Create Surfshark wireguard connection on OpenWrt easily

RuralRoots · March 30, 2022, 3:16pm

Yes, odd.

root@RuralRoots:/# find / -iname wg.json
/mnt/shared/wgapi/wg.json

Wondering about:

What are the file contents?

Bill · March 30, 2022, 3:24pm

The bricking comment was pointed at manipulating the wireguard.js file.

The file contents of the various and multiple *.json files are exactly what one would expect ~ yet dated. Perhaps ~ and most likely ~ running the wg_gen_config.sh file in WinSCP from the /www/luci-static/* folders during testing populated the errantly located files. I'll delete!

Thread Master Bot suggested I consolidate: So..

Does your repo edition of the script add verbosity to flag 429 error like @patrickm script does?

Bill · March 30, 2022, 3:29pm

Great find.... right to the source for the answer.

Good reason to be a Guinee pig and test that reorder script.

RuralRoots · March 30, 2022, 5:52pm

Other than adding -v option to the curl responses to figure what HTTP Responses were being returned, No. Only encountered it when I initially used my .ovpn Credentials in config.json.

Bill · March 30, 2022, 6:20pm

Ahhh, so you do have an intrepid vein. Bold Move...Bold Move.

btw thanks for jinxing me.. router did puke after all.

Bill · March 31, 2022, 12:20am

Dear Professor.. I had read this entire thread before joining, but your issue was the reason I joined. I hate to leave a rock unturned. I think this might help revive brain stem activity. Happy Regards!

Summary

Bill · March 31, 2022, 12:06pm

This is dedicate to the OP @yazdan , @patrickm , and @RuralRoots!

Thanks to @directnupe for Tutorial-1 and Tutorial-2 and Testing Script and Cron Job.

Summary of Scripts Available on This Thread

yazdan Feb 2, 2023 ~ gen_wg_config.sh: Support adding config files to a zip archive
Utility flag, useful to import the configurations to the android app
New Switches and Suffix's on the tagged {p2p, virtual, physical} in the config folder for refined selection.

            echo "  -f force register ignore checking"
            echo "  -g ignore generating profile files"
            echo "  -n <name> create a manual named key"
            echo "  -k <key> use provided private key"
            echo "  -l list registered manual keys"
            echo "  -d <key-id> delete registered manual key"
            echo "  -z [zip-file] zip archive in which to save the config files"

Bill reIyst update on Feb, 7 2023 Release 1.0.1 Keys.sh
patrickm revised this gist May 17, 2022

Interface 'wg0' Endpoint Swap

This README is dedicated to making a cli uci install of the Wireguard services and sswg script to enable one to swap endpoint easily and quickly. The front end work is lengthy, mostly reading; yet the outcome is well worth the time, especially since most of the work of configuration is uci set. Enjoy!

OpenWrt SurfShark WireGurard ~ SSWG

Have the requirements to run the script

opkg update opkg install diffutils curl jq ntpdate

You can install and run the script to obtain the keys within the wg.json file prior to doing Multi Peer section

From the reIyst SSWG download the 'sswg.sh' and 'sswg.json' files. If you have WinSCP your day is made easy. SSH into your router via WinSCP/Putty and create the folder structure. Copy the two files into the 'wg' directory and make the sswg.sh file executable. ./sswg.sh -g Is the first run application and will produce all connection files w/ pvt keys needed to configure your router, and/or import in WireGuard's© desktop app.

mkdir -p /wg/

chmod +x sswg.sh

./sswg.sh -g

Multi (Peer) For Interface named 'wg0'

Have the requirements to use Luci/uci WireGuard©

opkg update opkg install luci-app-wireguard luci-proto-wireguard wireguard-tools

Reboot your system so the above packages can manifest in Luci.

Installing w/out Peer(1) and with Multi Peer for uci cli Swapping.

Follow the Templet Use all or at least two, or configure within the file your own. Double check the wan.metric='10' with ip route show default to ensure metric 10 is not already in use; modify accordingly. All public key are dummy. Until changed with legitimate pub key from you downloaded client conf files; you will be without Internet access.

