Firewall errors using wireguard OpenWrt wiki guide on restart firewall

Installing and Using OpenWrt Network and Wireless Configuration
1

Hello, complete noob here so please ELI5. I setup openvpn server on my openwrt belkin rt3200 behind a main router. It is working fine with a openvpn client on a client router. However now I would like to setup wireguard and was following the wiki but when I put in the command "/etc/init.d/firewall_restart" I get the following errors in putty:

root@openwrt:~# /etc/init.d/firewall restart
Section lan (lan) option 'network' specifies invalid value ''
Section lan (lan) skipped due to invalid options
Section @rule[7] (Allow-IPSec-ESP) option 'dest' specifies invalid value 'lan'
Section @rule[7] (Allow-IPSec-ESP) skipped due to invalid options
Section @rule[8] (Allow-ISAKMP) option 'dest' specifies invalid value 'lan'
Section @rule[8] (Allow-ISAKMP) skipped due to invalid options
Section @forwarding[0] option 'src' specifies invalid value 'lan'
Section @forwarding[0] skipped due to invalid options

Here is my firewall file config:

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'
	option flow_offloading '1'
	option flow_offloading_hw '1'

config zone 'lan'
	option name 'lan'
	list network 'lan'
	list network ''
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list device 'tun+'

config zone 'wan'
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule 'ovpn'
	option name 'Allow-OpenVPN'
	option src 'wan'
	option target 'ACCEPT'

config rule 'wg'
	option name 'Allow-WireGuard'
	option src 'wan'
	option proto 'udp'
	option target 'ACCEPT'
2

field required?

1 Like
3

What does this mean? I'm a noob who is not in tech trying to set this up. Thanks!

4

I assume you have a typo in that config file, looks like that line should be deleted.

1 Like
5

Yes thank you so much, that was it! :joy:
While I've got your attention, does everything else look good for openvpn and wireguard servers running on openwrt?

6

Nevermind, figured it out!

7

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.