Connection Wireguard => LAN => VPN => WAN not working

techmol · May 30, 2023, 1:01pm

Hello,

After I successfully set up a Wireguard VPN (wg0) into my LAN, I have set up a VPN connection (novpn) in order to route all traffic for accessing WAN services through this VPN connection.

It works fine with clients connected locally to the LAN, however it is not working when I'm connected with the Wireguard connection. I hope it is only a minor thing with the Firewall settings.

cat /etc/config/firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone 'lan'
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	list network 'lan'
	option forward 'REJECT'

config zone 'wan'
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option mtu_fix '1'
	list network 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'

cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'sxd4:a29f:ab16::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ipaddr '192.168.201.1'

config interface 'wan'
	option device 'eth1'
	option proto 'static'
	option ipaddr '192.168.100.35'
	option netmask '255.255.255.0'
	option gateway '192.168.100.1'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '1 2 3 4 0'

config interface 'wg0'
	option proto 'wireguard'
	option private_key 'abz'
	option listen_port '51820'
	list addresses '192.168.202.1/24'

config wireguard_wg0
	option description 'ab'
	option public_key 'pub1'
	option private_key 'abz'
	list allowed_ips '192.168.202.10/32'
	option route_allowed_ips '1'

config wireguard_wg0
	option public_key 'pub3'
	option private_key 'abz'
	option description 'ter'
	option route_allowed_ips '1'
	list allowed_ips '192.168.202.11/32'

config interface 'novpn'
	option proto 'none'
	option device 'tun0'

trendy · May 30, 2023, 2:08pm

The firewall configuration is missing some output.
Interface tun0 is not assigned to any zone, nor is lan forwarding to any zone. Add wg0 interface in lan zone, or create a new zone for wg0 and add forwarding to tun0.

techmol · May 31, 2023, 10:46am

Ok, I put the novpn/tun0 interface in the lan firewall zone.

The issue persists when I connect to my Home Network through the Wireguard . Once the OpenVPN connection is enabled I can't reach Internet addresses. When I turn the OpenVPN off I can reach these Internet addresses again.

/etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fda0:c13f:ea34::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ipaddr '192.168.201.1'

config interface 'wan'
	option device 'eth1'
	option proto 'static'
	option ipaddr '192.168.100.35'
	option netmask '255.255.255.0'
	option gateway '192.168.100.1'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '1 2 3 4 0'

config interface 'wg0'
	option proto 'wireguard'
	option private_key 'pub2'
	option listen_port '51820'
	list addresses '192.168.202.1/24'

config wireguard_wg0
	option description 'px'
	option public_key 'pub3'
	option private_key 'priv3'
	list allowed_ips '192.168.202.10/32'
	option route_allowed_ips '1'

config wireguard_wg0
	option public_key 'pub4'
	option private_key 'priv4'
	option description '14r'
	option route_allowed_ips '1'
	list allowed_ips '192.168.202.11/32'

config interface 'novpn'
	option proto 'none'
	option device 'tun0'

/etc/config/firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone 'lan'
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'
	list network 'wg0'

config zone 'wan'
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option mtu_fix '1'
	list network 'wan'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'

egc · May 31, 2023, 11:02am

I think you have to use PBR (policy routing), to make sure wireguard packets are going out via the same way they came in = WAN.

If the vpn is active all traffic is going out via the vpn.

techmol · May 31, 2023, 11:14am

Sounds good.
I want all packets going out to go through the VPN.
Devices are connected locally to the LAN.
Or remotely via Wireguard.
Is this possible to configure with policy routing?

trendy · May 31, 2023, 11:58am

This is wrong, tun0 needs to be in its own zone (with masq and mtufix) and lan to have forwarding to it.

techmol · May 31, 2023, 12:37pm

I put it in its own zone, but I did not manage to put masq and mtufix in this zone specifically. And I activated forwarding from lan in the tun0 fw zone.

