zone forwarding setting beyond ‘Allow Remote Access to LAN’ needed to pass TCP 554 (vs. ICMP)?

  2. Anything specific about the X3000 (cellular NAT) that would let ping through but drop larger TCP stream.

Did somebody have the Same Problem?

Thanks in advance for any pointers!

Pascal

3

Hi,

Thank you for the detailed information.

To help us narrow down where the TCP 554 connection is interrupted without changing your current configuration, could you please help us collect the following diagnostic information?

Could you please capturing traffic on the WireGuard and LAN interfaces at the same time will show whether the request reaches the camera and whether the camera’s response returns through the tunnel.

  1. Please run the following command from the VPS or the device that opens the RTSP stream.
nc -vz -w 5 192.168.30.21 554

Whether it reports a successful connection, a timeout, or “connection refused.”
2. At the same time, please open two SSH sessions to the GL-X3000 and run the following commands.
Window 1: tcpdump -ni wgclient1 -vv -s 0 'host 192.168.30.21 and tcp port 554'
Window 2: tcpdump -ni br-lan -vv -s 0 'host 192.168.30.21 and tcp port 554'
While both captures are running, try to open the RTSP stream once, wait about 15 seconds, and then stop both captures with Ctrl+C .
Please also run the following command while the connection attempt is active.

conntrack -L -p tcp 2>/dev/null | grep 'dport=554'

Please send the command output or screenshots to us via a private message.

image
image499×180 13.3 KB

Thank you for your understanding and cooperation.