Help troubleshooting Wireguard firewall issues

Installing and Using OpenWrt
1

I configured wireguard on using script "a)" from here. Checking with wireshark I see "Handshake Initiation" packets coming in on the WAN port (eth1) but the RX/TX for the wg_lan interface remain at zero.

Here is my firewall configuration:

config defaults
        option flow_offloading '1'
        option syn_flood '1'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone 'lan'
        option name 'lan'
        option network 'lan wg_lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone 'wan'
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone 'docker'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option name 'docker'
        list network 'docker'

config rule 'wg'
        option name 'Allow-WireGuard-lan'
        option src 'wan'
        option dest_port '51820'
        option proto 'udp'
        option target 'ACCEPT'

and my network:

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdb0:cb02:8826::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth2'
        list ports 'eth0'

config device
        option name 'eth2'
        option macaddr '96:53:ff:a1:d5:28'

config device
        option name 'eth0'
        option macaddr '96:53:ff:a1:d5:28'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.10.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device
        option name 'eth1'
        option macaddr '<redacted>'

config interface 'wan'
        option device 'eth1'
        option proto 'dhcp'

config interface 'wan6'
        option device 'eth1'
        option proto 'dhcpv6'

config interface 'docker'
        option device 'docker0'
        option proto 'none'
        option auto '0'

config device
        option type 'bridge'
        option name 'docker0'

config interface 'wg_lan'
        option proto 'wireguard'
        option private_key '<redacted>'
        option listen_port '51820'
        list addresses '10.0.5.1/24'
        option mtu '1420'

config wireguard_wg_lan
        option public_key '1tra<redacted>'
        option preshared_key '<redacted>'
        option description '2_lan_Borked'
        list allowed_ips '10.0.5.2/32'
        option route_allowed_ips '1'
        option persistent_keepalive '25'

config wireguard_wg_lan
        option public_key 'uSMY<redacted>'
        option preshared_key '<redacted>'
        option description '3_lan_Pixel'
        list allowed_ips '10.0.5.3/32'
        option route_allowed_ips '1'
        option persistent_keepalive '25'

config wireguard_wg_lan
        option public_key 'Ugvj<redacted>'
        option preshared_key '<redacted>'
        option description '4_lan_esphome'
        list allowed_ips '10.0.5.4/32'
        option route_allowed_ips '1'
        option persistent_keepalive '25'

config wireguard_wg_lan
        option public_key 'YbpT<redacted>'
        option preshared_key '<redacted>'
        option description '5_lan_spare'
        list allowed_ips '10.0.5.5/32'
        option route_allowed_ips '1'
        option persistent_keepalive '25'
2

What is the output of:

ubus call system board
wg show

And can you show us one of your remote peer configs?

3 
{
        "kernel": "6.1.61",
        "hostname": "OpenWrt",
        "system": "ARMv8 Processor rev 0",
        "model": "FriendlyElec NanoPi R6S",
        "board_name": "friendlyelec,nanopi-r6s",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "SNAPSHOT",
                "revision": "r0-d3e947b",
                "target": "rockchip/armv8",
                "description": "OpenWrt SNAPSHOT r0-d3e947b"
        }
}

interface: wg_lan
  public key: 0QRw<redacted>
  private key: (hidden)
  listening port: 51820

peer: uLun<redacted>
  preshared key: (hidden)
  allowed ips: 10.0.5.2/32
  persistent keepalive: every 25 seconds

peer: uSMY<redacted>
  preshared key: (hidden)
  allowed ips: 10.0.5.3/32
  persistent keepalive: every 25 seconds

peer: Ugvj<redacted>
  preshared key: (hidden)
  allowed ips: 10.0.5.4/32
  persistent keepalive: every 25 seconds

peer: YbpT<redacted>
  preshared key: (hidden)
  allowed ips: 10.0.5.5/32
  persistent keepalive: every 25 seconds

and for the peer's config I am using the config generated at the bottom of the "Interfaces » wg_lan » Edit peer" page after pressing "Generate new key pair":
(for some reason I need to manually enter the address field after importing the config)

[Interface]
PrivateKey = <redacted>
# ListenPort not defined

[Peer]
PublicKey = 0QRw<redacted>
# PresharedKey not used
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = <redacted>.org:51820
PersistentKeepAlive = 25
4

This device is not currently supported by the official OpenWrt project.

It appears you are using firmware that is not from the official OpenWrt project.

When using forks/offshoots/vendor-specific builds that are "based on OpenWrt", there may be many differences compared to the official versions (hosted by OpenWrt.org). Some of these customizations may fundamentally change the way that OpenWrt works. You might need help from people with specific/specialized knowledge about the firmware you are using, so it is possible that advice you get here may not be useful.

You may find that the best options are:

  1. Install an official version of OpenWrt, if your device is supported (see https://firmware-selector.openwrt.org).
  2. Ask for help from the maintainer(s) or user community of the specific firmware that you are using.
  3. Provide the source code for the firmware so that users on this forum can understand how your firmware works (OpenWrt forum users are volunteers, so somebody might look at the code if they have time and are interested in your issue).

If you believe that this specific issue is common to generic/official OpenWrt and/or the maintainers of your build have indicated as such, please feel free to clarify.

1 Like
5

Yes I am aware, I am using https://github.com/mj22226/openwrt, which to my knowledge is just kernel patches for rockchip boards and sane defaults for those boards.

I do not believe the fork I am using is the cause of this issue, but if it's out of scope for this forum could I get some general guidance on troubleshooting steps for wireguard?

6

No, there is probably more to it than just a few kernel patches.
For example...

this is not valid syntax in the last several versions of OpenWrt (it was last valid in either 18.06 or 19.07, but since 21.02 each network must be on its own line).

This is obviously a seemingly small difference, but the fact is that the FriendlyElec builds are materially different than what is provided by the official OpenWrt project.

7

Note this is not a FriendlyElec firmware, it is forked directly from openwrt and I believe maintained independently. But I understand your point

1 Like
8

I see... well, then the maintainer of the build should be able to help you, then.

1 Like
9

Could I just get help locating relevant logs, I do not believe the maintainers will be of any help seeing as the readme has not been edited from master and github issues are disabled.

10

Wireguard doesn't really do any logging unless logs are enabled at compile time.

I do see that you're missing an address on your remote peer's interface -- that is required (and must match the respective peer config from the 'server' config). Also, your remote peer's config shows that a preshared key is not used, yet you have psk's defined in each of your peers on the 'server' -- that mismatch will prevent a connection from working (best option is to remove the PSK from the 'server' side). And your remote peer also has the IPv6 ::/0 in the allowed IPs... you can remove that unless you are actually using IPv6 through the tunnel.

Last thing -- you need to verify that you do indeed have a public IP on your router's wan interface. If you're behind NAT/CG-NAT, it may be game over.

11

I manually added the 10.0.5.x address to my client's config and disabled IPv6. I have a public IPv4 address and can see the incoming handshake traffic from the client on the router's WAN port. Still no luck, oh well, thanks for your help, I might give OpenVPN a go instead, little bit of overhead is better than nothing I guess.