I looked up some info in the Wiki re PBR: https://openwrt.org/docs/guide-user/network/routing/pbr#solutions
I think this config could work in my case: https://openwrt.org/docs/guide-user/network/routing/examples/pbr_app

Routing example: PBR

A typical configuration scenario that can be adapted for most common use cases:

Disable gateway redirection in the VPN client configuration.
Route LAN 192.168.1.0/24 to WAN and DMZ 192.168.3.0/24 to VPN.

opkg update
opkg install pbr luci-app-pbr
/etc/init.d/rpcd restart
uci set pbr.config.enabled="1"
uci set pbr.config.resolver_ipset="none"
uci set pbr.config.webui_show_ignore_target="1"
while uci -q delete pbr.@policy[0]; do :; done
uci add pbr policy
uci set pbr.@policy[-1].dest_addr="192.168.1.0/24 192.168.3.0/24"
uci set pbr.@policy[-1].interface="ignore"
uci add pbr policy
uci set pbr.@policy[-1].src_addr="192.168.3.0/24"
uci set pbr.@policy[-1].interface="vpn"
uci commit pbr
/etc/init.d/pbr restart

I wonder if I need a DMZ for it to work or can I just use the current WAN interface instead?

trendy · May 31, 2023, 12:53pm

Was there some problem and you didn't manage? They are necessary in order for the tunnel to work with traffic from the lan.

No, it is not relevant.
Also PBR should not to be mixed up right now. You need first to have a working tunnel with the proper firewall settings before you setup the policy routing.

techmol · May 31, 2023, 1:02pm

I was not able to find the setting. How can I put masq and mtufix in the same zone with tun0? Because so far I only know about Interfaces and Firewall zones and I can't select masq and mtufix.

trendy · May 31, 2023, 1:04pm

egc · May 31, 2023, 1:09pm

Do as @trendy says do not mix things up.

Regarding PBR in your case as you want all your internet traffic via the VPN, including the WireGuard clients which connects from outside, the easiest seems to just route the WG listen port 51820 as source port and route this port via the WAN, as this is the router you have to use the output chain

Something like (not tested and I could be wrong):

techmol · May 31, 2023, 1:56pm

@egc @trendy
I have applied the settings, but I have still no internet access when I am connected with the Wireguard and the OpenVPN client is active on the router at the same time.

trendy · May 31, 2023, 1:58pm

With the vpn switched on:

Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have

ubus call system board; \
uci export network; \
uci export dhcp; uci export firewall; \
ip -4 addr ; ip -4 ro li tab all ; ip -4 ru; \
ls -l  /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*

techmol · May 31, 2023, 2:13pm

I have switched on wg0 and novpn connection. Then I have run the commands. This is the resulting block:

 ubus call system board; \
> uci export network; \
> uci export dhcp; uci export firewall; \
> ip -4 addr ; ip -4 ro li tab all ; ip -4 ru; \
> ls -l  /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*
{
	"kernel": "5.10.176",
	"hostname": "FFC",
	"system": "ARMv7 Processor rev 5 (v7l)",
	"model": "AVM FRITZ!Box 4040",
	"board_name": "avm,fritzbox-4040",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "22.03.5",
		"revision": "r20134-5f15225c1e",
		"target": "ipq40xx/generic",
		"description": "OpenWrt 22.03.5 r20134-5f15225c1e"
	}
}
package network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fxa1:a23f:fa17::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ipaddr '192.168.201.1'

config interface 'wan'
	option device 'eth1'
	option proto 'static'
	option ipaddr '192.168.100.35'
	option netmask '255.255.255.0'
	option gateway '192.168.100.1'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '1 2 3 4 0'

config interface 'wg0'
	option proto 'wireguard'
	option private_key 'pub1'
	option listen_port '51820'
	list addresses '192.168.202.1/24'

config wireguard_wg0
	option description 'px'
	option public_key 'p1'
	option private_key 'pk1'
	list allowed_ips '192.168.202.10/32'
	option route_allowed_ips '1'

config wireguard_wg0
	option public_key 'pb2'
	option private_key 'pk2'
	option description 't14er'
	option route_allowed_ips '1'
	list allowed_ips '192.168.202.11/32'

config interface 'novpn'
	option proto 'none'
	option device 'tun0'

package dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option localservice '1'
	option ednspacket_max '1232'
	option confdir '/tmp/dnsmasq.d'
	list server '103.86.96.100'
	list server '103.86.99.100'
	option noresolv '1'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'
	option start '100'
	option limit '150'
	option leasetime '12h'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config host
	option name 'ffffkr'
	option ip '192.168.201.200'
	option mac '00000'

config host
	option name 'grfdafm'
	option ip '192.168.201.149'
	option mac 000000'

config host
	option name 'fsdfsdfsdf'
	option ip '192.168.201.185'
	option mac '0000000'

