WireGuard握手期间Mac客户端周期性断网的故障排查求助

大家好，我遇到了一个非常奇怪的WireGuard问题，想请各位帮忙分析一下：

我在Debian主机上用linuxserver的容器跑WireGuard服务端，客户端是我的MacBook。平时连接速度、访问内部服务都没问题，但每隔10-20分钟就会出现一次异常：握手触发后我的Mac立刻失去互联网访问，但仍然能连到服务器的内部服务，要等16秒左右下一次握手完成后，互联网才会恢复。

我观察了服务器端的情况：当下载torrent这类高负载操作时，会有很多kworker/1:1-wg-crypt-wg0进程在运行，断网发生时这些进程会被全部杀掉——但服务器和WireGuard服务并没有重启，因为内部服务依然能访问，而且其他设备的网络也正常，问题肯定出在WireGuard本身，不管是轻量浏览还是大流量下载都会触发这个问题。

我在服务器上持续ping Google，断网期间服务器的ping完全正常，只有Mac这边ping不通，说明不是VPS的网络问题。

接下来是我的配置文件：

服务端配置 #

[Interface]
# Core settings
PrivateKey = xxxxx
Address = 10.6.0.0/24

# Misc. settings (optional)
ListenPort = 51820

# Interface hooks (optional)
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth+ -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth+ -j MASQUERADE
MTU = 1400

#
# Peers
#
[Peer]
PublicKey = xxxxx
PresharedKey = xxxx
AllowedIPs = 10.6.0.2/32
PersistentKeepalive = 16

Mac客户端配置 #

[Interface]
# Core settings
PrivateKey = xxxxx
Address = 10.6.0.2/32

# Misc. settings (optional)
DNS = xxxxx
MTU = 1400

[Peer]
PublicKey = xxxx
Endpoint = xxxx:51820
AllowedIPs = 10.6.0.1/32, 0.0.0.0/0
PresharedKey = xxxx
PersistentKeepalive = 16

更新1：服务端与客户端日志 #

我加载了wireguard模块后拿到了服务端日志：

Mar 16 13:55:54 [ +2.156106] wireguard: wg0: Receiving handshake initiation from peer 315 (:16235)
Mar 16 13:55:54 [ +0.000003] wireguard: wg0: Sending handshake response to peer 315 ()
Mar 16 13:55:54 [ +0.000165] wireguard: wg0: Keypair 10604 destroyed for peer 315
Mar 16 13:55:54 [ +0.000002] wireguard: wg0: Keypair 10606 created for peer 315
Mar 16 13:56:10 [ +2.451426] wireguard: wg0: Receiving handshake initiation from peer 315 ()
Mar 16 13:56:10 [ +0.000003] wireguard: wg0: Sending handshake response to peer 315 ()
Mar 16 13:56:10 [ +0.000185] wireguard: wg0: Keypair 10605 destroyed for peer 315
Mar 16 13:56:10 [ +0.000001] wireguard: wg0: Keypair 10607 created for peer 315
Mar 16 13:56:10 [ +0.161195] wireguard: wg0: Receiving keepalive packet from peer 315 ()

同时Mac客户端ping Google的日志显示，两次握手之间正好是断网时间：

Mar 16 10:55:54 64 bytes from : icmp_seq=187 ttl=108 time=161.723 ms
Mar 16 10:55:56 Request timeout for icmp_seq 188
...（中间连续超时）
Mar 16 10:56:11 Request timeout for icmp_seq 203
Mar 16 10:56:11 64 bytes from : icmp_seq=204 ttl=108 time=161.172 ms

更新2：客户端verbose日志 #

我在Mac上执行sudo LOG_LEVEL=verbose wg show拿到了更详细的客户端日志，发现了关键信息：

服务端断网前后的日志：

~INTERNET GOES DOWN HERE~
Mar 16 16:47:09 [ +0.393175] wireguard: wg0: Receiving handshake initiation from peer 315 ()
Mar 16 16:47:09 [ +0.000003] wireguard: wg0: Sending handshake response to peer 315 ()
Mar 16 16:47:09 [ +0.000175] wireguard: wg0: Keypair 10790 destroyed for peer 315
Mar 16 16:47:09 [ +0.000001] wireguard: wg0: Keypair 10793 created for peer 315
Mar 16 16:47:09 [ +0.280476] wireguard: wg0: Receiving keepalive packet from peer 315 ()
~INTERNET GOES BACK UP RIGHT AFTER THE NEXT LINES~
Mar 16 16:47:25 [ +1.391045] wireguard: wg0: Receiving handshake initiation from peer 315 ()
Mar 16 16:47:25 [ +0.000003] wireguard: wg0: Sending handshake response to peer 315 ()
Mar 16 16:47:25 [ +0.000166] wireguard: wg0: Keypair 10792 destroyed for peer 315
Mar 16 16:47:25 [ +0.000002] wireguard: wg0: Keypair 10794 created for peer 315
Mar 16 16:47:25 [ +0.159758] wireguard: wg0: Receiving keepalive packet from peer 315 ()

客户端日志里出现了一行关键内容：

DEBUG: (utun6) 2023/03/16 13:47:24 peer(xxxx) - Retrying handshake because we stopped hearing back after 15 seconds
DEBUG: (utun6) 2023/03/16 13:47:24 peer(xxxx) - Sending handshake initiation
DEBUG: (utun6) 2023/03/16 13:47:24 peer(xxxx) - Received handshake response
DEBUG: (utun6) 2023/03/16 13:47:24 peer(xxxx) - Sending keepalive packet

这行重试握手的日志正好对应断网的时间点——看起来第一次握手失败了，客户端重试后才恢复，但我搞不懂为什么会这样。

更新3：端口异常发现 #

我在服务器上用watch wg show all持续监控，发现了新的线索：我的Mac客户端在正常连接时的端口是<my-ip>:16918，但断网发生时，服务端收到的握手请求来自另一个端口（比如16235）：

Mar 16 18:17:19 [ +1.217668] wireguard: wg0: Receiving handshake initiation from peer 318 (:16235)
Mar 16 18:17:19 [ +0.000004] wireguard: wg0: Sending handshake response to peer 318 (:16235)
Mar 16 18:17:19 [ +0.000191] wireguard: wg0: Keypair 10893 destroyed for peer 318
Mar 16 18:17:19 [ +0.000002] wireguard: wg0: Keypair 10896 created for peer 318
Mar 16 18:17:19 [ +0.275182] wireguard: wg0: Receiving keepalive packet from peer 318 (:16235)
Mar 16 18:17:34 [ +0.687921] wireguard: wg0: Receiving handshake initiation from peer 318 (:16918)
Mar 16 18:17:34 [ +0.000004] wireguard: wg0: Sending handshake response to peer 318 (:16918)
Mar 16 18:17:34 [ +0.000250] wireguard: wg0: Keypair 10894 destroyed for peer 318
Mar 16 18:17:34 [ +0.000002] wireguard: wg0: Keypair 10897 created for peer 318
Mar 16 18:17:34 [ +0.164268] wireguard: wg0: Receiving keepalive packet from peer 318 (:16918)

看起来握手请求来自了一个新的端口，服务器会回应这个新端口，但客户端根本没在这个端口监听，这会不会就是断网的原因？

现在我想请教各位，这个问题可能是路由器设置导致的？还是WireGuard的配置问题？应该从哪些方向进一步排查呢？

备注：内容来源于stack exchange，提问作者Lorenzo Piccoli Módolo