Issue setting up Wireguard client

Installing and Using OpenWrt
1

Hello all and thanks for having me here.
I have an issue setting up Wireguard client on OpenWRT and I'd appreciate any inputs you can provide.

My set up is the following:

  1. Home router - Zyxel EX5601-T0 running OpenWrt 25.12.2 r32802-f505120278
  2. Travel router - GL.iNet GL-AXT1800 running OpenWrt 25.12.2 r32802-f505120278

The home router is set up as a Wireguard server with one client (my mobile phone) working as expected. I would like to set up the travel router to act as a client so I can route my traffic through my home network when I'm travelling.
I've gone through Wireguard setup on my travel router but I am not able to establish a connection with my home router: the travel router shows packets being transmitted but nothing received, while the home router does not show any packet being received for this peer.

Below is the configuration I have on the devices:
Home router

config interface 'wg0'
	option proto 'wireguard'
	option private_key 'priv_key_1'
	option multipath 'off'
	option listen_port '51820'
	list dns '192.168.1.253'
	list addresses '10.0.0.1/24'
	list addresses '172.16.10.11/16'

config wireguard_wg0
	option description 'pixel6'
	option public_key 'pub_key_2'
	option private_key 'priv_key_2'
	option endpoint_port '51820'
	option persistent_keepalive '25'
	option route_allowed_ips '1'
	list allowed_ips '10.0.0.10/32'

config wireguard_wg0
	option description 'tr1p'
	option public_key 'pub_key_3'
	option private_key 'priv_key_3'
	option endpoint_port '51820'
	option route_allowed_ips '1'
	option persistent_keepalive '25'
	list allowed_ips '172.16.10.10/32'

config zone
	option name 'Wireguard'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option masq '1'
	option mtu_fix '1'
	list network 'wg0'

config forwarding
	option src 'Wireguard'
	option dest 'lan'

config forwarding
	option src 'Wireguard'
	option dest 'wan'

config forwarding
	option src 'lan'
	option dest 'Wireguard'

config rule
	option src 'wan'
	option name 'Allow-Wireguard'
	list proto 'udp'
	option dest_port '51820'
	option target 'ACCEPT'

Travel router

config interface 'wg0'
	option proto 'wireguard'
	option private_key 'priv_key_3'
	option multipath 'off'
	option listen_port '51820'
	list addresses '172.16.10.10/16'

config wireguard_wg0
	option description 'homebase'
	option public_key 'pub_key_1'
	option private_key 'pub_key_1'
	option endpoint_host 'home_router_ip_address'
	option persistent_keepalive '25'
	option endpoint_port '51820'
	list allowed_ips '172.16.10.11/32'

config zone
	option name 'wireguard'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'wg0'
	option masq '1'

config forwarding
	option src 'wireguard'
	option dest 'lan'

config forwarding
	option src 'wireguard'
	option dest 'wan'

config forwarding
	option src 'wireguard'
	option dest 'wwan'

config forwarding
	option src 'lan'
	option dest 'wireguard'

config forwarding
	option src 'wan'
	option dest 'wireguard'

config forwarding
	option src 'wwan'
	option dest 'wireguard'

I am testing this set up connecting my travel router to the wifi hotspot of my mobile phone.

Thanks to everybody who can help me.

2

Starting here, I'd recommend a few things:

Keep everything in a /24 subnet, ideally something a bit uncommon. The 172 part of the RFC1918 address range in particular doesn't need to be that big, and frankly it's unnecessary to have a second subnet in the WG config like this. This only increases the chance of a subnet. collision when you are connecting to a remote upstream network (i.e. hotel/cafe/etc.).

So, remove the 172 address.

Next, remove the endpoint port from below. That is only necessary when you are connecting to a peer that has listening for an inbound connection (i.e. a 'server'), whereas your phone is acting as a 'client':

Likewise, remove the endpoint port from your second peer, but additionally you should change the allowed IPs to something in the other 10.0.0.0/24 range:

Moving on... remove the masquerading from the Wireguard firewall zone:

On the travel router...

Remove the listen port and change the address to match the new one (in the 10.0.0.0/24 subnet).

The allowed IPs here should be 0.0.0.0/0

Also, the private key in the peer config stanza (on the travel router) is not necessary, and since this device is mobile (and could get stolen/lost), you don't want that key exposed... delete it.

Delete the following forwarding statements:

Finally, with masquerading enabled on the wireguard firewall zone, the following doesn't do anything, but is also not harmful:

Masquerading on that zone will prevent your downstream devices from being reachable from your home lan (i.e. a host on the home lan will not be able to initiate a connection to the devices behind the travel router, but they can respond to a request coming from the traveling devices).... probably not a big deal. If that is something you need/want, a few minor adjustments are necessary.

After making all of the changes recommended, reboot both routers and test again. If it still doesn't work, we need to see the complete firewall and network config files.

3

There are serious issues with your config
See how to setup a typical server:
WireGuard Server Setup Guide

Consider starting from scratch

The client side can be setup as a typical client by importing the config made by the server:
WireGuard Client Setup Guide

You can tweak that if you want bi-directional traffic and setup as a site-to-site setup

Note always test from outside so with your travel router connect via the hotspot of your phone