config host
	option name 'fsdfiii'
	option ip '192.168.201.162'
	option mac '000000'

config host
	option name 'dtef'
	option ip '192.168.201.101'
	option mac '000000'

config host
	option name 'tbr'
	option ip '192.168.201.140'
	option mac '000000'

config host
	option name 'bbbbbbbbbbb'
	option duid '000000'
	option mac '00000'

config host
	option name 'hhhhhhhh'
	option duid '000000'
	option mac '000000'

config host
	option ip '192.168.201.203'
	option mac '000000'

config host
	option ip '192.168.201.151'
	option mac '000000'

config host
	option ip '192.168.201.232'
	option mac '00000'

config host
	option ip '192.168.201.145'
	option mac '00000'

config host
	option name 'tttttt'
	option duid '000000

config host
	option name 'TTTTTT'
	option ip '192.168.201.219'
	option mac '000000'

config host
	option ip '192.168.201.197'
	option mac '00000'

package firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone 'lan'
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone 'wan'
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option mtu_fix '1'
	list network 'wan'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'Wireguard'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'wg0'

config forwarding
	option src 'Wireguard'
	option dest 'lan'

config forwarding
	option src 'wan'
	option dest 'Wireguard'

config forwarding
	option src 'Wireguard'
	option dest 'wan'

config rule
	option name 'wan-local-wireguard'
	list proto 'udp'
	option src 'wan'
	option dest_port '51820'
	option target 'ACCEPT'

config rule
	option src 'Wireguard'
	option dest 'wan'
	option target 'ACCEPT'
	option name 'wg to wan'

config zone
	option name 'vpnfw'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'novpn'

config forwarding
	option src 'lan'
	option dest 'vpnfw'

config include 'pbr'
	option fw4_compatible '1'
	option type 'script'
	option path '/usr/share/pbr/pbr.firewall.include'

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    inet 192.168.100.35/24 brd 192.168.100.255 scope global eth1
       valid_lft forever preferred_lft forever
6: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 192.168.201.1/24 brd 192.168.201.255 scope global br-lan
       valid_lft forever preferred_lft forever
7: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 192.168.202.1/24 brd 192.168.202.255 scope global wg0
       valid_lft forever preferred_lft forever
12: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500
    inet 10.8.0.6/24 scope global tun0
       valid_lft forever preferred_lft forever
default via 192.168.100.1 dev eth1 table pbr_wan 
192.168.201.0/24 dev br-lan table pbr_wan proto kernel scope link src 192.168.201.1 
default via 192.168.202.1 dev wg0 table pbr_wg0 
192.168.201.0/24 dev br-lan table pbr_wg0 proto kernel scope link src 192.168.201.1 
default via 10.8.0.6 dev tun0 table pbr_novpn 
192.168.201.0/24 dev br-lan table pbr_novpn proto kernel scope link src 192.168.201.1 
0.0.0.0/1 via 10.8.0.1 dev tun0 
default via 192.168.100.1 dev eth1 proto static 
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.6 
128.0.0.0/1 via 10.8.0.1 dev tun0 
185.196.22.201 via 192.168.100.1 dev eth1 
192.168.100.0/24 dev eth1 proto kernel scope link src 192.168.100.35 
192.168.201.0/24 dev br-lan proto kernel scope link src 192.168.201.1 
192.168.202.0/24 dev wg0 proto kernel scope link src 192.168.202.1 
192.168.202.10 dev wg0 proto static scope link 
192.168.202.11 dev wg0 proto static scope link 
broadcast 10.8.0.0 dev tun0 table local proto kernel scope link src 10.8.0.6 
local 10.8.0.6 dev tun0 table local proto kernel scope host src 10.8.0.6 
broadcast 10.8.0.255 dev tun0 table local proto kernel scope link src 10.8.0.6 
broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1 
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 
broadcast 192.168.100.0 dev eth1 table local proto kernel scope link src 192.168.100.35 
local 192.168.100.35 dev eth1 table local proto kernel scope host src 192.168.100.35 
broadcast 192.168.100.255 dev eth1 table local proto kernel scope link src 192.168.100.35 
broadcast 192.168.201.0 dev br-lan table local proto kernel scope link src 192.168.201.1 
local 192.168.201.1 dev br-lan table local proto kernel scope host src 192.168.201.1 
broadcast 192.168.201.255 dev br-lan table local proto kernel scope link src 192.168.201.1 
broadcast 192.168.202.0 dev wg0 table local proto kernel scope link src 192.168.202.1 
local 192.168.202.1 dev wg0 table local proto kernel scope host src 192.168.202.1 
broadcast 192.168.202.255 dev wg0 table local proto kernel scope link src 192.168.202.1 
0:	from all lookup local
30000:	from all fwmark 0x10000/0xff0000 lookup pbr_wan
30001:	from all fwmark 0x20000/0xff0000 lookup pbr_wg0
30002:	from all fwmark 0x30000/0xff0000 lookup pbr_novpn
32766:	from all lookup main
32767:	from all lookup default
lrwxrwxrwx    1 root     root            16 Apr 27 22:28 /etc/resolv.conf -> /tmp/resolv.conf
lrwxrwxrwx    1 root     root            35 May 31 15:45 /tmp/resolv.conf -> /tmp/resolv.conf.d/resolv.conf.auto
-rw-r--r--    1 root     root             0 May 31 15:45 /tmp/resolv.conf.d/resolv.conf.auto

