[GH-ISSUE #5212] WireGuard handshake timed out #10132

Open
opened 2026-08-05 01:24:46 -04:00 by saavagebueno · 0 comments
Owner

Originally created by @mrlhansen on GitHub (Jan 29, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5212

Originally assigned to: @pappz on GitHub.

Describe the problem

Since v0.64.1 I am having problems with handshake timeouts. Version 0.64.0 and earlier are working flawlessly. I am seeing the following in the /var/log/netbird/client.log file.

2026-01-29T13:28:44+01:00 WARN [peer: xxxyyy] client/internal/peer/wg_watcher.go:127: WireGuard handshake timed out: 2026-01-29 13:28:14 +0100 CET
2026-01-29T13:28:44+01:00 WARN [peer: xxxyyy] client/internal/peer/conn.go:585: WireGuard handshake timeout detected, closing current connection
2026-01-29T13:28:44+01:00 INFO [peer: xxxyyy] client/internal/peer/conn.go:443: ICE disconnected, do not switch to Relay. Reset priority to: None
2026-01-29T13:28:44+01:00 INFO [peer: xxxyyy] client/internal/peer/handshaker.go:159: sending offer with serial: 8763486fad
2026-01-29T13:28:46+01:00 INFO [peer: xxxyyy] client/internal/peer/handshaker.go:159: sending offer with serial: 8763486fad
2026-01-29T13:28:46+01:00 INFO [peer: xxxyyy] client/internal/peer/conn.go:280: OnRemoteAnswer, priority: None, status ICE: Disconnected, status relay: Disconnected
2026-01-29T13:28:46+01:00 INFO [peer: xxxyyy] client/internal/peer/handshaker.go:105: received answer, running version 0.64.0, remote WireGuard listen port 51820, session id: 97c73c6dfb
2026-01-29T13:28:46+01:00 INFO [peer: xxxyyy] client/internal/peer/worker_relay.go:49: Relay is not supported by remote peer
2026-01-29T13:28:46+01:00 INFO [peer: xxxyyy] client/internal/peer/worker_relay.go:49: Relay is not supported by remote peer
2026-01-29T13:29:07+01:00 INFO [peer: xxxyyy] client/internal/peer/handshaker.go:159: sending offer with serial: b1bc980c8b

This output is from the macOS client. The peer it's connecting to is running on Linux.

Are you using NetBird Cloud?

Self-hosted Netbird

NetBird version

0.64.2

Is any other VPN software installed?

Installed, yes, but not running.

Debug output

Peers detail:
 peer02.anon-KJfRk.domain:
  NetBird IP: 100.69.0.136
  Public key: xxxyyy
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): host/host
  ICE candidate endpoints (Local/Remote): 100:::51820/100::1:51820
  Relay server address:
  Last connection update: 6 minutes, 31 seconds ago
  Last WireGuard handshake: 1 minute, 12 seconds ago
  Transfer status (received/sent) 26.6 KiB/11.8 KiB
  Quantum resistance: false
  Networks: 10.10.0.0/16, 10.20.0.0/16
  Latency: 48.244625ms

 peer01.anon-KJfRk.domain:
  NetBird IP: 100.69.247.139
  Public key: xxxyyy
  Status: Connecting
  -- detail --
  Connection type: -
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 18 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 46.508708ms

