I'm looking for some help to get my PiVPN running correctly.

I have PiHole installed on a Raspberry Pi and I'm now trying to install PiVPN on it to be able to make use of the ad blocking while I'm on the go.

I've followed the PiVPN installation guide (I've tried with both WireGuard and OpenVPN) but I can't connect to the VPN. The installation seems to go fine and when running pivpn -d it says OK for all "Self checks".

I've now installed PiVPN with WireGuard on port 51820, which I've also forwarded in my router to my Raspberry Pi.

On the question "We have detected a Pi-hole installation, do you want to use it as the DNS server for the VPN, so you get ad blocking on the go?" I said Yes.

I don't get a static IP from my ISP so I've registered a domain on https://www.duckdns.org/ that I've entered as the domain on the question "Will clients use a Public IP or DNS Name to connect to your server"

In the PiHole settings I've enabled "Permit all origins" in the DNS tab.

On my Android phone I've download the WireGuard app and scanned the QR code generated from pivpn -qr. When trying to connect to the VPN on the phone the app doesn't say that it fail but I can see that on the Transfer row it says rx:0B. I've also tried viewing a website but nothing shows up. My phone is using mobile data, not the WiFi.

When running tcdump on the Raspberry while I'm trying to connect I can see data being received , but no data seems to be sent back from the server:

root@raspberrypi:/home/pi# tcpdump -n -i eth0 udp port 51820
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
19:38:24.847693 IP > UDP, length 148
19:38:30.118143 IP > UDP, length 148
19:38:35.437406 IP > UDP, length 148
19:38:40.727581 IP > UDP, length 148

What am I missing? All help is greatly appreciated!

Below is some configs and outputs:

pi@raspberrypi:~ $ pivpn -c
::: Connected Clients List :::
Name               Remote IP                Virtual IP      Bytes Received      Bytes Sent      Last Seen
g-mobil        8,0KiB              5,0KiB          (not yet)
::: Disabled clients :::

/etc/wireguard/wg0.conf (I've replaced some content with ******):

PrivateKey = ******
Address =
MTU = 1420
ListenPort = 51820
### begin g-mobil ###
PublicKey = ******
PresharedKey = ******
AllowedIPs =
### end g-mobil ###

/etc/wireguard/configs/g-mobil.conf (I've replaced some content with ******):

PrivateKey = ******
Address =

PublicKey = ******
PresharedKey = ******
Endpoint = ******.duckdns.org:51820
AllowedIPs =, ::0/0

iptables: (I'm a noob when it comes to this so I'm not sure what this is or what the config should look like. I've added some lines from a guide I found online so I'm not sure if this looks alright)

pi@raspberrypi:~ $ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere             udp dpt:51820 /* wireguard-input-rule */
ACCEPT     udp  --  anywhere             anywhere             state NEW udp dpt:openvpn
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             ctstate RELATED,ESTABLISHED /* wireguard-forward-rule */
ACCEPT     all  --          anywhere             /* wireguard-forward-rule */
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere 




#; Pi-hole FTL config file
#; Comments should start with #; to avoid issues with PHP and bash reading this file
#delay added by me, hoping it would fix my issues
#next line also added by me

3 Answers 3


Your listening port on the interface (e.g client) is probably not set to the port 51820 and it’s probably on automatic. So, you probably have to go to the wireguard app on your phone, click the profile and edit the config. Then, change the listening port to 51820 (or the port you have specified in the port forwarding).

  • Thanks but the port is correct. I can see the correct port in the app as well as incoming requests to port 51820 when using tcpdump.
    – gusjap
    Commented Jan 24, 2022 at 6:05

One thing to be mindful of is that wireguard doesn't return errors if you are sending something funny. So, for example, if you have a key wrong your UDP packets are just dropped. You will see something similar with PSK or allowed IP as well.

I don't know anything about PiVPN but in the pure wireguard world, I would suggest you connect your client and enable logging on the wireguard server:

echo "module wireguard +p" > /sys/kernel/debug/dynamic_debug/control

Run tcpdump at both ends of your link and on the server ping your client:


Check dmesg on the server to see the wireguard messages. Hopefully it will point you to the problem.

You can then do the reverse (ping etc.

If that works then you have a more general routing problem (perhaps NAT?) rather than a VPN issue.

Don't forget to turn off the extra logging when done with:

echo "module wireguard -p" > /sys/kernel/debug/dynamic_debug/control

I have had similar and decided the DNS server was the problem-when I changed to my router’s 192.68.1.., in /etc/pivpn/wireguard/setupVars.conf and recreated the config files and reinstalled them it seems to work. Presumably just google being fussy 😩

  • More likely Google just being wrongly specified. The addresses for their DNS service are and
    – Dougie
    Commented Mar 17 at 10:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.