# Networking: Handshake for peer did not complete after 5 seconds, retrying (try 2) — WireGuard tunnel never establishes

**Code:** `WireGuard: Handshake did not complete after 5 seconds` · **Category:** Networking · **Seen on:** Linux, Networking

The WireGuard peers can't complete the cryptographic handshake, so no traffic flows.

## Meaning

Verify both public keys, the peer's endpoint and UDP port, that the server's firewall/NAT allows UDP (default 51820), and that `AllowedIPs` and clocks are sane. `latest handshake` missing in `wg show` means the handshake never succeeded; also lower the MTU if only large packets fail.

## Common causes

- Wrong public key or private key mismatch
- Endpoint IP/port wrong or UDP port blocked
- Firewall/security group missing the UDP rule
- NAT/CGNAT with no persistent keepalive
- Wrong or missing AllowedIPs

## Quick fix

1. Compare public keys on both sides
2. Open UDP 51820 and set `PersistentKeepalive = 25` behind NAT
3. Check `wg show` for "latest handshake"

## Detailed fix by platform

### Linux

1. 

```bash
sudo wg show
sudo tcpdump -ni any udp port 51820
```


## How to diagnose

1. **Keys** — Matching?
2. **UDP port** — Reachable?
3. **latest handshake** — Present?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/networking/wireguard-handshake-did-not-complete)