WireGuard Windows troubleshooting for handshake failures and a stuck kill-switch.

Import a tunnel and activate it

1. Install Windows client 1.1.1 from the download page. Match the MSI size before you continue.
2. Open WireGuard. The manager service starts the tray UI if it is not already running.
3. Choose Import tunnel(s) from file.
4. Pick one .conf file, or a .zip that holds several configs.
5. Select the tunnel and press Activate.
6. Confirm the status reads Active, and that the peer shows a latest handshake time plus a transfer count.

1.1.1 rejects a duplicate tunnel name inside that import. Rename and try again. Why a name is rejected

Handshake did not complete after 5 seconds

An April 2021 mailing-list report, on client 0.3.11, showed this line while pings to the peer's public address still worked. Restarting the tunnel cleared it almost every time, across about a dozen Windows machines.

1. Open the Log tab, or run wireguard /dumplog.
2. Find the peer line that says the handshake did not complete after 5 seconds.
3. Allow UDP to the host and port in Endpoint. 51820 is only the usual example.
4. If that peer is behind NAT, set PersistentKeepalive to 25 for that peer. Leave it at 0 when you do not need it.
5. Deactivate the tunnel, then activate it again.
6. If a third-party firewall is installed, pause it only long enough to see whether the handshake then completes, then turn it back on.

The internet stopped when the tunnel dropped

Block untunneled traffic turns on when a tunnel has one peer and that peer's AllowedIPs include 0.0.0.0/0 or ::/0. The block is there so packets do not leak onto the normal connection. It also means a down tunnel feels like no network.

1. Open WireGuard and check whether the tunnel uses 0.0.0.0/0 or ::/0.
2. Press Deactivate. The block is tied to that tunnel.
3. If you want a default route without those firewall rules, replace 0.0.0.0/0 with 0.0.0.0/1 and 128.0.0.0/1.
4. Replace ::/0 with ::/1 and 8000::/1. The editor checkbox switches to this form.
5. Activate again. Test one address that should stay local and one that should use the tunnel.

More on the switch itself is in the Windows client section.

Set PersistentKeepalive only behind NAT

1. Edit the peer in the tunnel.
2. Add PersistentKeepalive = 25 only if this peer must accept new sessions after the path has gone quiet, and it sits behind NAT or a stateful firewall.
3. Leave the value at 0 in every other case. That is the project default.
4. Save, deactivate, and activate so the running service picks up the edit.

Antivirus quarantined wireguard.exe

Do not treat every flag as harmless, and do not treat every flag as proof of malware. Compare the file with the published build first.

1. Read the version and the size on the file table. Client 1.1.1 is 3.3 MB for amd64 and x86, and 2.9 MB for arm64.
2. If the size or the version does not match, do not restore the file. Remove it.
3. If it matches, you are in the class of report from May 2021: McAfee quarantined wireguard.exe after an update, and the exception died on the next hash change.
4. Restore or allow that matching file, then check the exception again after the next update.
5. If the service still will not start, read the Log tab or run wireguard /dumplog.

The no-malware note explains the same limit in plain language.

Ping works, but HTTP does not

A December 2023 report on client 0.5.3 and Windows 10 said G Data support called the combination a fundamental incompatibility. Ping and sometimes SMB worked. HTTP did not. Their workaround was to disable the firewall, connect, then enable it again. They did not promise a product change.

1. Note your client version. That report was 0.5.3, not 1.1.1.
2. Ping a host inside the tunnel. If ping works and the browser does not, the firewall may be treating the tunnel differently from ICMP.
3. Use the off-then-on firewall test only as a short check. Leave the firewall on when the test is over.
4. If 1.1.1 still shows the split, save wireguard /dumplog before you change more settings.

Practices that avoid the common traps

Private keys

Keep them out of email and screenshots. The manager stores an import as .conf.dpapi for Local System.

Split tunnel

List only the LAN in AllowedIPs when the rest of the internet should stay on the normal route.

Full route without the kill-switch

Use the /1 pairs instead of /0. The checkbox in the editor does this.

Before a reinstall

Export tunnels to a zip. The plaintext file is removed after DPAPI encryption.

Pre-shared key

Add one only when the server gave you a 32-byte secret. Otherwise leave the field empty.

Scripts

PreUp, PostUp, PreDown, and PostDown run only if the admin registry key that allows them is set.