Events:
  [WARNING] DNS (ec748201-5371-4d83-bf57-e4a6be0ad52a)
    Message: All upstream servers failed (probe failed)
    Time: 7 minutes, 25 seconds ago
    Metadata: upstreams: 10.10.10.10:53
  [WARNING] DNS (774b19db-6e74-45bc-a4d3-a6c92b35ca9b)
    Message: All upstream servers failed (probe failed)
    Time: 7 minutes, 25 seconds ago
    Metadata: upstreams: 10.10.10.10:53
  [WARNING] DNS (77655df5-4a31-47b4-a317-2a6f7a1fd3dc)
    Message: All upstream servers failed (probe failed)
    Time: 7 minutes, 25 seconds ago
    Metadata: upstreams: 10.10.10.10:53
  [INFO] SYSTEM (7594a1de-b6aa-4256-bcee-12f081661aa9)
    Message: Network map updated
    Time: 7 minutes, 25 seconds ago
OS: darwin/arm64
Daemon version: 0.64.2
CLI version: 0.64.2
Profile: default
Management: Connected to https://netbird.anon-MQXC9.domain:443
Signal: Connected to https://netbird.anon-MQXC9.domain:443
Relays:
Nameservers:
  [10.10.10.10:53] for [.] is Available
FQDN: xxxx.anon-KJfRk.domain
NetBird IP: 100.69.3.60/16
Interface type: Userspace
Quantum resistance: false
Lazy connection: false
SSH Server: Disabled
Networks: -
Peers count: 1/2 Connected
Originally created by @mrlhansen on GitHub (Jan 29, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5212 Originally assigned to: @pappz on GitHub. **Describe the problem** Since v0.64.1 I am having problems with handshake timeouts. Version 0.64.0 and earlier are working flawlessly. I am seeing the following in the `/var/log/netbird/client.log` file. ```text 2026-01-29T13:28:44+01:00 WARN [peer: xxxyyy] client/internal/peer/wg_watcher.go:127: WireGuard handshake timed out: 2026-01-29 13:28:14 +0100 CET 2026-01-29T13:28:44+01:00 WARN [peer: xxxyyy] client/internal/peer/conn.go:585: WireGuard handshake timeout detected, closing current connection 2026-01-29T13:28:44+01:00 INFO [peer: xxxyyy] client/internal/peer/conn.go:443: ICE disconnected, do not switch to Relay. Reset priority to: None 2026-01-29T13:28:44+01:00 INFO [peer: xxxyyy] client/internal/peer/handshaker.go:159: sending offer with serial: 8763486fad 2026-01-29T13:28:46+01:00 INFO [peer: xxxyyy] client/internal/peer/handshaker.go:159: sending offer with serial: 8763486fad 2026-01-29T13:28:46+01:00 INFO [peer: xxxyyy] client/internal/peer/conn.go:280: OnRemoteAnswer, priority: None, status ICE: Disconnected, status relay: Disconnected 2026-01-29T13:28:46+01:00 INFO [peer: xxxyyy] client/internal/peer/handshaker.go:105: received answer, running version 0.64.0, remote WireGuard listen port 51820, session id: 97c73c6dfb 2026-01-29T13:28:46+01:00 INFO [peer: xxxyyy] client/internal/peer/worker_relay.go:49: Relay is not supported by remote peer 2026-01-29T13:28:46+01:00 INFO [peer: xxxyyy] client/internal/peer/worker_relay.go:49: Relay is not supported by remote peer 2026-01-29T13:29:07+01:00 INFO [peer: xxxyyy] client/internal/peer/handshaker.go:159: sending offer with serial: b1bc980c8b ``` This output is from the macOS client. The peer it's connecting to is running on Linux. **Are you using NetBird Cloud?** Self-hosted Netbird **NetBird version** `0.64.2` **Is any other VPN software installed?** Installed, yes, but not running. **Debug output** ```text Peers detail: peer02.anon-KJfRk.domain: NetBird IP: 100.69.0.136 Public key: xxxyyy Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): host/host ICE candidate endpoints (Local/Remote): 100:::51820/100::1:51820 Relay server address: Last connection update: 6 minutes, 31 seconds ago Last WireGuard handshake: 1 minute, 12 seconds ago Transfer status (received/sent) 26.6 KiB/11.8 KiB Quantum resistance: false Networks: 10.10.0.0/16, 10.20.0.0/16 Latency: 48.244625ms peer01.anon-KJfRk.domain: NetBird IP: 100.69.247.139 Public key: xxxyyy Status: Connecting -- detail -- Connection type: - ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 18 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 46.508708ms Events: [WARNING] DNS (ec748201-5371-4d83-bf57-e4a6be0ad52a) Message: All upstream servers failed (probe failed) Time: 7 minutes, 25 seconds ago Metadata: upstreams: 10.10.10.10:53 [WARNING] DNS (774b19db-6e74-45bc-a4d3-a6c92b35ca9b) Message: All upstream servers failed (probe failed) Time: 7 minutes, 25 seconds ago Metadata: upstreams: 10.10.10.10:53 [WARNING] DNS (77655df5-4a31-47b4-a317-2a6f7a1fd3dc) Message: All upstream servers failed (probe failed) Time: 7 minutes, 25 seconds ago Metadata: upstreams: 10.10.10.10:53 [INFO] SYSTEM (7594a1de-b6aa-4256-bcee-12f081661aa9) Message: Network map updated Time: 7 minutes, 25 seconds ago OS: darwin/arm64 Daemon version: 0.64.2 CLI version: 0.64.2 Profile: default Management: Connected to https://netbird.anon-MQXC9.domain:443 Signal: Connected to https://netbird.anon-MQXC9.domain:443 Relays: Nameservers: [10.10.10.10:53] for [.] is Available FQDN: xxxx.anon-KJfRk.domain NetBird IP: 100.69.3.60/16 Interface type: Userspace Quantum resistance: false Lazy connection: false SSH Server: Disabled Networks: - Peers count: 1/2 Connected ```
saavagebueno added the triage-needed label 2026-08-05 01:24:46 -04:00
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#10132