hostapd compatible

Barry Cisna brcisna at
Sat Apr 2 12:42:48 UTC 2022

Hello All,

Have been struggling trying to get WireGuard set for a peer(B) that
also acts as an ltsp server to diskless clients,,running dnsmasq,
which iis connected to a Google Cloud instance WireGaurd

PeerA - Google Cloud Debian Bullseye static ip
PeerB - local Debian Bullseye behind CGNAT  cellular connection

PeerB uses a cellular modem for internet wwan0 and a bridged interface
for supplying dhcp to thin clients via dnsmasq
bridge0 = ethernet & wlan,which in turns uses hostapd to run the wlan
in master mode AP.
After many hours of iptabling,multiple wired clients works fine
through dnsmasq and internet through PeerB.
BUT the wireless clients are super slow and most web pages never
complete. Have tried all mtu settings on PeerA and PeerB and now see
no fragmented hits in wireshark.
It almost seems as though the MTU on the wlan interface needs to be
changed, but never see any fragment hits on wireshark on the wified
 Do NOT have stp enabled on the bridge,Have not tried enabling stp.
MTU 1460 seems to be the best setting for this setup,,but have read on
many tuts using GCloud instance should be 1360. This MTU 1360 made web
pages almost unusable for this setup.


PrivateKey = <>
Address =
#Address =
#DNS =
MTU = 1460
#PostUp = ip6tables -t nat -A POSTROUTING -o wwan0 -j MASQUERADE
#PostDown = ip6tables -t nat -A POSTROUTING -o wwan0 -j MASQUERADE

# PostUp = iptables -A FORWARD -i wg0client2 -j ACCEPT
# PostDown = iptables -t nat -A POSTROUTING -o wwan0 -j MASQUERADE

# Google Cloud Server
 PublicKey = <.>
 Endpoint = 35.226.##.###:51820
 AllowedIPs =, ::/0 # Forward all traffic to server


 auto bridge0
auto wlp3s0
auto enp2s0
iface wlp3s0 inet manual
iface enp2s0 inet manual
#iface wlp3s0 inet6 manual
#iface enp2s0 inet6 manual
#bridge setup
iface bridge0 inet static
bridge_ports enp2s0 wlp3s0
post-up iptables-restore < /etc/iptables.up.rules
post-up ip6tables-restore < /etc/ip6tables.up.rules
# gateway
# bridge_stp on


More information about the WireGuard mailing list