Help me to setup Wireguard

lleachii · February 24, 2023, 12:10pm

???

screenshot23

To be 100% clear, Deactivate this before testing with OpenWrt.

sunilalw2007 · February 24, 2023, 12:11pm

Yes, you are right. its always deactivated. my focus to run OpenWrt using the same.

lleachii · February 24, 2023, 1:08pm

This is invalid and not needed on LAN. Remove. Your gateway is on WAN.

Please inform if you add/change other configs.

sunilalw2007 · February 24, 2023, 1:43pm

Applied. also i reconfigure vpn again

Please verify firewall and network info as below

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option packet_steering '1'
        option ula_prefix '<an_ipv6>'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.1.1'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'
        option metric '20'
        option peerdns '0'
        list dns '1.1.1.1'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'
        option reqaddress 'try'
        option reqprefix 'auto'

config interface 'wg0'
        option proto 'wireguard'
        option private_key 'U<private_key>='
        list addresses '<ip_v4>'
        list addresses '<ip_v6>'
        option peerdns '0'
        list dns '1.1.1.1'

config wireguard_wg0
        option description 'Cloudflare'
        option public_key 'bm<public_key>='
        list allowed_ips '0.0.0.0/0'
        list allowed_ips '::/0'
        option endpoint_host 'engage.cloudflareclient.com'
        option endpoint_port '2408'

Firewall:

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'vpn'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'wg0'
        option input 'REJECT'
        option masq '1'

config forwarding
        option src 'lan'
        option dest 'vpn'

Wg:

interface: wg0
  public key: a<public-key>=
  private key: (hidden)
  listening port: 12345

peer: b<pear_public_key>=
  endpoint: 162.159.192.1:2408
  allowed ips: 0.0.0.0/0, ::/0

Please suggest
Thanks a lot @lleachii

lleachii · February 24, 2023, 1:53pm

WHY!?!?!?

Use IP for peer instead of hostname

Screenshot shows your real Public IP!

Return to config.

I'm not sure why you made changes that aren't necessary. I'll Private Message you.

lleachii · February 24, 2023, 2:00pm

Remove from WG config.

Not sure how the config returned.

As I mentioned in the Private Message:

The config was 100% OK the first time, all you had to do was remove the incorrect gateway setting.

Instead, you messed up the configs (no clue why) by "redoing" it.

Just use the first config as a reference.

lleachii · February 24, 2023, 3:38pm

@sunilalw2007 ,

Please do not use Private Message for the issue.

Per your message:

Could you please verify it once again

2 things:

Again, put this back in WG peer config

Remove these.

Please do not add configs we did not discuss, they are difficult to follow.

Last, please include the output of wg each time. Thanks.

sunilalw2007 · February 24, 2023, 3:53pm

I have just change my firewall vpn to wan and disable/enable my WAN interface and automatically its up, after it i have again change firewall rule to vpn and now I have applied DNS 1.1.1.1 its also working.

many many thanks to you @lleachii for your time given on it.

lleachii · February 24, 2023, 3:54pm

Congratulations!

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.

Remote access/VPN is a second Wireguard interface. Create a new thread if you need to.

sunilalw2007 · February 24, 2023, 4:23pm

Hi Guys,
I have a configured account from Cloudflare I want to use the same configure on my OpenWrt, how I can do, please advice.

Thanks

psherman · February 24, 2023, 4:24pm

What specifically are you trying to configure? Vpn/cloud flare warp? Something else?

sunilalw2007 · February 24, 2023, 4:26pm

WireGuard VPN with cloudflare warp using existing account

psherman · February 24, 2023, 4:42pm

There are several recent threads on this topic. Have you used the forum search to find them? If not, please do and then let us know if you encounter problems.

sunilalw2007 · February 24, 2023, 4:44pm

Yes, I have checked and tried. no luck. you can share if you believe it will work

psherman · February 24, 2023, 4:48pm

If you have tried, but were unsuccessful, please share your configs so we can review.

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/network
cat /etc/config/firewall

sunilalw2007 · February 24, 2023, 4:54pm

I am already done and its working fine, I just want to replace public and private keys from my existing Cloudflare account, that's it. Question is, how i can extract public and private key from my Cloudflare account.

psherman · February 24, 2023, 4:57pm

That was not clear from your original question.

Have you looked at the cloud flare documentation?

sunilalw2007 · February 24, 2023, 5:02pm

Yes, still checking.. nothing found yet

lleachii · February 24, 2023, 6:08pm

This isn't OpenWrt related.

I provided it already.

See: https://github.com/ViRb3/wgcf#change-license-key

You don't "replace public and private keys" from another account. That would be kinda insecure.

BTW, You asked this already. Please refrain from making multiple posts for the same issue.

So what's the issue?
Is your other account a Plus account (i.e. paid)?

In a previous thread, you told me you didn't have a paid VPN account.

If this is about a second Wireguard interface for remote access, you don't use Cloudflare, you create it yourself!

Borromini · February 24, 2023, 6:38pm

@psherman As @lleachii points out this is related to the other thread linked to, it seems they should be merged for clarity. I do agree asking how to work with Cloudflare itself has nothing to do with OpenWrt. Which the OP fully seems to realise.