Thanks for your instruction but this is totally new to me, could you please share a guide so I can implement step by step.
- You really should use 1 thread for 1 issue
- See (the example uses 9.9.9.9):
Also, from your deleted post, I see you started using the PBR app and failed to otherwise mention that, so you'll need to translate my instructions to PBR-compatiable rules.
1 Like
Thanks for your reply @lleachii ,
I've checked your suggested link and tried to understand and apply this. for now I am still unable to use the my Wireguard VPN with any device using pbr, the current situation is below
Please suggest, what is missing
As I noted before and in other threads refrenceed, I don't use the PBR app (I make manual IP Routes and IP Rules). I'm completely unfamiliar with your screenshot and what it means.
Perhaps others can assist.
Had a quick look at your screenshot and your deleted configs and it looks like wan is your default gateway. So without any rules every traffic will go over wan which is probably what you want…
The first rule looks like you defined 192.168.1.2 as your dest address - should probably be source….
Did you have a look at the pbr docs?
What’s actually not working right now?
1 Like
Yes, default will be wan if no rules,
Currently i have 2 rules for testing, but according to rules i am not getting results. Trafic should be from vpn in this case.
Also i have removed below from vpn config
option route_allowed_ips '1'
If i apply this vpn is default, i want to use this by rules.
For now i have single IP range for all network, please suggest if i need to do modify it
Thanks a lot for your help 
I don’t know if it makes any difference but
option route_allowed_ips '1'
should be set to ‘0’ and not be removed… at least according to the pbr docs…
What do you mean exactly with that?
Are you sure your wg tunnels actually working properly? Did you verify that before starting to use pbr?
Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have
ubus call system board; \
uci export network; \
uci export dhcp; uci export firewall; uci export pbr; uci export wireless
1 Like
Yes, i have tested it, it's working as default connection, if i am using bellow
option route_allowed_ips '1'
Else wan is default
{
"kernel": "5.10.161",
"hostname": "OpenWrt",
"system": "MediaTek MT7621 ver:1 eco:3",
"model": "D-Link DIR-2640 A1",
"board_name": "dlink,dir-2640-a1",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "22.03.3",
"revision": "r20028-43d71ad93e",
"target": "ramips/mt7621",
"description": "OpenWrt 22.03.3 r20028-43d71ad93e"
}
}
Network:
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option packet_steering '1'
option ula_prefix '<ip_v6>/48'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option ipaddr '192.168.1.1'
config interface 'wan'
option device 'wan'
option proto 'dhcp'
config interface 'wan6'
option device 'wan'
option proto 'dhcpv6'
option reqaddress 'try'
option reqprefix 'auto'
config interface 'wg0'
option proto 'wireguard'
option private_key 'U<private_key>='
option peerdns '0'
list dns '1.1.1.1'
list addresses '<ip_v4>/32'
list addresses '<ip_v6>/128'
option force_link '1'
config interface 'wg1'
option proto 'wireguard'
option private_key 'a<private_key>='
list addresses '<ip>/32'
option peerdns '0'
list dns '1.1.1.1'
option force_link '1'
config wireguard_wg0
option description 'Cloudflare'
list allowed_ips '0.0.0.0/0'
list allowed_ips '::/0'
option endpoint_port '<port>'
option public_key 'b<public_key>='
option endpoint_host '<host_add>'
option route_allowed_ips '0'
config wireguard_wg1
option description 'Proton'
option public_key '+<public_key>='
list allowed_ips '0.0.0.0/1'
list allowed_ips '128.0.0.0/1'
option endpoint_host '<host_add>'
option endpoint_port '<port>'
option route_allowed_ips '0'
DHCP:
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
option confdir '/tmp/dnsmasq.d'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option ra 'server'
option dhcpv6 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
config host
option name 'real'
option dns '1'
option mac '<phone_mac_add>'
option ip '192.168.1.190'
config mac 'wg0'
option mac '<phone_mac_add>'
option networkid 'wg0'
list dhcp_option '6,8.8.8.8,8.8.4.4'
Firewall:
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
config rule
option name 'Allow-WG-Inbound'
option target 'ACCEPT'
option src '*'
option proto 'udp'
option dest_port '61820'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config include 'pbr'
option fw4_compatible '1'
option type 'script'
option path '/usr/share/pbr/pbr.firewall.include'
PBR:
config pbr 'config'
option verbosity '2'
option strict_enforcement '1'
option ipv6_enabled '0'
option boot_timeout '30'
option rule_create_option 'add'
option procd_reload_delay '1'
list webui_supported_protocol 'all'
list webui_supported_protocol 'tcp'
list webui_supported_protocol 'udp'
list webui_supported_protocol 'tcp udp'
list webui_supported_protocol 'icmp'
option enabled '1'
list ignored_interface 'vpnserver'
list ignored_interface 'wgserver'
option webui_show_ignore_target '0'
option resolver_set 'none'
config include
option path '/usr/share/pbr/pbr.user.aws'
option enabled '0'
config include
option path '/usr/share/pbr/pbr.user.netflix'
option enabled '0'
config policy
option name 'Plex/Emby Local Server'
option interface 'wan'
option src_port '8096 8920 32400'
option enabled '0'
config policy
option name 'Plex/Emby Remote Servers'
option interface 'wan'
option dest_addr 'plex.tv my.plexapp.com emby.media app.emby.media tv.emby.media'
option enabled '0'
config policy
option name 'default'
option dest_addr '192.168.1.2'
option interface 'wg0'
config policy
option name 'realmesk'
option src_addr '<phone_mac_add>'
option interface 'wg0'
Wireless:
config wifi-device 'radio0'
option type 'mac80211'
option path '1eXXXXXXXXXXXXXXXXX.0'
option channel '1'
option band '2g'
option htmode 'HT20'
option cell_density '0'
config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'Secure_24'
option encryption 'sae-mixed'
option key '<password>'
config wifi-device 'radio1'
option type 'mac80211'
option path '1eXXXXXXXXXXXXXXXXXXXXXX.0'
option channel '36'
option band '5g'
option htmode 'VHT80'
option cell_density '0'
option disabled '1'
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid 'Secure_5'
option encryption 'sae-mixed'
option key '<password>'
option disabled '1'
As I mentioned before change:
config policy
option name 'default'
option dest_addr '192.168.1.2'
option interface 'wg0'
to
config policy
option name 'default'
option src_addr '192.168.1.2'
option interface 'wg0'
and then try again...