cd /
uci set network.wan.metric='10'

uci set network.wg0=interface
uci set network.wg0.proto='wireguard'
uci set network.wg0.listen_port='51820'
uci set network.wg0.addresses='10.14.0.2/8'
uci set network.wg0.private_key=$(eval echo $(jq '.prv' ./wg/wg.json))	
uci commit network

uci set network.peerchiu='wireguard_wg0'
uci set network.peerchiu.description=peerchiu
uci set network.peerchiu.public_key=DpMfulanF/MVHmt3AX4dqLqcyE0dpPqYBjDlWMaUI00=
uci add_list network.peerchiu.allowed_ips='0.0.0.0/0'
uci add_list network.peerchiu.allowed_ips='::/0'
uci set network.peerchiu.route_allowed_ips='1'
uci set network.peerchiu.endpoint_host=us-chi.prod.surfshark.com
uci set network.peerchiu.endpoint_port='51820'
uci set network.peerchiu.persistent_keepalive='25'
uci commit network

uci set network.peerdalu='wireguard_wg0'
uci set network.peerdalu.description=peerdalu
uci set network.peerdalu.public_key=0iwHQpV+rsOg38ogv4g4XMLJa51YqWY/yKWR9UEUMDk=
uci add_list network.peerdalu.allowed_ips='0.0.0.0/0'
uci add_list network.peerdalu.allowed_ips='::/0'
uci set network.peerdalu.route_allowed_ips='1'
uci set network.peerdalu.endpoint_host=us-dal.prod.surfshark.com
uci set network.peerdalu.endpoint_port='51820'
uci set network.peerdalu.persistent_keepalive='25'
uci commit network

uci set network.peernycu='wireguard_wg0'
uci set network.peernycu.description=peernycu
uci set network.peernycu.public_key=rhuoCmHdyYrh0zW3J0YXZK4aN3It7DD26TXlACuWnwU=
uci add_list network.peernycu.allowed_ips='0.0.0.0/0'
uci add_list network.peernycu.allowed_ips='::/0'
uci set network.peernycu.route_allowed_ips='1'
uci set network.peernycu.endpoint_host=us-nyc.prod.surfshark.com
uci set network.peernycu.endpoint_port='51820'
uci set network.peernycu.persistent_keepalive='25'
uci commit network

uci set network.peerwarp='wireguard_wg0'
uci set network.peerwarp.description=peerwarp
uci set network.peerwarp.public_key=vBa3HK7QXietG64rHRLm085VMS2cAX2paeAaphB/SEU=
uci add_list network.peerwarp.allowed_ips='0.0.0.0/0'
uci add_list network.peerwarp.allowed_ips='::/0'
uci set network.peerwarp.route_allowed_ips='1'
uci set network.peerwarp.endpoint_host=pl-waw.prod.surfshark.com
uci set network.peerwarp.endpoint_port='51820'
uci set network.peerwarp.persistent_keepalive='25'
uci commit network

uci set network.peertorc='wireguard_wg0'
uci set network.peertorc.description=peertorc
uci set network.peertorc.public_key=W9bzkcL3fiV64vDpB4pbrz8QafNn3y5P9Yc/kQvy4TA=
uci add_list network.peertorc.allowed_ips='0.0.0.0/0'
uci add_list network.peertorc.allowed_ips='::/0'
uci set network.peertorc.route_allowed_ips='1'
uci set network.peertorc.endpoint_host=ca-tor.prod.surfshark.com
uci set network.peertorc.endpoint_port='51820'
uci set network.peertorc.persistent_keepalive='25'
uci commit network
/etc/init.d/network restart

To minimize Firewall setup; Consider VPN network as public. Assign VPN interface to WAN zone.

uci add_list firewall.wan.network="wg0"
uci commit firewall
/etc/init.d/firewall restart

Swapping

Uci CLI Peer Swapping

The peer swapping is achieved by placing the desired peer config in the last/bottom order of the `/etc/config/network` file. The high arbitrary number '99' should suffice to place desired network peer at bottom. My personal config has only 15. The resulting command will also be represented in the Wireguard Status, Interface Peer Pages of Luci. Simple command, long description.

From the above install, Toronto Canada is the last peer installed and will be the default route the wg0 vpn tunnels through. By running the below command the Warsaw Poland endpoint takes the bottom position and becomes wg0 vpn tunnel. This is achieved from the network.peerwarp NETWORK not the description=peerwarp! A look at your /etc/config/network file will enlighten your understanding later.

Warsaw

uci reorder network.peerwarp=99;uci commit network;/etc/init.d/network restart

Chicago

uci reorder network.peerchiu=99;uci commit network;/etc/init.d/network restart

Dallas

uci reorder network.peerdalu=99;uci commit network;/etc/init.d/network restart

New York

uci reorder network.peernycu=99;uci commit network;/etc/init.d/network restart

Toranto

uci reorder network.peertorc=99;uci commit network;/etc/init.d/network restart

Common uci commands for introspective users.

ip rule
wg.show
ip route show default
ubus call system board; uci export dhcp; uci export network; uci export firewall

Copyright and Attribution of developed software, tool, logo, names are the right of the following entities respectively.

