Error: Nexthop has invalid gateway

Hello, I am using a GL-x750v2 with original Firmware (which is OpenWRT)

I actually got LTE and Wireguard to work, now I am missing a static route to reach my home network.

root@GL-X750:~# ip route
default via dev 3g-modem_1_1_2 proto static metric 40 dev 3g-modem_1_1_2 proto kernel scope link src via dev 3g-modem_1_1_2 dev wg0 scope link dev br-lan proto kernel scope link src

so I tried to add this but got the error message:

root@GL-X750:~# ip route add via dev wg0
Error: Nexthop has invalid gateway.

What am I doing wrong or what is missing?

Thanks for your help

It is not, if you want to report an error or get help, you will have to install real OpenWrt - we can't help you with random vendor forks.

It appears you are using firmware that is not from the official OpenWrt project.

When using forks/offshoots/vendor-specific builds that are "based on OpenWrt", there may be many differences compared to the official versions (hosted by Some of these customizations may fundamentally change the way that OpenWrt works. You might need help from people with specific/specialized knowledge about the firmware you are using, so it is possible that advice you get here may not be useful.

You may find that the best options are:

  1. Install an official version of OpenWrt, if your device is supported (see
  2. Ask for help from the maintainer(s) or user community of the specific firmware that you are using.
  3. Provide the source code for the firmware so that users on this forum can understand how your firmware works (OpenWrt forum users are volunteers, so somebody might look at the code if they have time and are interested in your issue).

If you believe that this specific issue is common to generic/official OpenWrt and/or the maintainers of your build have indicated as such, please feel free to clarify.


Apart from slh's correct comment on the firmware, you are getting a valid error, as you are using a gateway which doesn't exist in your routing table. Furthermore you already have a route for over wg.


I do understand all of you not beeing able to support all various branches of openwrt, but in this case I would assume to have a system/ip/network problem so I think you could help me on this anyway and would be very kind.

My Config is

Router IP
Wireguard IP of the router
Wireguard "server" ip is
Wireguard "server" lokal network is 192.168.1.x
the connection to wireguard has been established but no ping is working

I did use traceroute to check where the problem is but no clue on this:

root@GL-X750:~# traceroute
traceroute to (, 30 hops max, 38 byte packets
 1  *  *  *
 2 (  64.992 ms  18.266 ms  21.062 ms
 3 (  26.280 ms  20.073 ms (  20.993 ms
 4  *  *  *
 5 (  43.918 ms  25.888 ms  28.611 ms
 6  *  *  *
 7  *  *  *
 8  *  *  *
 9  *  *^X^C

Thanks for your help, what else information would you need

Your wireguard interface needs an IP that includes the other end of the tunnel I suggest to make it easy to remember that it is the gateway to the LAN. You'll need to install that route on the home router to have fully symmetric routing.

In other words:
Route: via
Route: via

You can place the wg tunnel interfaces in the lan firewall zone if you trust everything on both LANs. Make sure intra-zone forwarding is enabled on lan, which is the default.

1 Like

this is not accepted, the wireguard allows only as IP of the WG-Interface, but this is not the problem because same at smartphone and works fine.

The routes you can see here:

root@GL-X750:~# ip route
default via dev 3g-modem_1_1_2 proto static metric 40 dev 3g-modem_1_1_2 proto kernel scope link src via dev 3g-modem_1_1_2 dev wg0 scope link dev br-lan proto kernel scope link src

trying to add this last hop is like this

root@GL-X750:~# ip route add via
Error: Nexthop has invalid gateway.

BUT at the end I cannot even ping the (wg-server) but the handshake did take place:

  allowed ips:,
  latest handshake: 1 minute, 50 seconds ago
  transfer: 1.17 MiB received, 62.02 KiB sent

My impression is you have mixed up addresses....
As a first reminder, the next hop needs to be on link. Either an address from the subnet or a peer address.

As an example: if you have on the device you can add any route via an address out of that subnet. The only exception is if you add multiple host routes and the os supports recursive route lookups.

Anyway as far as I can see from the first route table you posted is that is already the subnet on the wg0 interface. Maybe this is just a typo in your interface config. Please share the relavant parts of etc/config/network and how do you bring up the wireguard interface.

PS: yeah even you use a fork of openwrt a invalid next hop is an invalid next hop :roll_eyes:

Here config/network:

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr ''
        option netmask ''
config interface 'lan'
        option type 'bridge'
        option ifname 'eth1'
        option proto 'static'
        option netmask ''
        option ip6assign '60'
        option hostname 'GL-X750-736'
        option ipaddr ''

Wireguard I set up at the GUI/Webinterface like this:

PrivateKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=
ListenPort = 51820
Address =
PublicKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=
AllowedIPs =,
Endpoint =

I did not set up any routes myself, they have been set up automatically.

Another problem could be IPTABLES? Or not the cause since I cannot even ping the (the wg-server)?

Firewall? Did not change anything I know how this would be done in luci interface but their interface does not show firewall zones. could you tell me how i check using the cli?
these are the only options at the webinterface concerning the firewall:

I really do appreciate all your help

Just for me to recap:

  • You do have control over both ends?
  • is LAN-A using 192.168.33.A for wg
  • is LAN-B using 192.168.33.B for wg, and therefor
  • is the subnet for the wireguard tunnel

So LAN-A should have a route via 192.168.33.B
and LAN-B should have a route via 192.168.33.A

Both sites should also have dev wg-foo and 192.168.33.X/32 dev wg-foo.

Check with ip addr and wg the assigned addresses, status of the peers. and then with ip route again your route table.

