A week debugging WireGuard through an ER605

Tue, 19 May 2026 09:00:00 +0000

Started the week thinking this would be a two-hour job. A week later I have WireGuard working and a much better understanding of why consumer routers make NAT traversal so much more painful than it needs to be.

The short version: the ER605 does symmetric NAT, which means the source port changes on every outbound connection. WireGuard’s handshake expects the port to stay consistent long enough to complete, and on a symmetric NAT box it often doesn’t. The fix was to set up the WireGuard endpoint on a VPS I already had, and use that as the relay rather than trying to punch through from the ER605 directly.

Network on Matt Ellis

A week debugging WireGuard through an ER605