Remote router WireGuard tunnel fails

Prerequisites and authority

Start with read-only checks and authorized records. Capture evidence before changes. Stop and escalate when data replacement, financial changes or wider outages are possible.

WireGuard tunnel or remote routing fails

Basic

Check site power/upstream and the configured endpoint. Identify whether there is a recent handshake. A public web interface working does not prove this path works.

Intermediate

Without a handshake, inspect endpoint DNS, UDP reachability, keys and NAT keepalive. With a handshake but no API reachability, inspect inner addresses, peer allowed networks, host routes and return routes.

Advanced

For a site gateway, check IP forwarding and forward-chain policy as well as input policy. Confirm downstream routers return traffic toward the management source. Test from the application runtime and identify overlap with Docker/site/VPN subnets.

Do not add a default route or broadly allow all networks just to bypass a missing specific route. Prefer the documented management routes and correct source restrictions.

Verify the complete sequence: handshake → route → API TCP → authenticated operation → event return path. Repeat after a controlled upstream interruption. Preserve the route/peer inventory and escalate when fixing overlap or routing requires a wider network redesign.