Wireguard stops after 3 minutes after locking the screen on Android (with solution)

Operating system

Android

System version

Android 15 / CalyxOS 6.10.20

Installation type

sing-box for Android Graphical Client

If you are using a graphical client, please provide the version of the client.

1.12.12

Version

Description

Wireguard stops after 3 minutes of screen lock on Android.
The connection is restored when the screen is unlocked.
The issue does not occur while charging.
Excluding the app (whitelisting it) from Doze does not help.
persistent_keepalive_interval = 25; udp_timeout: 20s or 5m - does not help

Reproduction

{
  "log": {
    "level": "debug"
  },
  "dns": {
    "servers": [
      {
        "type": "udp",
        "tag": "dns-remote",
        "server": "10.1.0.1",
        "server_port": 53,
        "detour": "wg-ep"
      },
      {
        "type": "udp",
        "tag": "dns-direct",
        "server": "10.1.0.1",
        "server_port": 53,
        "detour": "wg-ep"
      },
      {
        "type": "local",
        "tag": "dns-local",
        "detour": "wg-ep"
      },
      {
        "type": "fakeip",
        "tag": "dns-fake",
        "inet4_range": "198.18.0.0/15",
        "inet6_range": "fc00::/18"
      }
    ],
    "independent_cache": true,
    "strategy": "ipv4_only",
    "rules": [
      {
        "disable_cache": true,
        "inbound": ["tun-in"],
        "query_type": ["A", "AAAA"],
        "server": "dns-fake"
      },
      {
        "query_type": ["MX","CNAME","TXT","NS","SOA","PTR","AFSDB","CERT","DHCID","DNAME","HINFO","KEY","KX","LOC","NAPTR","OPENPGPKEY","RRSIG","SIG","SSHFP","TALINK","TLSA","UNSPEC","X25","CAA","CSYNC","SRV","AXFR","MAILB","MAILA","ANY","URI","NINFO","RKEY","TKEY","TSIG","IXFR","OPT"],
        "server": "dns-remote"
      }
    ],
    "final": "dns-remote"
  },
  "inbounds": [
    {
      "type": "tun",
      "tag": "tun-in",
      "address": ["172.19.0.1/28"],
      "mtu": 1500,
      "auto_route": true,
      "strict_route": true,
      "endpoint_independent_nat": true,
      "stack": "gvisor",
      "sniff": true,
      "sniff_override_destination": false
    }
  ],
  "endpoints": [
    {
      "type": "wireguard",
      "tag": "wg-ep",
      "system": false,
      "mtu": 1420,
      "address": ["*/32"],
      "private_key": "*=",
      "peers": [
        {
          "address": "*",
          "port": 443,
          "public_key": "*=",
          "pre_shared_key": "*=",
          "allowed_ips": ["0.0.0.0/0"],
          "persistent_keepalive_interval": 0
        }
      ],
      "udp_timeout": "20s",
      "detour": "vless-middle",
      "connect_timeout": "5s"
    }
  ],
  "outbounds": [
    {
      "type": "vless",
      "tag": "vless-middle",
      "server": "*",
      "server_port": 443,
      "uuid": "*",
      "flow": "xtls-rprx-vision",
      "packet_encoding": "xudp",
      "tls": {
        "enabled": true,
        "insecure": true,
        "utls": {
          "enabled": true,
          "fingerprint": "chrome"
        }
      },
      "detour": "urltest-exit-group",
      "connect_timeout": "5s"
    },
    {
      "type": "vless",
      "tag": "vless-exit-main",
      "server": "*",
      "server_port": 443,
      "uuid": "*",
      "flow": "xtls-rprx-vision",
      "packet_encoding": "xudp",
      "tls": {
        "enabled": true,
        "insecure": true,
        "server_name": "*",
        "utls": {
          "enabled": true,
          "fingerprint": "chrome"
        }
      },
      "connect_timeout": "5s"
    },
    {
      "type": "vless",
      "tag": "vless-exit-1",
      "server": "*",
      "server_port": 443,
      "uuid": "*",
      "flow": "xtls-rprx-vision",
      "tls": {
        "enabled": true,
        "server_name": "*",
        "reality": {
          "enabled": true,
          "public_key": "*",
          "short_id": "*"
        },
        "utls": {
          "enabled": true,
          "fingerprint": "chrome"
        }
      },
      "domain_resolver": "dns-direct",
      "connect_timeout": "5s"
    },
    {
      "type": "vless",
      "tag": "vless-exit-2",
      "server": "*",
      "server_port": 443,
      "uuid": "*",
      "flow": "xtls-rprx-vision",
      "tls": {
        "enabled": true,
        "server_name": "*",
        "reality": {
          "enabled": true,
          "public_key": "*",
          "short_id": "*"
        },
        "utls": {
          "enabled": true,
          "fingerprint": "chrome"
        }
      },
      "domain_resolver": "dns-direct",
      "connect_timeout": "5s"
    },
    {
      "type": "urltest",
      "tag": "urltest-exit-group",
      "outbounds": [
        "vless-exit-main",
        "vless-exit-1",
        "vless-exit-2"
      ],
      "url": "https://*.*",
      "interval": "30s",
      "tolerance": 100,
      "idle_timeout": "30s",
      "interrupt_exist_connections": true
    },
    {
      "type": "direct",
      "tag": "direct"
    },
    {
      "type": "block",
      "tag": "block"
    }
  ],
  "route": {
    "auto_detect_interface": true,
    "default_domain_resolver": {
      "server": "dns-remote"
    },
    "rules": [
      {
        "inbound": ["tun-in"],
        "protocol": "dns",
        "action": "hijack-dns"
      },
      {
        "protocol": "dns",
        "action": "hijack-dns"
      },
      {
        "ip_cidr": ["224.0.0.0/3", "ff00::/8"],
        "action": "reject"
      },
      {
        "protocol": ["ipv6"],
        "action": "reject"
      },
      {
        "ip_cidr": ["0.0.0.0/0", "::/0"],
        "action": "route",
        "outbound": "wg-ep"
      },
      {
        "action": "route",
        "outbound": "wg-ep"
      },
      {
        "ip_cidr": ["10.1.0.0/24"],
        "action": "route",
        "outbound": "wg-ep"
      }
    ],
    "final": "wg-ep"
  }
}

Solution:

1. Patching Go with https://git.zx2c4.com/wireguard-android/plain/tunnel/tools/libwg-go/goruntime-boottime-over-monotonic.diff?h=1.0.20250531
2. Comment some code on ~/build-android/sing-box-for-android/app/src/main/java/io/nekohasekai/sfa/bg/BoxService.kt
   @RequiresApi(Build.VERSION_CODES.M)
   private fun serviceUpdateIdleMode() {
   // Disabled: CLOCK_BOOTTIME patch makes pause/wake unnecessary
   // and causes stack split crash on sleep
   // if (Application.powerManager.isDeviceIdleMode) {
   // boxService?.pause()
   // } else {
   // boxService?.wake()
   // }
   }
   (Commenting out lines solves the application crash problem)

I'm currently using my own build of version 1.12.12 with fixes, but I'd like to be able to update (have fixes in the official release)

Logs

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Start by reviewing the goruntime-boottime-over-monotonic.diff patch for libwg-go and serviceUpdateIdleMode() in app/src/main/java/io/nekohasekai/sfa/bg/BoxService.kt. Reproduce the failure by locking an Android 15 device for several minutes, then verify that the application does not crash and the WireGuard connection remains available after wake without charging.