Problems setting up wireguard on a VPN appvm

Hello all, I’m experiencing a strange problem with wireguard. I have a sys-vpn appVM which I use to, well, set up VPN connections. This appVM is directly connected to sys-firewall and all appVMs that need to pass through a VPN are connected to it.
This setup ran fine until recently, when I switched my router for a pfsense box. I set up wireguard on my appVM as follows:



As you can see, this is nothing fancy. The stuff in AllowedIPs is because I need to access a whole lot of other subnets when I use the VPN.

My problem is the following: everything works ok, until I start the VPN. At that point, I start losing packets, e.g. by pinging random addresses I start losing pretty much immediately up to 50% of the pings, and latency goes up from 20ms to well over 1.5s.
Notably, this is also true if I ping addresses outside the AllowedIPs range, such as or
Even more notably, after I turn off the VPN the problem persists, and the only way I found to have internet back again is by killing the appVM and starting it again.

I configured other peers to use the wireguard VPN on PfSense (e.g. android devices) and I had no problems, so this seems to be Qubes specific. I have no clue as for what could be causing this. Any ideas?

It seems like you’re using the same VPN config on multiple devices/VMs simultaneously.
You can’t use the same peer config for multiple devices simultaneously.

I am not. This config is exclusive for this machine. The wireguard tunnel is also used exclusively for this appVM.

Most importantly, I do not understand how whatever hypothetical error in the config of wireguard would influence the behavior of my AppVN after I bring the wireguard connection down, for instance by using wg-quick down.

Are you sure that it’s down? Did you check the output of wg show?
Maybe you have some firewall rules that you use for your VPN?

I just checked, yes. The VPN is down. Still, latency is impacted and packets dropped until I restart the VPN.