How to set up Port Forwarding when I have Wireguard Paid VPN Interface?

Installing and Using OpenWrt
1

I’m running OpenWrt on my Wi-Fi router and have configured a WireGuard interface that routes all LAN traffic through my paid VPN provider. That setup is working correctly.

Now I’m trying to add remote access into my home network. For this, I’ve set up a Raspberry Pi as a WireGuard server. I’ve created the necessary port-forwarding and firewall rules on the OpenWrt router, and my DDNS is confirmed working. However, I’m unable to establish a remote WireGuard connection to the Pi, and I’m not sure what I’m missing.

What should I check or adjust to get remote access working in this setup?

uci export network

package network

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fd29:bc64:9b1e::/48'
option packet_steering '1'

config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'

config interface 'wan'
option device 'wan'
option proto 'dhcp'
option peerdns '0'
option type 'bridge'

config interface 'WGINTERFACE'
option proto 'wireguard'
option private_key 'XXXXXX'
option force_link '1'
list addresses '10.65.185.68/32'
list dns '100.64.0.63'

config wireguard_WGINTERFACE
option public_key 'XXXXXX'
option route_allowed_ips '1'
option endpoint_host '###'
option endpoint_port '51820'
list allowed_ips '0.0.0.0/0'
option description ' ch-zrh-wg-001 '
option disabled '1'

config wireguard_WGINTERFACE
option description 'fi-hel-wg-102'
option public_key 'XXXXXX'
list allowed_ips '0.0.0.0/0'
option endpoint_host '###'
option endpoint_port '51820'
option route_allowed_ips '1'

config device
option type 'bridge'
option name 'br-lan2'
option bridge_empty '1'

config interface 'lan2'
option proto 'static'
option device 'br-lan2'
option ipaddr '192.168.71.1'
option netmask '255.255.255.0'

config rule
option in 'lan2'
option src '192.168.71.0/24'
option lookup '4'

config route
option interface 'wan'
option target '0.0.0.0/0'
option table '4'

config wireguard_WGINTERFACE
option description 'fi-hel-wg-101'
option public_key 'XXXXXX'
list allowed_ips '0.0.0.0/0'
option endpoint_host '###'
option endpoint_port '51820'
option disabled '1'

uci export firewall

config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'

config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'

config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'

config rule
option name 'Allow-RPI-Wireguard'
list proto 'udp'
option src 'wan'
option dest 'lan'
list dest_ip '192.168.1.214'
option dest_port '51820'
option target 'ACCEPT'
option family 'ipv4'
list src_ip '0.0.0.0/0'

config rule
option name 'Allow-RPI-SSH'
list proto 'tcp'
option src 'lan2'
list src_ip '192.168.71.0/24'
option dest 'lan'
list dest_ip '192.168.1.214'
option dest_port '22'
option target 'ACCEPT'

config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'

config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'

config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'

config zone
option name 'WGZONE'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'WGINTERFACE'

config include 'pbr'
option fw4_compatible '1'
option type 'script'
option path '/usr/share/pbr/pbr.firewall.include'

config zone
option name 'lan2'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan2'

config forwarding
option src 'lan2'
option dest 'wan'

config redirect
option target 'DNAT'
option name 'forward-RaspberryPiWireguard'
option src 'wan'
option src_dport '51820'
option dest_ip '192.168.1.214'
option dest_port '51820'
option family 'ipv4'
list proto 'udp'
option dest 'lan'

config forwarding
option src 'lan'
option dest 'WGZONE'

config forwarding
option src 'WGZONE'
option dest 'wan'

config rule

config redirect
option dest 'lan'
option target 'DNAT'
option name 'forward-RPI-Wireguard'
option family 'ipv4'
list proto 'udp'
option src 'wan'
option src_dport '51820'
option dest_ip '192.168.1.214'
option dest_port '51820'

Thank you

2

Please re-format and complement your configs

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):

Screenshot 2025-10-20 at 8.14.14 PM

Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall
3

Thank you @brada4

root@OpenWrt:~# ubus call system board
{
        "kernel": "5.15.134",
        "hostname": "OpenWrt",
        "system": "MediaTek MT7621 ver:1 eco:3",
        "model": "D-Link DIR-882 A1",
        "board_name": "dlink,dir-882-a1",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.0",
                "revision": "r23497-6637af95aa",
                "target": "ramips/mt7621",
                "description": "OpenWrt 23.05.0 r23497-6637af95aa"
        }
}
root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'XXXXXX'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'
        option peerdns '0'
        option type 'bridge'

config interface 'WGINTERFACE'
        option proto 'wireguard'
        option private_key 'XXXXXX'
        option force_link '1'
        list addresses '10.65.185.68/32'
        list dns '100.64.0.63'