Have you restarted the router since installing and setting up pbr?
Aslo... are you sure 192.168.1.2 is the right ip of the device you are testing your wg connection with pbr on? When looking at your dhcp config it appears that your dhcp range is from 100 – 150. So clearly the ip 192.168.1.2 is not managed by dhcp. You also don’t have a static lease configured for 192.168.1.2. This could mean you manually defined the ip on the client or the client is using a different ip…
1 Like
After apply this, No internet. as i can see no wg0 vpn handshake.
Yes, that's correct.
What is the output of
service pbr status
============================================================
pbr - environment
pbr 1.0.1-16 running on OpenWrt 22.03.3. WAN (IPv4): wan/wan/192.168.0.1.
============================================================
Dnsmasq version 2.86 Copyright (c) 2000-2021 Simon Kelley
Compile time options: IPv6 GNU-getopt no-DBus UBus no-i18n no-IDN DHCP no-DHCPv6 no-Lua TFTP no-conntrack no-ipset no-auth no-cryptohash no-DNSSEC no-ID loop-detect inotify dumpfile
============================================================
pbr chains - policies
chain pbr_forward {
}
chain pbr_input {
}
chain pbr_output {
}
chain pbr_prerouting {
ip saddr @pbr_wg0_4_src_ip_cfg066ff5 goto pbr_mark_0x020000 comment "default"
ether saddr @pbr_wg0_4_src_mac_cfg076ff5 goto pbr_mark_0x020000 comment "real"
}
chain pbr_postrouting {
}
============================================================
pbr chains - marking
chain pbr_mark_0x010000 {
counter packets 0 bytes 0 meta mark set meta mark & 0xff01ffff | 0x00010000
return
}
chain pbr_mark_0x020000 {
counter packets 198 bytes 22509 meta mark set meta mark & 0xff02ffff | 0x00020000
return
}
chain pbr_mark_0x030000 {
counter packets 0 bytes 0 meta mark set meta mark & 0xff03ffff | 0x00030000
return
}
============================================================
pbr nft sets
set pbr_wg0_4_src_ip_cfg066ff5 {
type ipv4_addr
flags interval
auto-merge
comment "default"
elements = { 192.168.1.2 }
}
set pbr_wg0_4_src_mac_cfg076ff5 {
type ether_addr
flags interval
auto-merge
comment "real"
elements = { <mac_add> }
}
============================================================
IPv4 table 256 route: default via 192.168.0.1 dev wan
IPv4 table 256 rule(s):
30000: from all fwmark 0x10000/0xff0000 lookup pbr_wan
IPv4 table 257 route: default via 172.16.0.2 dev wg0
IPv4 table 257 rule(s):
30001: from all fwmark 0x20000/0xff0000 lookup pbr_wg0
IPv4 table 258 route: default via 10.2.0.2 dev wg1
IPv4 table 258 rule(s):
30002: from all fwmark 0x30000/0xff0000 lookup pbr_wg1
What happens if you use:
config policy
option name 'default'
option src_addr '192.168.1.2'
option interface 'wg0'
and then ping 8.8.8.8 from your 192.168.1.2 client?
No Internet
No Internet
1 Like
Yes, you know what i am thinking, when i boot my router, my wan automatically up, why wg0 and wg1 not.
I think this is the issue, please correct me if i am wrong.
Seems like his is wg interfaces are not assigned to the wan firewall zone.
Under etc/config/firewall add this to your wan zone:
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
list network 'wg0'
list network 'wg1'
Thanks @lleachii didn’t catch that when I first looked through his config. Maybe I'm wrong but I could swear that someone told him to do this. In this or the other thread…
2 Likes
Glad you caught it.
I thought so too. Enjoy. 
2 Likes
Thanks a lot @Hudra , @lleachii for your great help. Finally it's working for wg0, wg1 i will check my own. Great thanks 
3 Likes
This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.