/tmp/resolv.conf.d:
-rw-r--r--    1 root     root             0 May 31 15:45 resolv.conf.auto
==> /etc/resolv.conf <==

==> /tmp/resolv.conf <==

==> /tmp/resolv.conf.d <==
head: /tmp/resolv.conf.d: I/O error

==> /tmp/resolv.conf.d/resolv.conf.auto <==

trendy · May 31, 2023, 2:44pm

You have assigned the wg0 in a new firewall zone, but there is no forwarding to the vpnfw zone. Assign the wg0 back to lan zone.
Add an ip rule to send wg traffic via the wan. This should be accomplished by the PBR, using the OUTPUT chain for traffic from source port 51820.
Repost configuration to verify:

uci export network; \
uci export pbr; uci export firewall; \
ip -4 addr ; ip -4 ro li tab all ; ip -4 ru; \
nft list ruleset

techmol · May 31, 2023, 2:59pm

Ok, I have put the PBR in place and I have added the wg0 back to lan fw zone.

I repost the config:

uci export network; \
> uci export pbr; uci export firewall; \
> ip -4 addr ; ip -4 ro li tab all ; ip -4 ru; \
> nft list ruleset
package network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fda0:c13f:ea34::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ipaddr '192.168.201.1'

config interface 'wan'
	option device 'eth1'
	option proto 'static'
	option ipaddr '192.168.100.35'
	option netmask '255.255.255.0'
	option gateway '192.168.100.1'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '1 2 3 4 0'

config interface 'wg0'
	option proto 'wireguard'
	option private_key 'a'
	option listen_port '51820'
	list addresses '192.168.202.1/24'

config wireguard_wg0
	option description 'px'
	option public_key 'b'
	option private_key 'c'
	list allowed_ips '192.168.202.10/32'
	option route_allowed_ips '1'

config wireguard_wg0
	option public_key 'd'
	option private_key 'e'
	option description 't1'
	option route_allowed_ips '1'
	list allowed_ips '192.168.202.11/32'

config interface 'novpn'
	option proto 'none'
	option device 'tun0'

package pbr

config pbr 'config'
	option verbosity '2'
	option strict_enforcement '1'
	option resolver_set 'none'
	option ipv6_enabled '0'
	list ignored_interface 'vpnserver'
	list ignored_interface 'wgserver'
	option boot_timeout '30'
	option rule_create_option 'add'
	option procd_reload_delay '1'
	list webui_supported_protocol 'all'
	list webui_supported_protocol 'tcp'
	list webui_supported_protocol 'udp'
	list webui_supported_protocol 'tcp udp'
	list webui_supported_protocol 'icmp'
	option enabled '1'
	option resolver_ipset 'none'
	option webui_show_ignore_target '1'

config include
	option path '/usr/share/pbr/pbr.user.aws'
	option enabled '0'

config include
	option path '/usr/share/pbr/pbr.user.netflix'
	option enabled '0'

config policy
	option dest_addr '192.168.201.0/24 192.168.100.0/24'
	option interface 'ignore'
	option enabled '0'

config policy
	option src_addr '192.168.100.0/24'
	option interface 'novpn'
	option enabled '0'

config policy
	option name 'vpnspezial'
	option src_port '51820'
	option proto 'udp'
	option chain 'output'
	option interface 'wan'

package firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone 'lan'
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'
	list network 'wg0'

