[GH-ISSUE #145] AmneziaWG handshake failure (0 B received) on Raspberry Pi 4 (Debian 13 Trixie) with S4 streaming obfuscation #78

New issue

Open

opened 2026-10-13 21:03:21 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-13 21:03:21 +00:00

Owner

Originally created by @igr-noob on GitHub (Jun 8, 2026).
Original GitHub issue: https://github.com/amnezia-vpn/amneziawg-go/issues/145

The same configuration file works flawlessly on Windows 10 (official Amnezia client), but results in 0 B received (no handshake) on Raspberry Pi 4. The server uses advanced streaming obfuscation (S4).

Testing has been performed on both implementations:

amneziawg-go (v0.2.18 compiled from source code)
amneziawg-linux-kernel-module (compiled from source code via DKMS)
Both implementations result in identical behavior: packets are actively being sent (sent counter increases), but absolutely nothing is received (0 B received). Tweaking MTU down to 1280 or disabling kernel rp_filter did not resolve the issue.

Environment:
Device: Raspberry Pi 4
Model BOS: Raspberry Pi OS / Debian 13 (Trixie)
arm64Kernel
version: 6.12.75+rpt-rpi-v8amneziawg-go
version: v0.2.18
amneziawg-tools version: latest master (compiled from source)
Debug logs:

awg output on Raspberry Pi 4:
interface: wg0
public key: (hidden)
listening port: 47831
peer: [SERVER_PUBLIC_KEY]
endpoint: 193.108.116.50:7307
allowed ips: 0.0.0.0/0, ::/0
transfer: 0 B received, 46.51 KiB sent
persistent keepalive: every 25 seconds
awg-quick up wg0 verbose output (when running userspace implementation):
[#] ip link add wg0 type amneziawg
Error: Unknown device type.
[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation.
[#] amneziawg-go wg0
[#] awg setconf wg0 /dev/fd/63
[#] ip -4 address add 100.91.232.170/32 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] awg set wg0 fwmark 51820
[#] ip -4 route add 0.0.0.0/0 dev wg0 table 51820

Steps to reproduce:

Compile amneziawg-go (v0.2.18) and amneziawg-tools on Debian 13 (arm64).
Use a working configuration profile containing advanced obfuscation parameters (Jc, Jmin, Jmax, S1, S2, H1-H4, S3, S4).
Start the tunnel via systemctl start awg-quick@wg0.
Observe 0 B received while the exact same profile works fine on Windows.

Originally created by @igr-noob on GitHub (Jun 8, 2026). Original GitHub issue: https://github.com/amnezia-vpn/amneziawg-go/issues/145 The same configuration file works flawlessly on Windows 10 (official Amnezia client), but results in 0 B received (no handshake) on Raspberry Pi 4. The server uses advanced streaming obfuscation (S4). Testing has been performed on both implementations: 1. amneziawg-go (v0.2.18 compiled from source code) 2. amneziawg-linux-kernel-module (compiled from source code via DKMS) Both implementations result in identical behavior: packets are actively being sent (sent counter increases), but absolutely nothing is received (0 B received). Tweaking MTU down to 1280 or disabling kernel rp_filter did not resolve the issue. Environment: Device: Raspberry Pi 4 Model BOS: Raspberry Pi OS / Debian 13 (Trixie) arm64Kernel version: 6.12.75+rpt-rpi-v8amneziawg-go version: v0.2.18 amneziawg-tools version: latest master (compiled from source) Debug logs: 1. awg output on Raspberry Pi 4: interface: wg0 public key: (hidden) listening port: 47831 peer: [SERVER_PUBLIC_KEY] endpoint: 193.108.116.50:7307 allowed ips: 0.0.0.0/0, ::/0 transfer: 0 B received, 46.51 KiB sent persistent keepalive: every 25 seconds 2. awg-quick up wg0 verbose output (when running userspace implementation): [#] ip link add wg0 type amneziawg Error: Unknown device type. [!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation. [#] amneziawg-go wg0 [#] awg setconf wg0 /dev/fd/63 [#] ip -4 address add 100.91.232.170/32 dev wg0 [#] ip link set mtu 1420 up dev wg0 [#] awg set wg0 fwmark 51820 [#] ip -4 route add 0.0.0.0/0 dev wg0 table 51820 Steps to reproduce: 1. Compile amneziawg-go (v0.2.18) and amneziawg-tools on Debian 13 (arm64). 2. Use a working configuration profile containing advanced obfuscation parameters (Jc, Jmin, Jmax, S1, S2, H1-H4, S3, S4). 3. Start the tunnel via systemctl start awg-quick@wg0. 4. Observe 0 B received while the exact same profile works fine on Windows.

bsakaguchi commented

2026-10-13 21:03:22 +00:00

Author

Owner

@igr-noob commented on GitHub (Jun 9, 2026):

Проблема решена сменой конфигурационного файла на сервер другой страны. Возможно это как-то связано, но у сервера, который заработал, S4=1, а у того, который работал на Windows, но не работал на RPI4 был S4=3.

@igr-noob commented on GitHub (Jun 9, 2026): Проблема решена сменой конфигурационного файла на сервер другой страны. Возможно это как-то связано, но у сервера, который заработал, S4=1, а у того, который работал на Windows, но не работал на RPI4 был S4=3.

bsakaguchi referenced this issue

2026-10-13 21:03:53 +00:00

[PR #78] [MERGED] Sync with Major Upstream changes #130