Verifying Server IP Forwarding
Before troubleshooting complex firewall rules, you must ensure the Linux kernel is allowed to route traffic between interfaces. If IP forwarding is disabled, packets arriving from the Wireguard interface will be dropped instead of being forwarded to the public internet. Check the current status by running:sysctl net.ipv4.ip_forward
If the output is net.ipv4.ip_forward = 0, forwarding is disabled. Enable it temporarily with:
sudo sysctl -w net.ipv4.ip_forward=1
To make this change persistent across reboots, edit the /etc/sysctl.conf file. Find the line containing net.ipv4.ip_forward and uncomment it, setting the value to 1. Then apply the changes using:
sudo sysctl -p
Without this setting, no amount of firewall tweaking will allow your client to reach external hosts. For more context on setting up Wireguard on Ubuntu, see How to Run Wireguard (wg-quick) on Ubuntu VPS with Copied Config from macOS.
Configuring Masquerading Rules
The most frequent cause of "no internet" issues in Wireguard setups is the absence of NAT (Network Address Translation) or masquerading rules. Wireguard routes traffic based on private IPs, but the public internet requires source IP translation so return traffic knows where to go. For IPv4, use iptables to add a masquerade rule. Assuming your Wireguard interface is namedwg0, run:
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
Replace eth0 with your actual public-facing network interface name. You can verify the rule was added by running:
sudo iptables -t nat -L -n -v
If you are using UFW (Uncomplicated Firewall), note that UFW manages input rules primarily. Outbound traffic is generally unrestricted by default in modern UFW configurations. Therefore, commands like sudo ufw allow out 53/udp are unnecessary and syntactically misleading because UFW does not block outbound traffic unless explicitly configured to do so via advanced rules. Focus instead on ensuring UFW allows forward traffic if it is enabled.
Add this rule to your UFW before/after rules file to ensure it persists after firewall restarts:
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
Checking Firewall Permissions
Even with correct routing and NAT, local firewalls can block traffic. On the server, ensure that the Wireguard port (default51820/udp) is open. More importantly, ensure that the firewall allows forwarded traffic between the Wireguard interface and the internet interface.
If using firewalld, enable masquerading on the zone used by your public interface:
sudo firewall-cmd --zone=public --add-masquerade --permanent
sudo firewall-cmd --reload
If using ufw, ensure that forwarding is permitted. Add the following to /etc/ufw/before.rules:
-A ufw-before-forward -i wg0 -j ACCEPT
-A ufw-before-forward -o wg0 -j ACCEPT
This allows traffic to flow in both directions between the VPN tunnel and the host system. Remember to restart UFW after making these changes.
MTU and Client Configuration
Sometimes the server is correctly configured, but the client cannot send large enough packets due to MTU (Maximum Transmission Unit) mismatches. Wireguard adds overhead to each packet. If your network MTU is 1500, the effective payload is smaller. Set the MTU in your client configuration file:[Interface]
...
MTU = 1420
Or set it dynamically on the client side:
wg set wg0 mtu 1420
Test connectivity with a small ping first, then try downloading a larger file. If large downloads fail but pings work, MTU is likely the culprit. Adjust the value incrementally until stable. For further reading on persistent connection issues, check WireGuard: Persistent Keepalive Not Working for Split Tunnel with Single Client and Two VPSs.
Frequently Asked Questions
Why can I ping the server but not browse websites?
This confirms that the Wireguard tunnel itself is working, but routing or NAT is broken. Ensure that IP forwarding is enabled on the server and that an iptables masquerade rule exists for your public interface.
Does Wireguard require specific DNS servers?
No, Wireguard does not mandate specific DNS servers. However, if your ISP blocks standard DNS over UDP, you may need to configure DoH or DoT. The error described usually stems from network layer issues, not DNS resolution failures.
How do I verify if my firewall is blocking forwarded traffic?
Check your firewall logs or use tcpdump on the server's public interface. If you see outgoing SYN packets but no return SYN-ACK, the packet is being dropped by the firewall or missing a NAT rule.
Is UFW sufficient for managing Wireguard traffic?
UFW handles inbound rules well, but it does not manage NAT or forwarding rules automatically. You must manually add iptables rules for masquerading and potentially edit UFW's before.rules file to allow forwarded traffic between interfaces.
What happens if I forget to enable IP forwarding?
The kernel will drop all routed packets immediately. Your client will connect to the server, but any attempt to access external resources will time out. Always verify sysctl net.ipv4.ip_forward returns 1.