So I've recently been struggling to figure out what went wrong with my VPN in unRaid.

Following a power loss and Ubiquiti router update (both happened in a span of half a day), my wireguard tunnels are now unable to access the internet.
Containers using the tunnel's custom network can ping other containers on my machine, but cannot access the outside world.

When I ping my tunnel it replies, but the "Data received:" and "Data sent:" entries at the bottom left show essentially no traffic (1.80 kb and 35.0 kb)

 

I hadn't updated or changed any settings in my setup prior to this happening, so I'm at a bit of a loss.

Things I've tried/double-checked:

- Quadrouple checking my port forwarding

- Changing my server's IP from static to automatic and back from unraid, and changing the IP it's assigned via the router to a new one and back

- Deleting my tunnel and setting them up again (even downloaded a new config from ProtonVPN)

- Deleting my network.cfg and wg0.conf/wg1.conf

- Setting up a static route (which the server previously did not need) 

- Setting my persistent keepalive to 25 seconds (was not set/needed previously)

I also tried making these suggested tweaks (I was previously using ipvlan):

Settings > Network Settings > eth0 > Enable Bonding = Yes or No, either work with this solution

Settings > Network Settings > eth0 > Enable Bridging = No (this will automatically enable macvlan)

Settings > Docker > Host access to custom networks = Enabled

 

And these did not help. I followed the "Complex Network Setup" portion of this guide and currently have these settings.

 

My current settings are as follows:

Use NAT = No

Settings > Network Settings > eth0 > Enable Bonding = Yes

Settings > Network Settings > eth0 > Enable Bridging = Yes

Settings > Docker > Host access to custom networks = Enabled

I've been trying to figure this out for a few weeks now, and I normally don't like asking but can someone please help me troubleshoot this?

*Double check unraids ip routes...

It sounds like your WireGuard VPN setup is experiencing routing issues due to the combination of the power loss and Ubiquiti router update. Let’s go step by step to troubleshoot and resolve the problem:

 

Verify Ubiquiti Router Configuration

The router update likely reset some settings. Double-check the following:

Port Forwarding:

Ensure the WireGuard port (usually 51820) is correctly forwarded to your Unraid server’s current static IP address. Verify both UDP and the correct internal IP.

Firewall Rules:

Ensure your Ubiquiti router isn’t blocking WireGuard traffic. Check any custom firewall rules or policies and temporarily disable them for testing.

Routing for WireGuard Subnet:

Add a static route in your Ubiquiti router if the WireGuard subnet (e.g., 10.x.x.x) isn’t accessible.For example:

Destination: 10.x.x.0/24

Gateway: Your Unraid server's IP

This static route ensures packets destined for the VPN subnet are directed back to the Unraid server.

 

Verify WireGuard Configurations

Peer Configurations:

Confirm your WireGuard client configuration has the correct AllowedIPs. For instance:

If you need full tunnel (all traffic through VPN): AllowedIPs = 0.0.0.0/0, ::/0

If you only need specific subnets (split tunnel): AllowedIPs = 192.168.x.0/24, 10.x.x.0/24

Persistent Keepalive:

Ensure PersistentKeepalive = 25 is set in the client config, as this helps maintain NAT traversal when the connection is idle.

 

Check Unraid Network Configuration

Docker Network Settings:

If you’ve switched from ipvlan to macvlan, this may require reconfiguring Docker’s custom networks:

Go to Settings > Docker and recreate any custom networks used by containers relying on WireGuard.

Routing Table

On the Unraid terminal, check if WireGuard routes exist by running

ip route

Ensure routes for the WireGuard subnet (10.x.x.0/24) and the external gateway are present.

Enable NAT if Needed:

If the Unraid server isn’t routing traffic properly, try enabling NAT for the WireGuard interface:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Replace eth0 with your server’s primary network interface if different.

Bridge Mode:

If using bridging, ensure the Docker custom networks are set correctly. Try disabling bridging temporarily to see if it resolves the issue.

 

 

Test WireGuard Functionality

Ping Internal and External IPs:

From a container using the WireGuard tunnel, try:

ping 8.8.8.8   # Tests if the container can access the internet
ping unraid.local # Replace with your Unraid server’s hostname/IP to test internal routing

If internal works but external does not, it’s likely a NAT or gateway issue.

Check Traffic Flow:

Monitor WireGuard traffic in Unraid by checking the logs

cat /var/log/wireguard/wg0.log

 

*Look for handshake failures or routing-related messages.

 

Simplify the Setup for Testing

To isolate the issue, try the following:

Temporary NAT Setup:

Enable NAT on WireGuard (Use NAT = Yes) and test. If it works, the issue is likely with routing on your Ubiquiti router.

Direct Container Connection:

Test a single container (e.g., Jellyfin) using the host network instead of a custom network to rule out Docker network issues.

 

Restart Key Services

#docekr:
/etc/rc.d/rc.docker restart
#Unriad NEtwroking:
/etc/rc.d/rc.network restart

WireGuard:

Disable and re-enable the WireGuard tunnel from the Unraid GUI.

 

Update Firmware/Software

Ensure your Ubiquiti router is running the latest stable firmware, as there might be bug fixes affecting VPN functionality.

Update Unraid, Dynamix VPN Manager, and WireGuard plugin to the latest versions.

8. Collect Logs for Further Troubleshooting

If the above steps don’t resolve the issue:

Collect diagnostic logs in Unraid (Tools > Diagnostics) and share relevant logs from:

/var/log/wireguard/

/var/log/docker.log

Check Ubiquiti router logs for blocked packets or routing issues