Resolving a "no RX connection" error in WireGuard between two routers typically involves verifying that the public keys match exactly, ensuring UDP port 51820 is open on both ends, and confirming that the allowed IPs do not create routing loops. Most failures stem from misconfigured peer entries or firewall blocks rather than core protocol errors.
Verify Configuration Symmetry
The most common cause for a one-sided connection failure is an asymmetry in the configuration files. WireGuard requires that both peers know about each other. If Router A sees Router B but Router B does not see Router A, the handshake will fail silently or result in no received packets. Check the[Peer] section on both routers. The PublicKey of the remote router must be present in the local configuration. Similarly, the AllowedIPs field must be configured correctly. A frequent mistake is setting AllowedIPs to 0.0.0.0/0 (all traffic) when you only intend to route specific subnets. While this works for full tunneling, it can cause issues if the default gateway settings are not aligned. Ensure that the PresharedKey is identical on both sides, although modern implementations often omit this for simplicity if using just public keys.
Check Firewall and NAT Settings
WireGuard operates over UDP port 51820 by default. Even if the software is running, the underlying operating system or router firmware may block incoming connections. You must ensure that the firewall on both routers allows inbound UDP traffic on this specific port. If your routers are behind a carrier-grade NAT or a upstream ISP firewall, you may need to configure Port Forwarding. Direct the external UDP 51820 traffic to the internal IP address of the router hosting the WireGuard interface. Additionally, check for any intermediate network devices, such as modems or switches, that might have strict security profiles enabled. Disabling SIP ALG or similar deep packet inspection features can sometimes resolve connectivity issues, as these features often interfere with VPN protocols. For more details on general connectivity barriers, see our guide on Default Gateway cannot be reached for networked computer. This often overlaps with VPN routing issues where the gateway becomes unreachable due to conflicting routes.Validate Interface and Routing Tables
Once the connection appears established, verify that the virtual interface is actually up. On many router platforms, you can check the status via the web interface or command line. Look for the assigned IP addresses on thewg0 (or similar) interface. They should be within the same subnet defined in the Address field of the configuration.
Next, examine the routing table. The route to the remote router's LAN subnet should point through the WireGuard interface, not the physical WAN interface. If you see a route pointing to the wrong interface, traffic will leave the router and never return through the tunnel. You may need to add static routes manually if your router firmware does not auto-populate them based on the AllowedIPs directive.
Ensure that the Endpoint field in the client configuration points to the correct public IP or domain name of the server router. If the server has a dynamic IP, consider using a Dynamic DNS service and updating the endpoint accordingly.
Test Connectivity and Debug Logs
Use ping tests to isolate the layer of failure. Try pinging the remote WireGuard interface IP first. If this succeeds, the tunnel is working, and the issue lies in the LAN-to-LAN routing. If it fails, the problem is at the network or transport layer. Enable verbose logging on both routers. Look for messages indicating "handshake completed" or "new peer connected." If you see repeated "no response" or "timeout" messages, it confirms a network path issue. Check the MTU settings if you suspect fragmentation issues, though this usually results in slow performance rather than total failure. For insights into optimizing VPN performance, refer to Troubleshooting Slow VPN Upload Traffic on Your Tech Support Site, as MTU mismatches are a common culprit there as well. If you are connecting between two sequential public IPs without proper NAT traversal, consult Troubleshooting Cannot Connect Between 2 Sequential Public IPs for specific handling of edge cases in public IP allocation.Frequently Asked Questions
Why does my WireGuard connection show as active but I cannot ping?
This usually indicates a routing mismatch where the return traffic is not being sent back through the tunnel. Verify that the AllowedIPs on the peer entry matches the subnet you are trying to reach, and check your router's routing table to ensure the destination subnet points to the WireGuard interface.
Can I use a different port than 51820 for WireGuard?
Yes, you can change the ListenPort on the server and the corresponding port in the client's Endpoint field. This is useful for bypassing ISP blocks or avoiding conflicts with other services, but you must update firewall rules to allow the new UDP port.
What causes the "no RX" message specifically?
"No RX" means the local device is sending packets but receiving none back. This is almost always caused by the remote firewall dropping the packets, incorrect public key configuration, or the remote router not having a valid route back to the source IP.
Do I need to forward ports on both routers?
No, only the router acting as the server needs to have its UDP port forwarded or exposed. The client router initiates the connection outbound, so it does not require inbound port forwarding, assuming it has a public IP or is behind standard NAT.
How do I reset a broken WireGuard configuration on a router?
Most router firmwares allow you to delete the existing WireGuard instance or profile through the web UI. After deletion, restart the router and recreate the configuration from scratch, ensuring you copy the keys carefully to avoid typos.