config zone 'wan'
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option mtu_fix '1'
	list network 'wan'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'Wireguard'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'

config forwarding
	option src 'Wireguard'
	option dest 'lan'

config forwarding
	option src 'wan'
	option dest 'Wireguard'

config forwarding
	option src 'Wireguard'
	option dest 'wan'

config rule
	option name 'wan-local-wireguard'
	list proto 'udp'
	option src 'wan'
	option dest_port '51820'
	option target 'ACCEPT'

config rule
	option src 'Wireguard'
	option dest 'wan'
	option target 'ACCEPT'
	option name 'wg to wan'

config zone
	option name 'vpnfw'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'novpn'

config forwarding
	option src 'lan'
	option dest 'vpnfw'

config include 'pbr'
	option fw4_compatible '1'
	option type 'script'
	option path '/usr/share/pbr/pbr.firewall.include'

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    inet 192.168.100.35/24 brd 192.168.100.255 scope global eth1
       valid_lft forever preferred_lft forever
6: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 192.168.201.1/24 brd 192.168.201.255 scope global br-lan
       valid_lft forever preferred_lft forever
7: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 192.168.202.1/24 brd 192.168.202.255 scope global wg0
       valid_lft forever preferred_lft forever
12: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500
    inet 10.8.0.6/24 scope global tun0
       valid_lft forever preferred_lft forever
default via 192.168.100.1 dev eth1 table pbr_wan 
192.168.201.0/24 dev br-lan table pbr_wan proto kernel scope link src 192.168.201.1 
default via 192.168.202.1 dev wg0 table pbr_wg0 
192.168.201.0/24 dev br-lan table pbr_wg0 proto kernel scope link src 192.168.201.1 
default via 10.8.0.6 dev tun0 table pbr_novpn 
192.168.201.0/24 dev br-lan table pbr_novpn proto kernel scope link src 192.168.201.1 
0.0.0.0/1 via 10.8.0.1 dev tun0 
default via 192.168.100.1 dev eth1 proto static 
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.6 
128.0.0.0/1 via 10.8.0.1 dev tun0 
185.196.22.201 via 192.168.100.1 dev eth1 
192.168.100.0/24 dev eth1 proto kernel scope link src 192.168.100.35 
192.168.201.0/24 dev br-lan proto kernel scope link src 192.168.201.1 
192.168.202.0/24 dev wg0 proto kernel scope link src 192.168.202.1 
192.168.202.10 dev wg0 proto static scope link 
192.168.202.11 dev wg0 proto static scope link 
broadcast 10.8.0.0 dev tun0 table local proto kernel scope link src 10.8.0.6 
local 10.8.0.6 dev tun0 table local proto kernel scope host src 10.8.0.6 
broadcast 10.8.0.255 dev tun0 table local proto kernel scope link src 10.8.0.6 
broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1 
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 
broadcast 192.168.100.0 dev eth1 table local proto kernel scope link src 192.168.100.35 
local 192.168.100.35 dev eth1 table local proto kernel scope host src 192.168.100.35 
broadcast 192.168.100.255 dev eth1 table local proto kernel scope link src 192.168.100.35 
broadcast 192.168.201.0 dev br-lan table local proto kernel scope link src 192.168.201.1 
local 192.168.201.1 dev br-lan table local proto kernel scope host src 192.168.201.1 
broadcast 192.168.201.255 dev br-lan table local proto kernel scope link src 192.168.201.1 
broadcast 192.168.202.0 dev wg0 table local proto kernel scope link src 192.168.202.1 
local 192.168.202.1 dev wg0 table local proto kernel scope host src 192.168.202.1 
broadcast 192.168.202.255 dev wg0 table local proto kernel scope link src 192.168.202.1 
0:	from all lookup local
30000:	from all fwmark 0x10000/0xff0000 lookup pbr_wan
30001:	from all fwmark 0x20000/0xff0000 lookup pbr_wg0
30002:	from all fwmark 0x30000/0xff0000 lookup pbr_novpn
32766:	from all lookup main
32767:	from all lookup default
table inet fw4 {
	chain input {
		type filter hook input priority filter; policy accept;
		iifname "lo" accept comment "!fw4: Accept traffic from loopback"
		ct state established,related accept comment "!fw4: Allow inbound established and related flows"
		tcp flags syn / fin,syn,rst,ack jump syn_flood comment "!fw4: Rate limit TCP syn packets"
		iifname { "wg0", "br-lan" } jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
		iifname "eth1" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
		iifname "tun0" jump input_vpnfw comment "!fw4: Handle vpnfw IPv4/IPv6 input traffic"
	}

