A WireGuard tunnel can show a recent handshake, pass a small ping, and still fail when it carries a web page, file transfer, RDP session, database response, or routed subnet. That pattern usually means reachability is working but packet size is not. An encrypted packet grows when ...