Wireguard keepalives stops working when device is put to sleep (screen turned off) (clone of #3401)

Operating system

Android

System version

16

Installation type

sing-box for Android Graphical Client

If you are using a graphical client, please provide the version of the client.

All versions

Version

Description

This is a clone of the closed ticket https://github.com/SagerNet/sing-box/issues/3401.

I am using the stock Android firmware on pixel 9 so not a custom rom or anything non-standard.
As requested, will provide the reproduction steps with a config below.

This is not related to some custom rom bug but rather looks like a bug on the golang compiler itself. As mentioned on the linked ticket (https://github.com/celzero/rethink-app/issues/2170).

Please note that this does not happen on the official wireguard app which seem to be build with a patched golang compiler to prevent it from ignoring the time spent during the device asleep (the patch to switch to CLOCK_BOOTTIME instead of CLOCK_MONOTONIC) so it works there but I did not see it working as expected on any other wireguard capable app.

Please take the time to go through the discussion on the ticket above with details about the golang compiler patch:

https://git.zx2c4.com/wireguard-android/tree/tunnel/tools/libwg-go/goruntime-boottime-over-monotonic.diff?h=1.0.20250531

Reproduction

Create a minimal config with a wireguard endpoint wihth keepalive enabled. No inbound traffic is expected as we only want to observe keepalives:

{
  "endpoints": [
    {
      "type": "wireguard",
      "tag": "wgtag",
      "mtu": 1380,
      "address": "192.168.202.22/32",
      "private_key": "wg private key",
      "peers": [
        {
          "address": "serverip",
          "port": 12345,
          "public_key": "server public key"
          "allowed_ips": "0.0.0.0/0",
          "persistent_keepalive_interval": 5
        }
      ]
    }
  ],
  "inbounds": [
    {
      "type": "socks",
      "tag": "socks-in",
      "listen": "127.0.0.1",
      "listen_port": 9052
    }
  ],
  "outbounds": [
    {
      "type": "direct",
      "tag": "direct"
    }
  ]
}

On remote endpoint, observe keepalive activity with tcpdump after finding out the source port selected by the sing-box:

#  wg show wg0
.
.
peer: <peer public key>
  endpoint: 192.168.178.1:34952
  allowed ips: 192.168.202.22/32
  latest handshake: 3 minutes, 21 seconds ago
  transfer: 51.15 MiB received, 1.37 GiB sent
.
.

When the screen is turned on, observe that keepalives are coming in every 5 seconds on remote server and they stop when the screen is turned off and resume after turning the screen on again (note: device needs to be unplugged from power supply to trigger sleeping):

# tcpdump -i wlo1 -nl port 34952 -Q in
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on wlo1, link-type EN10MB (Ethernet), snapshot length 262144 bytes
15:52:46.890850 IP 192.168.178.1.34952 > 192.168.1.10.10111: UDP, length 32
15:52:51.930943 IP 192.168.178.1.34952 > 192.168.1.10.10111: UDP, length 32
15:52:56.984632 IP 192.168.178.1.34952 > 192.168.1.10.10111: UDP, length 32
15:53:01.918817 IP 192.168.178.1.34952 > 192.168.1.10.10111: UDP, length 32
.
.  no keepalives when the screen off and then they continue after turning the screen back on
.
.
15:54:01.003613 IP 192.168.178.1.34952 > 192.168.1.10.10111: UDP, length 32
15:54:05.937603 IP 192.168.178.1.34952 > 192.168.1.10.10111: UDP, length 32

Logs

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Start by reviewing the linked issue #3401, the Rethink issue #2170, and WireGuard Android's goruntime-boottime-over-monotonic.diff. Reproduce the problem with the minimal WireGuard configuration, an unplugged Android device, and tcpdump while toggling the screen. Done means persistent keepalives continue during device sleep and resume correctly afterward.