WireGuard Connected but No Internet: How to Fix It
A handshake proves that peers authenticate. It does not prove forwarding, NAT, DNS, or a default route. Check the path in order instead of regenerating keys.
Confirm handshake and addresses
sudo wg show
ip address show wg0Check forwarding and NAT
Verify net.ipv4.ip_forward=1 and ensure POSTROUTING MASQUERADE uses the real public interface from ip route get 1.1.1.1.
Inspect AllowedIPs and DNS
For a full tunnel, the client needs AllowedIPs = 0.0.0.0/0. Test an IP before testing a hostname.
Review both firewalls
Check UFW, iptables or nftables, and the provider firewall. Use journalctl -u wg-quick@wg0 for service errors.
Quick checklist
- A recent handshake exists.
- Forwarding is enabled.
- NAT uses the real interface.
- AllowedIPs, DNS, and both firewalls are checked.
This guide focuses on practical self-hosting. See the complete WireGuard server guide for the full setup. Tired of maintaining the server yourself? ZeroBlock handles the VPN infrastructure so you can connect without managing a VPS.