WireGuard Works on Wi-Fi but Not Mobile Data
Mobile networks use carrier NAT, different DNS, IPv6 preferences, and sometimes stricter UDP behavior. A Wi-Fi profile may need endpoint and keepalive tuning for cellular.
Compare endpoints
Confirm the phone can resolve and reach the VPS over mobile data. Test the public IPv4 directly if cellular DNS resolves differently.
Use mobile keepalive
For a client behind NAT, add PersistentKeepalive = 25 and reconnect. It keeps mappings alive but cannot defeat a carrier block.
Check address families
Compare IPv4, IPv6, DNS results, and APN restrictions without changing several variables at once.
Test the carrier limitation
Try another carrier or hotspot. If the profile works there, the original network filters or routes traffic differently.
Quick checklist
- The endpoint is reachable over cellular.
- Keepalive is used when needed.
- Address-family behavior is checked.
- A second mobile network is compared.
This guide focuses on practical self-hosting. See the complete WireGuard server guide for the full setup. Tired of maintaining the server yourself? ZeroBlock handles the VPN infrastructure so you can connect without managing a VPS.