WireGuard: Handshake did not complete after 5 seconds Networking Origin: Network OSI layer 6 · Presentation Last updated 5 Nov 2026

Networking: Handshake for peer did not complete after 5 seconds, retrying (try 2) — WireGuard tunnel never establishes

The WireGuard peers can't complete the cryptographic handshake, so no traffic flows.

Exact message you may see Handshake for peer did not complete after 5 seconds, retryingwireguard: Handshake did not completeWireGuard no handshakelatest handshake neverHandshake for peer 1 did not complete after 5 seconds
Explore the map of this error Full error map →
Seen on: Linux Networking

Meaning

Verify both public keys, the peer's endpoint and UDP port, that the server's firewall/NAT allows UDP (default 51820), and that AllowedIPs and clocks are sane. latest handshake missing in wg show means the handshake never succeeded; also lower the MTU if only large packets fail.

Common causes

  • Wrong public key or private key mismatch
  • Endpoint IP/port wrong or UDP port blocked
  • Firewall/security group missing the UDP rule
  • NAT/CGNAT with no persistent keepalive
  • Wrong or missing AllowedIPs

⚡ Quick fix

  1. Compare public keys on both sides
  2. Open UDP 51820 and set PersistentKeepalive = 25 behind NAT
  3. Check wg show for "latest handshake"

Detailed fix by platform

Linux

  1. bash
    sudo wg show
sudo tcpdump -ni any udp port 51820

How to diagnose

  1. Keys — Matching?
  2. UDP port — Reachable?
  3. latest handshake — Present?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

4-way handshake timeout / Incorrect password — Networking: wlan0: WPA: 4-way handshake failed - pre-shared key may be incorrect / WRONG_KEY (Networking)4-way handshake timeo…Connections hang on large transfers (PMTU black hole) — Networking: SSH/HTTPS connects but hangs on large data — path MTU discovery black hole (Networking)Connections hang on l…Frag needed and DF set (ICMP type 3 code 4) — Networking: ping: local error: message too long, mtu=1500 / Packet needs to be fragmented but DF set (Networking)Frag needed and DF se…ICMP Destination unreachable (Port unreachable) — Networking: ICMP Destination unreachable (Port unreachable) — UDP packet sent to a port where nothing is listening (Networking)ICMP Destination unre…Internal hostnames fail on VPN (split DNS / systemd-resolved) — Networking: VPN connected but internal names like db.corp.local don't resolve — split DNS / 127.0.0.53 stub resolver not using the VPN DNS (Networking)Internal hostnames fa…NO_PROPOSAL_CHOSEN (IPsec/IKE) — Networking: IKE: received NO_PROPOSAL_CHOSEN — IPsec peers can't agree on encryption, hash or DH group (Networking)NO_PROPOSAL_CHOSEN (I…UDP RcvbufErrors / packet receive errors — Networking: netstat -su: packet receive errors, receive buffer errors — UDP datagrams dropped by a full socket buffer (Networking)UDP RcvbufErrors / pa…VPN connected but internal subnets unreachable — Networking: VPN is connected but I can't reach the internal network — missing routes, split tunnel or overlapping subnets (Networking)VPN connected but int…WireGuard…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.