Can't reach luci interface via wireguard interface (that does other things well)

Installing and Using OpenWrt Network and Wireless Configuration
1

Hi,
I've add a wireguard interface, connected to a public vps, and almost everything seems to work.
Config the wireguard interface of the router with the peer with allowedIPs = 0.0.0.0/0, all data are routed into the tunnel.
Now, I want to use this interface only to access to the router from internet and I dont want that traffic generated from the lan is routed into the tunnel.
So, if I understood how wireguard works, I modified the allowedIPs of the peer (on openWrt router side), specifying only that of a) the VPS that is the peer on internet with the public ip, used as a sort of relay server and b) of my phone that is connected to the VPS itself.
From the phone, via vpn@vps, I can ping the private address of the wireguard router's interface... so I think everything work... but, from phone via vpn@vps, I can reach luci (while I can do from lan, using the wireguard ip).
Should I do something special? It seems some rules block me, but I dont know how to check it. Better: I think I have to add a rule to the firewall, right? But how?
I've already add the wireguard interface to the wan zone of the firewall (otherwise how should ping and allowedIP=0.0.0.0/0 should have worked?) in the wireguard interface config form.
Any advice will be greatly appreciate!!!

cat config/network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd77:ba07:ad24::/48'

config interface 'lan'
        option type 'bridge'
        option ifname 'eth1.1'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option delegate '0'
        option ipaddr '172.16.1.1'

config interface 'wan'
        option ifname 'eth0.2'
        option proto 'dhcp'

config interface 'wan6'
        option ifname 'eth0.2'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '1 2 3 4 6t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '5 0t'

config interface 'wg10'
        option proto 'wireguard'
        option delegate '0'
        option private_key 'the key'
        list addresses '10.0.10.10/32'

config wireguard_wg10
        option description 'peer'
        option public_key 'the key'
        option endpoint_host 'iDontTellYou.duckdns.org'
        option endpoint_port '55610'
        option persistent_keepalive '25'
        option preshared_key 'the key'
        option route_allowed_ips '1'
        list allowed_ips '10.0.10.1/32'
        list allowed_ips '10.0.10.2/32'

cat /etc/config/firewall



config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'
        list network 'wg10'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Support-UDP-Traceroute'
        option src 'wan'
        option dest_port '33434:33689'
        option proto 'udp'
        option family 'ipv4'
        option target 'REJECT'
        option enabled 'false'

config include
        option path '/etc/firewall.user'

config include 'miniupnpd'
        option type 'script'
        option path '/usr/share/miniupnpd/firewall.include'
        option family 'any'
        option reload '1'

config include 'bcp38'
        option type 'script'
        option path '/usr/lib/bcp38/run.sh'
        option family 'IPv4'
        option reload '1'

config redirect 'adblock_lan53'
        option name 'Adblock DNS (lan, 53)'
        option src 'lan'
        option proto 'tcp udp'
        option src_dport '53'
        option dest_port '53'
        option target 'DNAT'

config redirect 'adblock_lan853'
        option name 'Adblock DNS (lan, 853)'
        option src 'lan'
        option proto 'tcp udp'
        option src_dport '853'
        option dest_port '853'
        option target 'DNAT'

config redirect 'adblock_lan5353'
        option name 'Adblock DNS (lan, 5353)'
        option src 'lan'
        option proto 'tcp udp'
        option src_dport '5353'
        option dest_port '5353'
        option target 'DNAT'
2

Trying to add a rule like this but it doesnt work...
immagine

4

You have assigned the wg interface in wan zone.
Ping works because you have the default rule to allow incoming pings.
Luci doesn't work because there is no such rule. The rule you added is wrong, because you allowed udp protocol. http is tcp/80 and https is tcp/443.

2 Likes
5

I thought I should have used the protocol of the wireguard interface (udp).
Modified it to tcp, enabled the rule and restarted the firewall service and everything goes! Great!
Do you think Do I can or have to increase the security, for example specifying the destination zone of the rule (actually I use "this device" and I have added the destination address that is thw wireguard if of the router side interface.

immagine

6

You may want to limit the destination ports to only what you want to allow, like 80, 443, or 22. But it is not absolutely necessary.

7

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.