WireGuard Connected but Not Working: Reachability, DNS, and Subnet Checks

Supported GL.iNet WireGuard server/client configurations; authorized networks only.

Applies to: Supported GL.iNet WireGuard server/client configurations; authorized networks only.

Checked: 2026-11-01 · Risk: high-impact · Status: source-grounded editorial draft; not hands-on tested.

Before you begin

Keep profiles private. Identify whether the failure is no handshake, no internet through a connected tunnel, or no access to a particular LAN service.

Procedure

1. Test remote access from a separate network rather than the VPN server’s own LAN.
2. Check whether the home endpoint is reachable under its actual ISP/public-address arrangement.
3. For a connected tunnel without usable traffic, inspect DNS and route policy separately.
4. Check for overlapping client LAN, server LAN and VPN subnets. Renumber only with a recovery plan.
5. Validate a fresh authorized profile locally if configuration information is missing.

Verify the result

Check handshake recency, the intended DNS result and one explicitly permitted service. Do not upload the configuration to RouterFix.

Undo or recover

Restore recorded addressing/routing, disable the test profile and revoke unused keys. Reconnect local clients after any deliberate subnet change.

Stop and escalate

Do not expose HTTPS router administration or bypass certificate warnings merely to test a VPN port.

Evidence and interpretation limits

The vendor page includes remote-admin testing; this risky technique is deliberately excluded. MTU changes require evidence and are not a fixed magic-number fix.

The steps above combine paraphrased official instructions with an original safety and test workflow. They are not a verbatim manual, a guaranteed fix, or evidence of a common hardware defect.

Official sources

• GL.iNet WireGuard server troubleshooting — gl-wg-troubleshoot; access: full_text.

Try the right tool