CC Attribution-Share Alike 4.0 International

Calprainn · April 3, 2022, 1:10pm

I am relatively new to OpenWRT, but have been following this thread for a while and have successfully connected the Surfshark wireguard connection.

Is there a tutorial that allows me to use my OpenWRT router as a separate wireless access point, next to my main router, to pass wirelessly connected devices through the Surfshark wireguard tunnel?

The OpenWRT router (192.168.1.2) is connected directly to my Internet router (192.168.1.1) via LAN.

RuralRoots · April 3, 2022, 2:02pm

With your WG tunnel up, any device attached to your OpenWrt br-lan should run through the tunnel.

Calprainn · April 3, 2022, 3:28pm

Ok thanks, that sounds nice, but this answer does not help me with my question. I would set up my OpenWRT router as a wireless hotspot, providing a separate IP range for connected wireless devices besides my normal router, which surf through the surfshark wireguard connection.

RuralRoots · April 3, 2022, 3:32pm

Bill · April 3, 2022, 3:41pm

May I interject?

Have you already tried this, if not then it should work by default as @RuralRoots said.

I'm typing on a router (Tomato) that is downstream form the WireGuard connection. Good to Go!
My cell phones connected to this same router (Tomato) Good to Go!

The reason is that the (Tomato) is connected to the OpenWRT router's br-lan and MUST tunnel.

I hope this helps

If you have tried and see failure we'll need to dig deeper.
If you have not tried, you won't be hurt by this simple test and see.

Calprainn · April 3, 2022, 4:16pm

Thanks again. In the docs guest wifi example the OpenWRT router is the main router which using the WAN port. In my scenario the OpenWRT router is connected over LAN with my main router. Should I connect the OpenWRT over WAN with my main router?

Unfortunately I do not know how to change the configuration for my situation. As I said, I'm still a little inexperienced with OpenWRT.

Bill · April 3, 2022, 4:24pm

Humm making something easy..

Second router is WAP (wireless access point) 192.168.2.1 > connects to 192.168.1.1 via lan jack DONE!

192.168.1.1 is Wireguarded! connects to Modem > Internet

You can do this then test by connecting you phone to the WAP and hitting
https://surfshark.com/what-is-my-ip

Forgive me.. I see my setup is not you question.

Calprainn · April 3, 2022, 4:50pm

I hope my request does not go beyond the scope here...

My scenario:
MainRouter (192.168.124.1)
OpenWRT (192.168.124.2)
Both connected via LAN port.

Following these instructions (https://openwrt.org/docs/guide-user/network/wifi/guestwifi/guestwifi_dumbap) I've now configured my OpenWRT, including the firewall rules. This router provides now a guest Wifi (192.168.125.1). I can connect to the guest wifi via my cell phone and get an IP address (192.168.125.241) from the guest dhcp server.

Problem: no matter if with or without the Surfshark WG connection, I don't get internet access on the connected mobile.

Translated with www.DeepL.com/Translator (free version)

Bill · April 3, 2022, 4:59pm

I'm on the same page now. I looked at this page
Set up the firewall zone

Edit: I'm confused too. I've got internet via my guest network but not wireguard and my phone is presenting as IPV6.

Perhaps I'll figure this out later.

EDIT 4:
Got it you wont have to stray far.

HINT: Just changed the firewall from Lan to Wan>Wan6>Wiregurard-If
my wireguard If is SSWG for reference.

RuralRoots · April 4, 2022, 4:33am

Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have

uci export network; uci export wireless; uci export firewall

Michael · April 8, 2022, 6:50am

Hello together,
hello @yazdan,

sorry for my bad english, I no native english speaking person

I found this script, cause I´m using openwrt on an APU2E4.
I setup the wireguard manually and it works fine.
Till now I updated the keys manually, if they expired.
So I was happy to have found the script.
BUT
I get an error in "registering key"... The error I get looks like:
{"code":401,"message":"JWT Token not found"}
What can I do? What did I wrong?
The creds are correct, but if I will use the generated keys WG is stopping the connection.

Michael

RuralRoots · April 8, 2022, 7:50am

Try this to resynchronize.

Invoke the script using the -g switch. ./gen-wg-config.sh -g
Run the script again using the -f switch. ./gen-wg-config.sh -f
Run the script a third time using the -g switch. ./gen-wg-config.sh -g

This will retrieve a new token file and authorize your keys.

Michael · April 8, 2022, 6:08pm

@RuralRoots
Thanks alot
now it works like a charme

Michael