I guess technically Wireguard is "peer to peer", so maybe I'm using the server term incorrectly but anyway:
I have Wireguard installed on my OpenWrt router so that I can connect to my home network from my phone when on the road, and also to increase my security when not at home. However, at one location I am at, Wireguard and other VPNs are blocked by the firewall. Must be DPI of some sort, since I've tried shifting ports and servers without luck. Unfortunately it's a cellular dead zone, otherwise I'd just use that.
So I was hoping to use AmneziaWG, which claims to be able to get around this. There is a port to OpenWrt, and the configuration looks to be very similar to Wireguard. I've been going through the steps to set up a Wireguard interface (like this: https://bayas.dev/posts/wireguard-server-openwrt) only using the AmneziaWG interface.
The setup went as expected except:
it doesn't generate a config file for peers that I can find. The peers I created do appear in the status window, however, so I think they were created.
I can't connect... the iPhone app says I'm connected to the OpenWrt AmneziaWG peer but OpenWrt status window shows no connection, and I get no traffic.
I realize this is rather uncharted/unsupported territory, but thought I'd see if any clever individual has figured this out. I see a lot of tutorials for setting up AmneziaWG and other DPI-bypassing mechanisms as clients on OpenWrt, but my router is in the clear -- I need it to act as the VPN server.
Aha, thank you! The troubleshooting tips down at the bottom helped me out a lot -- the commands for AmneziaVPN are amneziawp show and so on, and through that I was able to realize my manual conf file had the wrong publickey listed. As you said, copying the settings is not ideal.
Thanks, the issue was that it wouldn't/doesn't create a peer conf file -- don't know if that was something specific about my install or what. When I created the conf file manually, I got mixed up on which key to put where.
Security best practice is to not use that sort of file. Generate the peer's private key locally on the peer and keep it secret there. Share only the public key to the server.
I think the WG plugin displays one (as well as a QR code) that can be copied to the peer, but it doesn't save it to the host. That feature in the AmneziaWG Luci app didn't work, and I got confused when copying the different keys to the fields and messed one up.