Before replacing hardware or resetting an account, identify exactly when this happens: A WireGuard tunnel works at home but shows no traffic when the phone uses cellular. The aim is to identify the first failing dependency, apply only an appropriate supported change and demonstrate that the original operation works again. The tests are tied to real device behavior and supported configuration, not assumptions about a future error code.
Identify the failure pattern
A WireGuard tunnel works at home but shows no traffic when the phone uses cellular. Record whether this happens every time or only after an update, a network change or a restart. Check whether another device or a second authorized account exhibits the same behavior: that distinction can prevent an unnecessary device-wide repair.
| Observation | What it helps distinguish |
|---|---|
| Exact failure | A WireGuard tunnel works at home but shows no traffic when the phone uses cellular. |
| First comparison | Check current public endpoint and handshake timestamps on both networks. |
| Expected working result | A controlled internal service is reachable through the authorized tunnel on mobile data. |
Technical explanation
CGNAT, endpoint addressing or mobile routing policies may differ. Link-layer association, local IP configuration, DNS, network routing and service availability must be evaluated separately. A connected Wi-Fi icon proves only a radio link. Compare failing and working paths so that ISP, router, switch and client responsibilities do not get confused.
For this WireGuard case, the initial explanation is only a working hypothesis: CGNAT, endpoint addressing or mobile routing policies may differ. Test it against the first observation, check current public endpoint and handshake timestamps on both networks. If those results do not support the suspected cause, compare the second and third checks rather than treating an update or a network connection as proof of a specific fault.
Before making changes
Record the current router setup. Do not disable encryption, expose admin ports or alter ISP account settings simply to make a test pass. Do not turn off firewall protection broadly or expose admin interfaces.
- Record: client IP/subnet, negotiated link details, interface status and the sanitized connection result.
- Make the first check read-only: Check current public endpoint and handshake timestamps on both networks.
- Define success in advance: A controlled internal service is reachable through the authorized tunnel on mobile data.
Step-by-Step Troubleshooting
Beginner: safe initial checks. Advanced: controlled diagnostics and evidence.
Confirm the exact WireGuard symptom
A WireGuard tunnel works at home but shows no traffic when the phone uses cellular. Write down the exact message or observed behavior, the affected product and client IP/subnet, negotiated link details, interface status and the sanitized connection result. Try to reproduce once without changing settings, then note which event or configuration change preceded it.
Perform the first supported check
Check current public endpoint and handshake timestamps on both networks. Record the actual outcome. If it establishes the cause, change only that single variable using the product's documented controls. Keep the initial result available for comparison.
Test the relevant connection or configuration
Verify UDP endpoint port and the profile's allowed IP ranges. Check whether the same result occurs with an authorized second app, device or path where applicable. A comparison is useful only when the underlying account and service are equivalent.
Check the remaining dependency and retest
Use sanitized client and server logs to distinguish timeout from routing failure. Do not turn off firewall protection broadly or expose admin interfaces. After any approved adjustment, repeat the exact operation that failed before and do not continue to destructive procedures without a recovery plan.
Map the failure to its responsible layer
CGNAT, endpoint addressing or mobile routing policies may differ. Gather client IP/subnet, negotiated link details, interface status and the sanitized connection result and compare the working and failing contexts. Decide whether the next evidence should come from the device, client application, identity provider or upstream service.
Compare against a known-good baseline
The discriminating check is: Check current public endpoint and handshake timestamps on both networks. Compare the reported state, version, selected profile and relevant path to one known-working example. Change no more than one factor between trials.
Inspect the exact dependent component
Verify UDP endpoint port and the profile's allowed IP ranges. Next, use sanitized client and server logs to distinguish timeout from routing failure. Collect only redacted log lines or status output that answer this question; do not copy private identifiers or passwords into shared reports.
Make a reversible change and record acceptance
Do not turn off firewall protection broadly or expose admin interfaces. Define the acceptance result as: A controlled internal service is reachable through the authorized tunnel on mobile data. Roll back the test setting if the failure persists. If escalation is needed, provide include router and client models, SSIDs without passwords, subnet summaries, negotiated speeds and anonymized traces.
Decision guide: interpreting the checks
If direct IP access works but hostnames fail, DNS is a likely fault domain. If neither path works, inspect the interface and routes. For this specific setup compare: Check current public endpoint and handshake timestamps on both networks. Verify UDP endpoint port and the profile's allowed IP ranges.
If the first check does not match the expected state, correct that dependency before proceeding. If the first check is normal but the second differs from a working baseline, focus on the second layer instead. If both appear normal, use the third test to distinguish the remaining configuration or device-specific path: Use sanitized client and server logs to distinguish timeout from routing failure.
Common mistakes to avoid
- Do not turn off firewall protection broadly or expose admin interfaces.
- Changing several settings at once makes it impossible to know which adjustment mattered. Repeat the original test after each approved change.
- Assuming an online or connected indicator proves that WireGuard can complete the required operation.
How to verify the fix
A controlled internal service is reachable through the authorized tunnel on mobile data. Re-run the same original action with the same authorized account, device or file, and compare the result with the recorded baseline. Do not declare success just because a status indicator changes color or a test utility finishes without error.
If the issue was intermittent, repeat the relevant WireGuard operation at several short intervals and record times. Then perform a routine reconnect or restart only if it was associated with the original failure. In this case the confirmation is specific: A controlled internal service is reachable through the authorized tunnel on mobile data. If only one configuration works, document that limit and check use sanitized client and server logs to distinguish timeout from routing failure. before extending the conclusion to other users or devices.
Solution Checklist
If the problem continues
If WireGuard continues to show this behavior, stop making broad changes. Do not turn off firewall protection broadly or expose admin interfaces. Restore test settings that did not help, preserve the exact observation from check current public endpoint and handshake timestamps on both networks. and contact the relevant device vendor, service provider or organizational administrator. Include router and client models, SSIDs without passwords, subnet summaries, negotiated speeds and anonymized traces.
Prevent the problem from returning
Keep a note of the exact WireGuard configuration that produced the working result: A controlled internal service is reachable through the authorized tunnel on mobile data. Recheck the same operation after router firmware, ISP configuration, access-point placement and device network changes. For this failure, the quickest future comparison is check current public endpoint and handshake timestamps on both networks. Preserve supported settings and use vendor-approved maintenance rather than accumulating unverified resets.