Help! Wireguard tunnel config

Installing and Using OpenWrt Network and Wireless Configuration
1

Hi everyone!

I have decided to flash OpenWRT on my GL-iNet MT6000 / Flint 2. I have used DD-WRT in the past and have basic network knowledge but need some help if possible.

All is working well but I have hit an issue regarding my wireguard setup.

I have a Surfshark wireguard tunnel running 24/7 for 2 devices on my lan. Using the native GL firmware, these two devices went via the tunnel by MAC address and the other devices went straight to the WAN.

I have configured the wireguard tunnel and it works for all devices when the target IP is 0.0.0.0/0.

I have set a static IP for each device, removed 0.0.0.0/0. Added the two static addresses and I get no traffic throughput at all. I can see packet traffic on the wireguard interface though.

I have looked into PBR and even tried to lean on ChatGPT but that was rather vague.

Can anyone help me get 192.168.1.200 and 201 to go down the tunnel?

Thanks!

2

First setup a regular Wireguard tunnel (with 0.0.0.0/0 as Allowed IPs)

Do not enable Route Allowed IPs. this will make everything going to the WAN by default

See: WireGuard Client Setup Guide

Then you need Policy Based Routing to route your LAN clients (via MAC address if you are using IPv4 and IPv6) or via IP address if you are IPv4 only.
Either install the full package see:

Or do it manually see:
OpenWRT Policy Based Routing (PBR)

Feel free to ask if you are stuck

3

Thanks!

I have ticked the route all traffic just to test the tunnel and it is working so that’s good. I have unticked that now and traffic is going to the WAN.

I have just installed PBR.

I have service gateways wan and wg0 ticked and the service control is enabled. Is that correct?

The bit I am stuck with now is the policy.

I have created a policy called wg01 VPN.

Local address as 192.168.1.120, one of my tunnelled devices.

Local ports I have left empty.

Now for remote, if I want all traffic on 1.120 to go via the tunnel what do I choose? Do I leave that blank?

Chain is rerouting and the interface at the bottom is wg0.

4

Yes leave it blank

Chain is default (=prerouting)
Interface is wg0

That should do it

Depending on what you did you might need a reboot

5

Ok great thanks. I will give it a go.

Do I need to make any changes to the firewall rules in the Wireguard guide that I made?

6

Not specific for PBR.
If you have a working connection with Route Allowed IPs enabled (meaning everything via the WireGuard tunnel, check with ipleak.net) then you have all the necessary firewall rules in place already.

1 Like
7

Ok so the good news is the device is now using the tunnel and it works.

The bad news is it is failing the DNS leak test and I can see Cloudflare instead of the 2x Surfshark DNS servers set in the wg0 interface setup.

8

That is normal as you did not configure DNS yet.
Just set the DNS policy in the PBR config :slight_smile:

1 Like
9

I have created a DNS policy in PBR.

Local address - 192.168.1.120

I have set the remote DNS as Surfshark's DNS in their config file. No more DNS leaks.

Is that the correct way of forcing the clients using wg0 to use Surfsharks DNS?

10

Yes that is fine.

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Thanks! :slight_smile:

2 Likes
11

Thanks for your help, very much appreciated!

1 Like
12

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.