ProtonVPN WireGuard "Connect timeout" caused by OpenSnitch NFQUEUE — Complete Diagnosis & Fix

Summary

When
running ProSnitch alongside ProtonVPN on Linux, WireGuard connections
fail with a "Connect timeout" error after ~10 seconds, and then it tries again, and again... The root cause is
OpenSnitch's NFQUEUE rule in the nftables mangle OUTPUT
chain, which intercepts WireGuard's kernel-generated UDP packets but
cannot identify an owning process. The queue stalls, exceeding
ProtonVPN's local agent timeout. OpenVPN is unaffected because it runs
as a userspace binary (/usr/sbin/openvpn) that OpenSnitch can identify.

This was diagnosed and resolved on Linux Mint with ProtonVPN v4.14.1 and OpenSnitch v1.7.x using iptables-nft.

Diagnosis

Symptom

ProtonVPN launched from terminal shows:

INFO | VPN server REACHABLE.

INFO | Waiting for agent status from node-XXX.protonvpn.net...

INFO | Connect timeout

INFO | CONN:STATE_CHANGED | Error

WARNING | Reached connection error state: Timeout

The tunnel comes up and the server is reachable, but the local agent times out after 10 seconds.

Confirmation Tests

Test 1 — Stop OpenSnitch, test WireGuard:

sudo systemctl stop opensnitch

protonvpn-app  # connect with WireGuard — succeeds

sudo systemctl start opensnitch

If WireGuard connects without OpenSnitch running, OpenSnitch is confirmed as the cause.

Test 2 — Check OpenSnitch daemon log for queue errors:

sudo tail -50 /var/log/opensnitchd.log | grep -i "queue\|stuck\|timeout"

Look for:

WAR  queue stuck, closing by timeout

WAR  Queue.destroy(), nfq_close() not closed: -1

ERR  Connection to the UI service lost.

Test 3 — Check nftables mangle OUTPUT chain:

sudo nft -a list chain ip mangle OUTPUT

Look for a rule containing queue num 0 bypass — this is the rule intercepting WireGuard's UDP traffic.

Root Cause

WireGuard
operates entirely in the Linux kernel. Encrypted UDP packets are
generated by the kernel, not by any userspace process. OpenSnitch
intercepts outbound packets via an NFQUEUE rule in the nftables mangle OUTPUT
chain and attempts to match them to a process. When no process is found
(because WireGuard packets are kernel-generated), the queue stalls.
OpenSnitch's processing timeout (often 30 seconds) exceeds ProtonVPN's
local agent timeout (10 seconds), causing the connection to fail.

This
is related to issue #454 but extends the diagnosis: the problem is not
limited to DNS interception — it affects the entire NFQUEUE in the
mangle table, which intercepts all new outbound connections.

Fix

Temporary Fix (test first)

Insert a rule that allows all UDP traffic to bypass the NFQUEUE:

sudo nft insert rule ip mangle OUTPUT ip protocol udp counter accept

Test WireGuard:

protonvpn-app

If it connects, proceed to the permanent fix.

Permanent Fix

Create a systemd override so the rule is inserted after OpenSnitch finishes setting up its nftables chains:

sudo mkdir -p /etc/systemd/system/opensnitch.service.d/

sudo nano /etc/systemd/system/opensnitch.service.d/override.conf

Paste:

[Service]

ExecStartPost=/bin/bash -c "sleep 2 && /usr/sbin/nft insert rule ip mangle OUTPUT ip protocol udp counter accept"

Save and exit, then:

sudo systemctl daemon-reload

sudo systemctl restart opensnitch

Verify:

sudo nft -a list chain ip mangle OUTPUT

The UDP accept rule should appear as the first rule in the chain.

Reboot to confirm the fix survives a full restart.

If the Fix Stops Working After Reboot

The sleep 2 may not be long enough. Increase it:

sudo nano /etc/systemd/system/opensnitch.service.d/override.conf

Change sleep 2 to sleep 5.

Security Impact

This fix allows all UDP traffic to bypass OpenSnitch's NFQUEUE filtering. Impact assessment:

• TCP filtering remains fully intact — browsers, mail clients, and most applications use TCP and are still monitored


• WireGuard's tunnel traffic is kernel-generated and cannot be matched
  to a process, so OpenSnitch provides no useful filtering for it


• DNS queries (UDP port 53) bypass the NFQUEUE, but OpenSnitch's separate DNS interception (if enabled) continues to work

For a more restrictive bypass limited to ProtonVPN's WireGuard ports only: