Hello everyone. Now my device has internet via Wi-Fi (the internet comes in via the ethernet and goes out via Wi-Fi). There is also a configured and working wireguard connection on my device. Tell me what needs to be configured so that my Wi-Fi clients can also go through the wireguard connection. Thank you.
Thanks for this guide. I reconfigured my device according to this guide. Internet on my wi-fi client appeared. But when I turn on wireguard, the Internet disappears. At the same time, ping from my wi-fi client shows the following.
PING google.com (209.85.233.113) 56(84) bytes of data.
From _gateway (192.168.2.1) icmp_seq=1 Destination Port Unreachable
From _gateway (192.168.2.1) icmp_seq=2 Destination Port Unreachable
From _gateway (192.168.2.1) icmp_seq=3 Destination Port Unreachable
From _gateway (192.168.2.1) icmp_seq=4 Destination Port Unreachable
From _gateway (192.168.2.1) icmp_seq=5 Destination Port Unreachable
^C
--- google.com ping statistics ---
5 packets transmitted, 0 received, +5 errors, 100% packet loss, time 4006ms
root@OpenWrt:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fde7:9c55:33d1::/48'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option ipaddr '192.168.8.2'
option gateway '192.168.8.1'
list dns '192.168.8.1'
option metric '0'
config interface 'wg0'
option proto 'wireguard'
list addresses '10.8.0.34/24'
list dns '1.1.1.1'
option private_key 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
option metric '0'
option auto '0'
config wireguard_wg0
option private_key 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
option preshared_key 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
list allowed_ips '0.0.0.0/0'
option route_allowed_ips '1'
option endpoint_host '94.142.137.88'
option persistent_keepalive '25'
option endpoint_port '51820'
option public_key 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
config device
option type 'bridge'
option name 'br-guest'
option bridge_empty '1'
config interface 'guest'
option proto 'static'
option device 'br-guest'
option ipaddr '192.168.2.1'
option netmask '255.255.255.0'
root@OpenWrt:~# cat /etc/config/firewall
config defaults
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
option input 'REJECT'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
list network 'lan'
option forward 'ACCEPT'
option masq '1'
config zone
option name 'guest'
option output 'ACCEPT'
option forward 'REJECT'
list network 'guest'
option input 'REJECT'
config forwarding
option src 'guest'
option dest 'lan'
config rule
option name 'Guest_DHCP'
list proto 'udp'
option src 'guest'
option dest_port '67-68'
option target 'ACCEPT'
config rule
option name 'Guest_DNS'
option src 'guest'
option dest_port '53'
option target 'ACCEPT'
config rule
option name 'Block_Guest_from_Lan'
option src 'guest'
option dest 'lan'
list dest_ip '192.168.8.0/24'
option target 'REJECT'
That all looks normal. Like many sites, the web server refuses to use http instead it promoted the connection to https. It should have continued to connect to https://duckduckgo.com If you specify https in the first place, does it just fail immediately? That could be the VPN server blocking that site.
Thanks everyone! The site started opening when I activated MSS clamping on the lan zone or you could also set MTU < 1500 on the clients (for example 1420). In the end, I left MSS enabled.
I have one last question about setting up my device. How can I make the web panel available from the guest network?