Accessing MACVLAN device from VPN(wireguard)

Hi all,

I'm getting crazy about this, so maybe one of you can tell me how to solve it in OpenWRT :slight_smile:

That's what i have:

At my MACVLAN i have some docker container assigned for example:

I can connect by wireguard and accessing the lan. For example access to luci is no problem. I also can ping devices which are connected to the router by DHCP. But i can not access or ping any docker container inside my MACVLAN if i'm connected by wireguard. I'm pretty sure it's not a big thing, but i don't have any idea anymore :slight_smile:

So, two things what i don't understand:

  1. I can't ping or access the docker container with a client connected with wireguard (over wan), but i can do for clients connected by wlan.
  2. I can't ping the docker containers from the router.. no matter how i'm connected to it

A screenshot from my zone settings:

(Don't get confused by the docker zone, this is an docker internal bridge. The MACVLAN is assigned to the lan zone)

Another thing i've seen if i make a traceroute to a docker container from the client:

traceroute to (, 64 hops max, 40 byte packets
 1 (  2.498 ms  2.550 ms  2.325 ms

If i'm connected from wan by wireguard:

traceroute to (, 64 hops max, 40 byte packets
 1 (  124.768 ms  505.323 ms  306.936 ms
 2 (  3589.456 ms !H  3474.829 ms !H  3481.052 ms !H

And from the router:

traceroute to (, 30 hops max, 46 byte packets
 1 (  3145.022 ms !H  3119.329 ms !H  3119.585 ms !H

The wireguard client config is:

PrivateKey = XXX
Address =

PublicKey = XXX
PresharedKey = XXX
AllowedIPs =
Endpoint = XXX:51820
PersistentKeepalive = 25

I hope I didn't describe my problem too confusingly :smiley:
Just tell me which info's you would need, or give me a hint what i can try :smiley:
Every help is welcome :smiley: