I may have a problem w my WAN interface wrt WG/Roadwarrior access?

Continuing the discussion from Completely unable to get WireGuard running:

I'm supposed to have a static IP via my 5G ISP. As you can see, they've done this "static" route via DHCP.

According to the previous thread, this won't work w Wireguard?

I'm only starting to try setting up WG.
Using....
https://openwrt.org/docs/guide-user/services/vpn/wireguard/basics

.... Installed wg0 interface......

.... Restarted wg0 interface (per instructions).
No interfaces shown on Luci / Wireguard Status.

Do I need to completely reboot OpenWrt?

What VPN setup is possible given my type of WAN interface (which I cannot change)?

Sorry, I know there are TWO questions in this post.....

.

I've had a look at /etc/config/wgserver....

Should "/root/wg.key" & "/root/wg.pub" be visible? There's nothing in /root.

root@OpenWrt:/etc/config# cat wgserver

config server
    option port_start '51820'
    option port_end '52820'
    option base_prefix_ipv4 '10.0.0.1/24'
    option base_prefix_ipv6 '2002::/64'
    option wg_key '/root/wg.key'
    option wg_pub '/root/wg.pub'
    option wg_tmp_key '1'
    option timeout_handshake '600'

config babeld_hotplug
    option rxcost '1024'

config olsrd_hotplug
    option LinkQualityMult 'default 0.1'

Probably best to start over this does not come close.

It looks like you want to setup a WireGuard server, see:
https://openwrt.org/docs/guide-user/services/vpn/wireguard/server

You do appear to have a proper public IP on your wan, so that is good. While it doesn't rule out the ISP blocking ports/protocols, it's not terribly likely to be the issue.

That said, how did you arrive at the WG config you shared? It doesn't resemble the necessary syntax in any way, shape, or form.

As @egc suggested, start over with the guide provided.

wg0 interface was created via Network / Interfaces / .

Keys were generated via the [ Generate New Key Pair ] button, & IP address filled in. Only I don't know where the Key files were generated, certainly not in /root.

Previously I was following the Basics Guide, which was obv not enough....

https://openwrt.org/docs/guide-user/services/vpn/wireguard/basics

.... I did generate Key files, but when I saw the button in GUI, I deleted Keys already generated, used GUI button for keys. Now Keys ARE in GUI/Luci, but NOT on filesystem....

I restarted OpenWrt box, then found the wg0 interface listed under the Wireguard status page..... at startup, but disappeared later. wg0 DOES have "Start Interface at Startup" enabled. I seem to remember someone else on this forum having same "wg0 disappearing" issue.

I need clarification re the server setup. Not enough info for me....
https://openwrt.org/docs/guide-user/services/vpn/wireguard/server

.... All these Env Vars are set. I assume these Env Vars NEED to be scripted for use @ load/startup time, however no suggestions about WG startup scripting is given.

No, those are simply for a single-use runtime script to generate the UCI config.

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/firewall
1 Like

( I hope I've redacted everything I need to ).

ubus call system board.....

root@OpenWrt:~# ubus call system board
{
        "kernel": "5.15.134",
        "hostname": "OpenWrt",
        "system": "ARMv8 Processor rev 4",
        "model": "FriendlyElec NanoPi R4S",
        "board_name": "friendlyarm,nanopi-r4s",
        "rootfs_type": "ext4",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.0",
                "revision": "r23497-6637af95aa",
                "target": "rockchip/armv8",
                "description": "OpenWrt 23.05.0 r23497-6637af95aa"
        }
}

cat /etc/config/network......

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdbe:1c56:5a7f::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth1'

config device
        option name 'eth1'
        option macaddr '****'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device
        option name 'eth0'
        option macaddr '*****'

config interface 'wan'
        option device 'eth0'
        option proto 'dhcp'

config interface 'wan6'
        option device 'eth0'
        option proto 'dhcpv6'

config interface 'wg0'
        option proto 'wireguard'
        option private_key 'qGf8****Qb1c='
        list addresses '1.1.1.1'

cat /etc/config/firewall....
(I have not done any firewall config).

root@OpenWrt:~# cat /etc/config/firewall
config defaults
        option syn_flood        1
        option input            REJECT
        option output           ACCEPT
        option forward          REJECT
# Uncomment this line to disable ipv6 rules
#       option disable_ipv6     1

config zone
        option name             lan
        list   network          'lan'
        option input            ACCEPT
        option output           ACCEPT
        option forward          ACCEPT

config zone
        option name             wan
        list   network          'wan'
        list   network          'wan6'
        option input            REJECT
        option output           ACCEPT
        option forward          REJECT
        option masq             1
        option mtu_fix          1

config forwarding
        option src              lan
        option dest             wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
        option name             Allow-DHCP-Renew
        option src              wan
        option proto            udp
        option dest_port        68
        option target           ACCEPT
        option family           ipv4

# Allow IPv4 ping
config rule
        option name             Allow-Ping
        option src              wan
        option proto            icmp
        option icmp_type        echo-request
        option family           ipv4
        option target           ACCEPT

config rule
        option name             Allow-IGMP
        option src              wan
        option proto            igmp
        option family           ipv4
        option target           ACCEPT

# Allow DHCPv6 replies
# see https://github.com/openwrt/openwrt/issues/5066
config rule
        option name             Allow-DHCPv6
        option src              wan
        option proto            udp
        option dest_port        546
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-MLD
        option src              wan
        option proto            icmp
        option src_ip           fe80::/10
        list icmp_type          '130/0'
        list icmp_type          '131/0'
        list icmp_type          '132/0'
        list icmp_type          '143/0'
        option family           ipv6
        option target           ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Input
        option src              wan
        option proto    icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        list icmp_type          router-solicitation
        list icmp_type          neighbour-solicitation
        list icmp_type          router-advertisement
        list icmp_type          neighbour-advertisement
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Forward
        option src              wan
        option dest             *
        option proto            icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-IPSec-ESP
        option src              wan
        option dest             lan
        option proto            esp
        option target           ACCEPT

config rule
        option name             Allow-ISAKMP
        option src              wan
        option dest             lan
        option dest_port        500
        option proto            udp
        option target           ACCEPT


### EXAMPLE CONFIG SECTIONS
# do not allow a specific ip to access wan
#config rule
#       option src              lan
#       option src_ip   192.168.45.2
#       option dest             wan
#       option proto    tcp
#       option target   REJECT

# block a specific mac on wan
#config rule
#       option dest             wan
#       option src_mac  00:11:22:33:44:66
#       option target   REJECT

# block incoming ICMP traffic on a zone
#config rule
#       option src              lan
#       option proto    ICMP
#       option target   DROP

# port redirect port coming in on wan to lan
#config redirect
#       option src                      wan
#       option src_dport        80
#       option dest                     lan
#       option dest_ip          192.168.16.235
#       option dest_port        80
#       option proto            tcp

# port redirect of remapped ssh port (22001) on wan
#config redirect
#       option src              wan
#       option src_dport        22001
#       option dest             lan
#       option dest_port        22
#       option proto            tcp

### FULL CONFIG SECTIONS
#config rule
#       option src              lan
#       option src_ip   192.168.45.2
#       option src_mac  00:11:22:33:44:55
#       option src_port 80
#       option dest             wan
#       option dest_ip  194.25.2.129
#       option dest_port        120
#       option proto    tcp
#       option target   REJECT

#config redirect
#       option src              lan
#       option src_ip   192.168.45.2
#       option src_mac  00:11:22:33:44:55
#       option src_port         1024
#       option src_dport        80
#       option dest_ip  194.25.2.129
#       option dest_port        120
#       option proto    tcp

You should upgrade to 23.05.3.

Meanwhile, this address is not a valid choice -- that is not an RFC1918 address.

In fact, the address you are using is not just any old random public IP (which should be avoided) -- it is actually one of the most popular public DNS servers.

Stick to RFC1918 addresses, and usually this address will be specified as a /24 subnet size.

You also need a peer config stanza.

It doesn't seem that you are following the process described in the wiki article at all.

1 Like

I saw that IP somewhere & liked it. Didn't know it was a DNS! I know of 8.8.8.8.

I've also seen 192.168.9.1 as wg0.

I have not got past the Basics page, so yes, there's a lot left out. The wireguard docs are in many pieces/pages.... a lot of ground to cover for a beginner.

Using an address just because you 'liked it' is a flawed approach -- you need to stick to RFC1918 addresses

Yes, this is the common address used in the examples. You don't have to use this one, but it is important to use one that is within the RFC1918 ranges.

Also, it should be defined as an address with it's subnet size: 192.168.9.1/24

Add a peer (which you can do with the GUI). It should use an address in the same subnet, but this time be a /32. For example: 192.168.9.2/32 This address will be entered in the allowed_ips field.

1 Like

O M G.... I've managed to get my phone working on as a WG Peer.....

I was gonna post here w all sorts of questions.... But I found enough mistakes that I made.... "Allowed IPs" confused the hell out of me, I had stuff like "192.168.9.0/32" AND "192.168.1.0/32" for hosts / subnets that I wanted access to.
Then I realised the QR code was showing ALL THE WRONG info which I had keyed in.

BTW, Please Guys.... The Peer config interface on the Luci / Interface / wg0 config is too confusing.... One needs to read instructions VERY CAREFULLY bc the Peer GUI interface is not intuitive to newcomers.

I got WG client on my phone "connecting" without a handshake on the server. I could ping my LAN IPs, or so I thought, but I could NOT connect to NAS device via SMB.

Then I looked at /etc/config/firewall.... WG rule had a bad port number. I updated that..... Boom, everything worked.... Server handshake, NAS connection.....

WG.ActivePeer

All without posting again here.

Is someone willing to receive some suggestions for Luci GUI improvements?

Glad you got it working!

The problem is not so much with OpenWrt as it is with the potential for confusion with the terminology used in WireGuard in general. A lot of this stems from the fact that WireGuard doesn't have a formalized "server" or "client" definition. Instead, all devices are just "peers" even though some peers act in a server capacity while others act in a client. It's possible for a single peer to actually act in both capacities simultaneously (think quantum mechanics superposition :laughing: ), especially when used in a site-to-site setup.

I agree that it can be confusing at first, but it does become more clear as you learn it, and we're here to help you along the journey.

That said, take a look at the official WireGuard website and read through their documentation. From there, if you see areas where OpenWrt's documentation and/or GUI could specifically improve the description or use of the fields, feel free to create a new thread under the Talk About Documentation section of the forum.

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.