Not quiet sure about the defaults but if your wireguard interface config has option route_allowed_ips '1' then the networks listed in allowed_ips will get an route entry.
(You could for testing purpose disable that and add routes manually.)

Regarding the firewall: If you have not added/changed anything then this is in either way an additional issue.
For a quick and dirty, and non persistent test:
iptables -I INPUT 1 -i wg-foo -j ACCEPT, and
iptables -I FORWARD 1 -i wg-foo -j ACCEPT, and
iptables -I FORWARD 2 -o wg-foo -j ACCEPT
to simple have in and out rules at the very beginning.
This way you can at least check if traffic goes trough the tunnel or not.

How you setup proper firewall rules on your GL devices you need to check for your self, but maybe my points give a a few hints how and where to continue... good luck.

On a working wireguard client-server pair one would, on the client (mine a GL-X750 running 21.02.3 OpenWRT called gateway), find the only default route via the wireguard interface (mine called vpn) like:

root@gateway:~# ip -4 route
default dev vpn scope link

Not sure why you do not get such one.
I do notice your only default route is static:

root@GL-X750:~# ip route
default via dev 3g-modem_1_1_2 proto static metric 40

I do not have such static one to mobile interface.
I do have (when wireguard is inactive):

root@gateway:~# ip -4 route 
default via dev wwan0  src

Perhaps GL-INET works different (which OpenWRT version?) and perhaps it (or you?) added a static default route?

ip -4 route
default via dev 3g-modem_1_1_2 proto static metric 40 dev 3g-modem_1_1_2 proto kernel scope link src via dev 3g-modem_1_1_2 dev wg0 scope link dev br-lan proto kernel scope link src

My Verision (they put on the device)

root@GL-X750:~# cat /etc/openwrt_release
DISTRIB_DESCRIPTION='OpenWrt 19.07.8 r11364-ef56c85848'

I did not add any route, the wg interface shows "green status" and there is a tiny bit of traffic, but hardly any (Upload / Download22.12 KB / 632 B) in 1 min.

I still can NOT ping (=wg server)

and yes I did try using plain openWRT before ... had a lot more trouble like no roming in greece possible and so on

I did check the addresses:
LAN A = with the server using
this (wireguard) server uses as wg interface address.
here the wireguard server ip routes:

wireguard-SERVER:~$ ip route
default via dev eth0 proto dhcp src metric 202
default via dev wlan0 proto dhcp src metric 303 dev vethee31619 scope link src metric 208 dev veth5796082 scope link src metric 210 dev docker0 proto kernel scope link src linkdown dev br-4db4c8c735b6 proto kernel scope link src dev eth0 proto dhcp scope link src metric 202 dev wlan0 proto dhcp scope link src metric 303 dev wg0 scope link dev wg0 scope link dev wg0 scope link dev wg0 scope link dev wg0 scope link dev wg0 scope link dev wg0 scope link dev wg0 scope link

(side note: connecting with smartphone/notebook from anywhere using wg works just fine)

LAN B = (with the GL-X750v2 as LTE router) which has the address
this LTE router has the wg interface address

here the network:
on the home network all is set up, the only problem is the LTE Router

and trying to add the second route you said:

root@GL-X750:~# ip -4 route
default via dev 3g-modem_1_1_2 proto static metric 40 dev 3g-modem_1_1_2 proto kernel scope link src via dev 3g-modem_1_1_2 dev br-lan proto kernel scope link src
root@GL-X750:~# ip route add via
Error: Nexthop has invalid gateway.

Wireguard config:
Client = LTE Router (GL-x750v2)

root@GL-X750:~# wg show
interface: wg0
  public key: G8rN......................H71Qk1I=
  private key: (hidden)
  listening port: 51820

peer: xxR9......................kZuiTRI=
  allowed ips:
  latest handshake: 1 minute, 10 seconds ago
  transfer: 25.49 KiB received, 18.89 KiB sent
  persistent keepalive: every 25 seconds

and WG-Server at homeLAN

On regular OpenWrt, configuring a wireguard tunnel interface with a /24 IP is possible, and it will then appear in the routing table with the other "real" interfaces, and you can use addresses within that /24 as gateways to the LANs at remote sites (note you also have to include those LANs in allowed_ips on your end.

For some reason this OS is not starting up the tunnel properly.


Maybe you can try
ip route add default wg0 metric 20
and optionally
ip route del default via dev 3g-modem_1_1_2
not sure if this helps.
Basically change the default route via modem to a better one via wireguard.

I don't know if OP wants to redirect all Internet use through the VPN or just have site to site LAN access. If you do set allowed_ips to and route_allowed_ips, the wireguard programs will properly set up the routes to redirect all Internet use:

  • A single host route to the wireguard server via the regular WAN (LTE modem here)
  • and two split /1 routes that send all other Internet use into the tunnel
1 Like

correct ... maybe :
ip route add via wg0 metric 20
would be accepted?

When the default route is the tunnel you don't need to enter other LANs separately, they're already covered. The router at the other end will decide if the requested destination IP is a LAN or the Internet.

I did change the wg-client (lte router) IP to**/24** that helped pinging one way

My problem is, I can ping from the openwrt wireguard client to the rest, but not from my LAN (1.0/24) to remote lan (66.0/24)

LAN address:
WG-Interface (wg server)

LTE Router

LAN address:


66.1 --> 1.94   OK
66.1 --> 33.1   OK
1.94 --> 33.9   FAIL
1.94 --> 66.1   FAIL

here the fw config:

and here pictures that show the LUCI Webinterface (interfaces / firewall)
This is how the LUCI config looks like:
interfaces: interfaces — ImgBB

1 Like