	chain forward {
		type filter hook forward priority filter; policy drop;
		ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
		iifname { "wg0", "br-lan" } jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
		iifname "eth1" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
		iifname "tun0" jump forward_vpnfw comment "!fw4: Handle vpnfw IPv4/IPv6 forward traffic"
		jump handle_reject
	}

	chain output {
		type filter hook output priority filter; policy accept;
		oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
		ct state established,related accept comment "!fw4: Allow outbound established and related flows"
		oifname { "wg0", "br-lan" } jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
		oifname "eth1" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
		oifname "tun0" jump output_vpnfw comment "!fw4: Handle vpnfw IPv4/IPv6 output traffic"
	}

	chain prerouting {
		type filter hook prerouting priority filter; policy accept;
		iifname { "wg0", "br-lan" } jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment"
		iifname "eth1" jump helper_wan comment "!fw4: Handle wan IPv4/IPv6 helper assignment"
	}

	chain handle_reject {
		meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
		reject comment "!fw4: Reject any other traffic"
	}

	chain syn_flood {
		limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit"
		drop comment "!fw4: Drop excess packets"
	}

	chain input_lan {
		jump accept_from_lan
	}

	chain output_lan {
		jump accept_to_lan
	}

	chain forward_lan {
		jump accept_to_wan comment "!fw4: Accept lan to wan forwarding"
		jump accept_to_vpnfw comment "!fw4: Accept lan to vpnfw forwarding"
		jump accept_to_lan
	}

	chain helper_lan {
	}

	chain accept_from_lan {
		iifname { "wg0", "br-lan" } counter packets 173 bytes 13369 accept comment "!fw4: accept lan IPv4/IPv6 traffic"
	}

	chain accept_to_lan {
		oifname { "wg0", "br-lan" } counter packets 1 bytes 160 accept comment "!fw4: accept lan IPv4/IPv6 traffic"
	}

	chain input_wan {
		meta nfproto ipv4 udp dport 68 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCP-Renew"
		icmp type echo-request counter packets 0 bytes 0 accept comment "!fw4: Allow-Ping"
		meta nfproto ipv4 meta l4proto igmp counter packets 1 bytes 36 accept comment "!fw4: Allow-IGMP"
		meta nfproto ipv6 udp dport 546 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCPv6"
		ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { mld-listener-query . no-route, mld-listener-report . no-route, mld-listener-done . no-route, mld2-listener-report . no-route } counter packets 0 bytes 0 accept comment "!fw4: Allow-MLD"
		icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply, nd-router-solicit, nd-router-advert } limit rate 1000/second counter packets 1 bytes 168 accept comment "!fw4: Allow-ICMPv6-Input"
		icmpv6 type . icmpv6 code { packet-too-big . no-route, parameter-problem . no-route, nd-neighbor-solicit . no-route, nd-neighbor-advert . no-route, parameter-problem . admin-prohibited } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Input"
		udp dport 51820 counter packets 12 bytes 2112 accept comment "!fw4: wan-local-wireguard"
		jump reject_from_wan
	}

	chain output_wan {
		jump accept_to_wan
	}

	chain forward_wan {
		icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
		icmpv6 type . icmpv6 code { packet-too-big . no-route, parameter-problem . no-route, parameter-problem . admin-prohibited } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
		meta l4proto esp counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: Allow-IPSec-ESP"
		udp dport 500 counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: Allow-ISAKMP"
		jump accept_to_Wireguard comment "!fw4: Accept wan to Wireguard forwarding"
		jump reject_to_wan
	}

	chain helper_wan {
	}

	chain accept_to_wan {
		oifname "eth1" counter packets 0 bytes 0 accept comment "!fw4: accept wan IPv4/IPv6 traffic"
	}

	chain reject_from_wan {
		iifname "eth1" counter packets 3 bytes 714 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
	}

	chain reject_to_wan {
		oifname "eth1" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
	}

