WireGuard: Handshake for peer 1 (203.0.113.10:51820) did not complete after 5 seconds, retrying (try 2)

What it means

The client sends handshake initiations to the server and gets no answer. The tunnel cannot come up.

Why it happens

• The server’s UDP port is closed (firewall, cloud security group) or the endpoint address/port is wrong.
• The keys do not pair: the server has a different public key for this peer, or the client uses a wrong server public key.
• UDP is blocked or throttled by the network (some mobile and corporate networks).

How to fix it

1. Open the UDP port on the server and at the cloud provider; check Endpoint = host:port.
2. Compare keys: the client’s public key must be the [Peer] PublicKey on the server, and vice versa (wg show).
3. Try another network (mobile data); if it works there, UDP is filtered on the first one.

Useful tools

WireGuard config generator · Port check · NAT type test

Other WireGuard errors

• Packet has unallowed src IP (10.0.0.7) from peer 3 (198.51.100.20:43210)
• RTNETLINK answers: Operation not supported / Unable to access interface: Protocol not supp
• /usr/bin/wg-quick: line 32: resolvconf: command not found
• Key is not the correct length or format: `abc…`
• Unable to modify interface: Address already in use
• Name or service not known: `vpn.example.com:51820' / Configuration parsing error