config wireguard_WGINTERFACE
        option public_key 'XXXXXX'
        option route_allowed_ips '1'
        option endpoint_host '####'
        option endpoint_port '51820'
        list allowed_ips '0.0.0.0/0'
        option description ' ------- '
        option disabled '1'

config wireguard_WGINTERFACE
        option description '-------'
        option public_key 'XXXXXX'
        list allowed_ips '0.0.0.0/0'
        option endpoint_host '####'
        option endpoint_port '51820'
        option route_allowed_ips '1'

config device
        option type 'bridge'
        option name 'br-lan2'
        option bridge_empty '1'

config interface 'lan2'
        option proto 'static'
        option device 'br-lan2'
        option ipaddr '192.168.71.1'
        option netmask '255.255.255.0'

config rule
        option in 'lan2'
        option src '192.168.71.0/24'
        option lookup '4'

config route
        option interface 'wan'
        option target '0.0.0.0/0'
        option table '4'

config wireguard_WGINTERFACE
        option description '----'
        option public_key 'XXXXXX'
        list allowed_ips '0.0.0.0/0'
        option endpoint_host '####'
        option endpoint_port '51820'
        option disabled '1'

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
        option channel 'auto'
        option band '2g'
        option cell_density '0'
        option country 'US'
        option htmode 'HT40'

config wifi-device 'radio1'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
        option channel 'auto'
        option band '5g'
        option htmode 'HT40'
        option country 'US'
        option cell_density '0'
        option disabled '0'

config wifi-iface 'wifinet2'
        option device 'radio0'
        option mode 'ap'
        option ssid 'wi--fi'
        option encryption 'psk2'
        option key 'XXXXXX'
        option network 'lan'

config wifi-iface 'wifinet1'
        option device 'radio0'
        option mode 'ap'
        option ssid 'wi-fi'
        option encryption 'psk2'
        option key 'XXXXXX'
        option network 'lan2'

config wifi-iface 'wifinet3'
        option device 'radio1'
        option mode 'ap'
        option ssid 'wi-fi'
        option encryption 'psk2'
        option key 'XXXXXX'
        option network 'lan2'
        option disabled '1'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'
        list server '10.64.0.1'
        option strictorder '1'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option force '1'
        list dhcp_option '6,192.168.1.1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config host
        option ip '192.168.71.117'
        option mac 'XXXXXX'
        option name 'CMG-47679213857'
        option dns '1'

config host
        option name 'RaspberryPi'
        option ip '192.168.1.139'
        option mac 'XXXXXX'

config dhcp 'lan2'
        option interface 'lan2'
        option start '100'
        option limit '150'
        option leasetime '12h'
        list dhcp_option '6,192.168.71.1'

config host
        option name 'RaspberryPiWireGuard'
        option dns '1'
        option mac 'XXXXXX'
        option ip '192.168.1.214'

root@OpenWrt:~# cat /etc/config/firewall
4

Start by upgrading to a supported release using eg luci-app-attendedsysupgrade

5

Since raspberry does wireguard you have to forward ports there. (based on your viable dnat rule)

6

Lets first remove this:

Now that this is gone, you want to open port 51820 for your main wireguard server on wan.

Make a traffic rule:

config rule
option name 'allow-WGZONE-wan'
option src 'wan'
option dest_port '51820'
option proto 'udp'
option target 'ACCEPT'

to forward inside the wgserver:

config redirect
option target 'DNAT'
option name 'forward-RPI-Wireguard'
option family 'ipv4'
list proto 'udp'
option src 'WGZONE'
option src_dport '51820'
option dest_ip '192.168.1.214'
option dest_port '51820'
option dest 'lan'

As for the created routes in network lan2, maybe they are not needed, not sure why this routing needs to exist as wan has the default route checked, other interfaces should have it unchecked or need option defaultroute '0' except for interface lan since it is a special interface in case of a conflict.

As for this ip:

That makes me worried, that is usually a cgnat address, are you sure this is not cgnat?

In case I misunderstood, and your intention was not to portforward through the wireguard tunnel in OpenWrt and then connect through the wireguard server of the Raspberry pi, then you need a different listen port because if you NAT translate 51820 your normal wireguard server will no longer work, but redirect to the rpi.

7

Thank you @xize! A few things.

To clarify: WGZONE is a WireGuard client interface for a paid VPN service running on OpenWRT.

I’m trying to set up a WireGuard server on a Raspberry Pi inside my LAN zone so I can connect remotely from my phone.

The IP address shown earlier is not CGNAT—it’s an internal IP from the paid VPN provider.

I created a policy-based route to ensure the WireGuard server’s traffic exits through the WAN zone instead of the WG client interface, but the server still isn’t reachable.

Any guidance would be appreciated.

8

Does the rule look like this?

config policy
        option name 'wg_server'
        option proto 'udp'
        option src_port '51820'
        option src_addr '192.168.1.214'
	    option interface 'wan'