Handshake succeeds, but HTTPS to non-Cloudflare sites times out on Linux

Summary

wgcf generates a WireGuard profile successfully and the tunnel handshakes, but HTTPS traffic to non-Cloudflare sites consistently times out on Linux.

The tunnel is not completely dead:

• WireGuard handshake succeeds
• DNS resolution works
• ICMP ping through the tunnel works
• Cloudflare HTTPS works in some tests
• Google/GitHub HTTPS time out consistently

Official Android 1.1.1.1/WARP works on the same network.

Environment

• OS: Linux Mint 22 / Ubuntu 24.04 base kernel 7.0

• Kernel: 7.0.0-28-generic

• Network: Wi-Fi, same network where Android official WARP works

• wgcf account type: free

• wgcf generated a new account/profile during testing

• dnscrypt-proxy is used locally at 127.0.0.1, but the same behavior appears with direct curl -4 tests

Tested with:

• wgcf + wg-quick (kernel WireGuard)
• sing-box 1.13.18 WireGuard endpoint with real config.client_id-derived reserved
• IPv4 and IPv6 endpoints
• direct DNS (dnscrypt stopped) and dnscrypt
• BBR and CUBIC, MTU 1420 and 1280

Result in all cases:

• Handshake OK
• Cloudflare trace: warp=on
• example.com (Cloudflare): HTTP 200
• google.com, github.com: timeout

Handshake succeeds, Cloudflare sites work, but external HTTPS times out (tested: wg-quick, sing-box, real reserved)

What works

After wg-quick up wgcf:

interface: wgcf endpoint: 162.159.192.1:2408 latest handshake: 6-8 seconds ago transfer: some KiB received/sent Ping works: ping -c 3 1.1.1.1

0% packet loss

DNS works: dig @127.0.0.1 google.com +short

returns Google IPs

Cloudflare HTTPS sometimes works: curl -4 -m 10 -I -sS https://speed.cloudflare.com | head -5 HTTP/1.1 200 OK What fails Google and GitHub consistently time out over the wgcf tunnel: curl -4 -m 10 -I -sS https://www.google.com curl: (28) Connection timed out after 10002 milliseconds

curl -4 -m 10 -I -sS https://github.com curl: (28) Connection timed out after 10002 milliseconds When the tunnel is down, the same tests work immediately: sudo wg-quick down wgcf

curl -4 -I https://www.google.com

HTTP/2 200

curl -4 -I https://github.com

HTTP/2 200

Things tested

1. New wgcf account/profile A completely new wgcf register && wgcf generate profile shows the same behavior.

2. Multiple endpoints Tested endpoints: 162.159.192.1:2408 162.159.193.1:2408 162.159.195.1:2408 engage.cloudflareclient.com:2408 Results:

• 162.159.192.1: handshake works, Google/GitHub timeout
• 162.159.193.1: no working tunnel
• 162.159.195.1: handshake works, Google/GitHub timeout
• engage.cloudflareclient.com: resolves/uses Cloudflare endpoint, same timeout behavior

1. MTU Tested: MTU 1420 MTU 1280 No change. Google/GitHub still timeout.

2. TCP congestion control Tested: net.ipv4.tcp_congestion_control = bbr net.ipv4.tcp_congestion_control = cubic No change.

3. IPv4-only curl All failing tests use curl -4, so this does not appear to be an IPv6-only issue.

4. AllowedIPs split workaround Tested excluding 160.0.0.0/5 from AllowedIPs: AllowedIPs = 0.0.0.0/1, 128.0.0.0/3, 192.0.0.0/2 This did not fix the issue. Google/GitHub still time out. Example test output === WG === endpoint: 162.159.192.1:2408 latest handshake: 8 seconds ago transfer: 704 B received, 7.47 KiB sent

=== CLOUDFLARE TRACE === curl: (28) Connection timed out after 10002 milliseconds

=== HTTPS TESTS === curl -4 -m 10 -I https://speed.cloudflare.com

sometimes HTTP/1.1 200 OK

curl -4 -m 10 -I https://www.google.com

curl: (28) Connection timed out

curl -4 -m 10 -I https://github.com

curl: (28) Connection timed out

Question Is this expected behavior due to Cloudflare WARP abuse-prevention / region restrictions, or is there another wgcf-specific workaround for the case where:

• handshake succeeds,
• ICMP works,
• DNS works,
• but HTTPS to non-Cloudflare destinations times out?

Thanks.