	chain input_Wireguard {
		jump accept_from_Wireguard
	}

	chain output_Wireguard {
		jump accept_to_Wireguard
	}

	chain forward_Wireguard {
		meta l4proto tcp counter packets 0 bytes 0 jump accept_to_wan comment "!fw4: wg to wan"
		meta l4proto udp counter packets 0 bytes 0 jump accept_to_wan comment "!fw4: wg to wan"
		jump accept_to_lan comment "!fw4: Accept Wireguard to lan forwarding"
		jump accept_to_wan comment "!fw4: Accept Wireguard to wan forwarding"
		jump reject_to_Wireguard
	}

	chain helper_Wireguard {
	}

	chain accept_from_Wireguard {
	}

	chain accept_to_Wireguard {
	}

	chain reject_to_Wireguard {
	}

	chain input_vpnfw {
		jump reject_from_vpnfw
	}

	chain output_vpnfw {
		jump accept_to_vpnfw
	}

	chain forward_vpnfw {
		jump reject_to_vpnfw
	}

	chain accept_to_vpnfw {
		oifname "tun0" counter packets 124 bytes 12509 accept comment "!fw4: accept vpnfw IPv4/IPv6 traffic"
	}

	chain reject_from_vpnfw {
		iifname "tun0" counter packets 1 bytes 40 jump handle_reject comment "!fw4: reject vpnfw IPv4/IPv6 traffic"
	}

	chain reject_to_vpnfw {
		oifname "tun0" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject vpnfw IPv4/IPv6 traffic"
	}

	chain dstnat {
		type nat hook prerouting priority dstnat; policy accept;
	}

	chain srcnat {
		type nat hook postrouting priority srcnat; policy accept;
		oifname "tun0" jump srcnat_vpnfw comment "!fw4: Handle vpnfw IPv4/IPv6 srcnat traffic"
	}

	chain srcnat_vpnfw {
		meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 vpnfw traffic"
	}

	chain raw_prerouting {
		type filter hook prerouting priority raw; policy accept;
	}

	chain raw_output {
		type filter hook output priority raw; policy accept;
	}

	chain mangle_prerouting {
		type filter hook prerouting priority mangle; policy accept;
		jump pbr_prerouting comment "Jump into pbr prerouting chain"
	}

	chain mangle_postrouting {
		type filter hook postrouting priority mangle; policy accept;
		jump pbr_postrouting comment "Jump into pbr postrouting chain"
	}

	chain mangle_input {
		type filter hook input priority mangle; policy accept;
		jump pbr_input comment "Jump into pbr input chain"
	}

	chain mangle_output {
		type route hook output priority mangle; policy accept;
		jump pbr_output comment "Jump into pbr output chain"
	}

	chain mangle_forward {
		type filter hook forward priority mangle; policy accept;
		iifname "eth1" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 ingress MTU fixing"
		oifname "eth1" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 egress MTU fixing"
		iifname "tun0" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone vpnfw IPv4/IPv6 ingress MTU fixing"
		oifname "tun0" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone vpnfw IPv4/IPv6 egress MTU fixing"
		jump pbr_forward comment "Jump into pbr forward chain"
	}

	chain pbr_forward {
	}

	chain pbr_input {
	}

	chain pbr_output {
		udp sport 51820 goto pbr_mark_0x010000 comment "vpnspezial"
	}

	chain pbr_prerouting {
	}

	chain pbr_postrouting {
	}

	chain pbr_mark_0x010000 {
		counter packets 12 bytes 1440 meta mark set meta mark & 0xff01ffff | 0x00010000
		return
	}

	chain pbr_mark_0x020000 {
		counter packets 0 bytes 0 meta mark set meta mark & 0xff02ffff | 0x00020000
		return
	}

	chain pbr_mark_0x030000 {
		counter packets 0 bytes 0 meta mark set meta mark & 0xff03ffff | 0x00030000
		return
	}
}

trendy · May 31, 2023, 3:04pm

In PBR configuration add wg0 in the list of ignored interfaces.

config pbr 'config'
...
	list ignored_interface 'vpnserver'
	list ignored_interface 'wgserver'

Is is working now?

egc · May 31, 2023, 3:19pm

One thing I noticed is that sometimes a reboot is necessary to get everything going.

techmol · May 31, 2023, 3:36pm

Unfortunately not.

I noticed that too. I have rebooted the router and my computer and also my phone. I did not help unfortunately.

trendy · May 31, 2023, 8:13pm

Try to run this and let us know if it works.

ip route add to default via 192.168.100.1 table 100
ip rule add sport 51820 to default lookup 100 prio 100