Complete troubleshooting and schema optimization for Google Play update exceptions on Android

🧭 1. Problem background (real use scene)

On Android phones, I use two VPN network architectures at the same time:

🟢 Scheme A: Vultr + Wireguard (Singapore)

• Server: Vultr (Singapore node)
• Protocol: WireGuard (pure)
• Android performance:
  • ✔ Play Store opens normally
  • ✔ App updates have a download progress bar
  • ✔ Update stable completion

📷 (Figure 2: Vultr Wireguard is updated normally)

🔴 Scenario B: ZGoCloud + Wstunnel + Wireguard + Clash Verge Rev (L.A.)

• Server: ZGoCloud (Los Angeles node)
• Architecture:
  • WSTUnnel → Wireguard → Clash Verge Rev
• Android performance:
  • ✔ Play store page can be opened
  • ❌ App update:
    • Always ‘waiting’
    • No download progress
    • Finally fail

📷 (Figure 1: Play Store cannot be updated)

👉 Initial judgment:

• Is it related to **server region (Singapore vs Los Angeles)**?

🌐 2. Traffic verification (whether the PLAY store is an agent)

View requests using flclash on Android:

key evidence

play.googleapis.com → Proxy
play-fe.googleapis.com → Proxy

📷 (Figure 3: Flclash Google request)

Conclusion

• ✔ Play store traffic is all through the proxy link
• ❌ There is no direct connection
• ❌ Troubleshoot DNS/Clash GeoIP rules issues

📊 3. Preliminary analysis (stage judgment)

👉 Preliminary conclusion:

It is more likely that wstunnel + long link quality causes the download to fail

🔬 4. WireGuard separate verification (WG1 scheme)

⚠️ 4.1 Reasons for triggering WG1

In the WG0 (51820) environment:

📷 (Figure 4) No ‘Last Handshake Time’

• Android Wireguard:
  • ❌ No Handshake (without ‘Last Handshake Time’)
• Conclusion:
  • 51820 UDP suspected to be blocked or interfered

🧱 4.2 WG1 Architecture Design

Target:

Verify WireGuard availability separately without affecting WSTUnnel

⚙️ 4.3 The whole process of WG1 construction (the key details are completed)

Step 1: Copy the configuration file

cp /etc/wireguard/wg0.conf /etc/wireguard/wg1.conf

Modify:

• listenport → 35698
• Subnet → 10.8.0.0/24

Step 2: Try changing Wireguard.sh (failed)

Original idea:

WG_CONF=/etc/wireguard/wg1.conf

But:

• ❌ The script does not support dynamic configuration file parameters

Step 3: Copy Management Script

cp wireguard.sh wireguardwg1.sh
chmod +x wireguardwg1.sh

Modify:

• wg_conf → wg1.conf
• Client Storage → WG1

Step 4: Generate a key system

wg genkey | tee privatekey_client_wg1 | wg pubkey > publickey_client_wg1
wg genpsk > psk_client_wg1

Generate:

• client private key
• client public key
• preshared key

Step 5: Android configuration

[Interface]
PrivateKey = xxx
Address = 10.8.0.3/32
DNS = 8.8.8.8, 8.8.4.4

[Peer]
PublicKey = wg1_server_pub
PresharedKey = xxx
Endpoint = 154.21.196.249:35698
AllowedIPs = 0.0.0.0/0
MTU = 1240

📷 (Figure 5: WG1 Handshake successfully)

❌ 4.4 WG1 test results

• ✔ Wireguard Handshake normal
• ❌ The PLAY store cannot be opened
• ❌ MTU adjustment is invalid

📷 (Figure 6: Play Store is not accessible)

Conclusion:

WG pass, but the business layer fails (Google Play is not available)

🧨 5. Summary of WG1 program failure

• WireGuard itself has no problem
• The problem comes from:
  • wstunnel path complex
  • Los Angeles node quality
  • Decreased quality of long connections

🔁 6. Final verification (abandon WSTUNNEL)

Step 1: Modify the WG0 port

51820 → 36425

📷 (Figure 7: Port Modification)

Step 2: Result

📷 (Figure 8)

• ✔ Play Store Recovery
• ✔ Download a progress bar appears

📷 (Figure 9) Update is complete

• ✔ Update completed

📌 7. Final conclusion

root cause confirmation

📊 Eight, the revised effect model

🧭 Nine, the final architecture plan (recommended)

🟢 Scheme 1: Diversion architecture (recommended)

Play Store → WireGuard（直连）
其他流量 → Wstunnel

✔ Stable
✔ Simple
✔ Minimum changes

🟡 Scenario 2: iptables multi-port WireGuard

客户端端口：20000–60000
        ↓
iptables NAT
        ↓
服务器 51820

📌 Dynamic port mechanism

• Android Wireguard:
  • Automatic/manual selection port (20000–60000)
• wstunnel:
  • Fixed 51820
• The two do not conflict with each other

🧪 Option 3: WSTUNnel Optimization Direction (Future)

• Reduce TLS Buffer Latency
• Adjust WebSocket Frame Size
• Optimize keepalive
• Reduce tunneling layer overhead
• Try HTTP/2/Quic Tunnel (as supported)

🧩 10. Complete traffic architecture diagram

                Android
                   |
        -------------------------
        |                       |
  WireGuard (Play)        Wstunnel + Clash
        |                       |
     ZgoCloud               ZgoCloud
        |                       |
        --------- Internet ------
                    |
                Google Play

🧠 Eleven, key experience summary

1. WG can pass ≠ application available
2. wstunnel will amplify the long connection problem
3. Los Angeles nodes are more sensitive to Google Play
4. Play Store is very sensitive to ‘download link quality’
5. Multi-layer proxy (WG + WSTunnel + Clash) is very easy to introduce implicit failures