WireGuard Handshake Not Working: Common Causes
When no recent handshake appears, start at the packet path: endpoint, DNS, UDP port, provider firewall, host firewall, and key pairing.
Verify endpoint and port
Confirm the client uses the current VPS public IP or hostname and the same UDP port configured by the server.
Check firewall layers
Allow UDP 51820 in the cloud firewall and operating-system firewall. A port can be open in UFW while blocked by the provider.
Check keys and clocks
The server peer contains the client public key and vice versa. Ensure device clocks are correct.
Handle NAT
Clients behind restrictive NAT may need PersistentKeepalive = 25. Use it where a periodic outbound packet is needed.
Quick checklist
- The endpoint is current.
- UDP is allowed at both layers.
- Public keys are paired.
- Clock and NAT behavior are tested.
This guide focuses on practical self-hosting. See the complete WireGuard server guide for the full setup. Tired of maintaining the server yourself? ZeroBlock handles the VPN infrastructure so you can connect without managing a VPS.