Hello,
I'm trying to get Wireguard to work on my Redmi AX6000. I had set it up previously using the wiki guide and it was working fine. Then, I went to try it again recently and, while my smartphone connected, it had no network or internet access. I can see it connecting on the Wireguard page in LuCI but no traffic flows through. What could the issue be? I'm not sure what info I need to provide to check the configuration but I did follow the wiki exactly. Thanks!
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):
Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/firewall
And also the config file on your phone.
{
"kernel": "6.12.94",
"hostname": "OpenWrt",
"system": "ARMv8 Processor rev 4",
"model": "Xiaomi Redmi Router AX6000 (OpenWrt U-Boot layout)",
"board_name": "xiaomi,redmi-router-ax6000-ubootmod",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "25.12.5",
"firmware_url": "https://downloads.openwrt.org/",
"revision": "r33051-f5dae5ece4",
"target": "mediatek/filogic",
"description": "OpenWrt 25.12.5 r33051-f5dae5ece4",
"builddate": "1782737960"
}
}
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd6d:c0ec:ae46::/48'
option packet_steering '2'
option steering_flows '128'
option dhcp_default_duid '0004271de20dcda54de596483ddf0e710daa'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
config interface 'lan'
option device 'br-lan.1'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
config device
option name 'wan'
option macaddr 'REDACT'
config interface 'wan'
option device 'wan'
option proto 'dhcp'
config interface 'wan6'
option device 'wan'
option proto 'dhcpv6'
config bridge-vlan
option device 'br-lan'
option vlan '1'
list ports 'lan2'
list ports 'lan3'
config bridge-vlan
option device 'br-lan'
option vlan '2'
list ports 'lan4'
config bridge-vlan
option device 'br-lan'
option vlan '3'
config interface 'IoT'
option proto 'static'
option device 'br-lan.2'
option ipaddr '192.168.2.1'
option netmask '255.255.255.0'
config interface 'Guest'
option proto 'static'
option device 'br-lan.3'
option ipaddr '192.168.3.1'
option netmask '255.255.255.0'
config interface 'wg0'
option proto 'wireguard'
option private_key 'REDACT'
option multipath 'off'
option listen_port '51820'
list addresses '10.0.0.1/24'
config wireguard_wg0
option public_key REDACT'
option private_key 'REDACT'
option description 'S26+'
list allowed_ips '10.0.0.10/32'
option endpoint_port '51820'
option persistent_keepalive '25'
config wireguard_wg0
option description 'Pixel 8'
option public_key 'REDACT'
option private_key 'REDACT'
list allowed_ips '10.0.0.10/32'
option endpoint_port '51820'
option persistent_keepalive '25'
config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
option flow_offloading '1'
option flow_offloading_hw '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config redirect 'adblock_wan53'
option name 'Adblock DNS (wan, 53)'
option src 'wan'
option proto 'tcp udp'
option src_dport '53'
option dest_port '53'
option target 'DNAT'
option family 'any'
config rule 'adblock_wan853'
option name 'Adblock DNS (wan, 853)'
option src 'wan'
option proto 'tcp udp'
option dest_port '853'
option target 'REJECT'
option dest '*'
config rule 'adblock_wan5353'
option name 'Adblock DNS (wan, 5353)'
option src 'wan'
option proto 'tcp udp'
option dest_port '5353'
option target 'REJECT'
option dest '*'
config zone
option name 'IoT'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
list network 'IoT'
config zone
option name 'Guest'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
list network 'Guest'
config forwarding
option src 'lan'
option dest 'Guest'
config forwarding
option src 'lan'
option dest 'IoT'
config forwarding
option src 'IoT'
option dest 'wan'
config forwarding
option src 'Guest'
option dest 'wan'
config zone
option name 'Wireguard'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option masq '1'
option mtu_fix '1'
list network 'wg0'
config forwarding
option src 'Wireguard'
option dest 'lan'
config forwarding
option src 'Wireguard'
option dest 'wan'
config forwarding
option src 'lan'
option dest 'Wireguard'
config rule
option src 'wan'
option name 'Wireguard-in'
list proto 'udp'
option dest_port '51820'
option target 'ACCEPT'
I'm not sure how to load the config file from my phone but I added it using the QR code generation from within LuCI
Remove the endpoint_port lines below:
And to each of the above add:
option route_allowed_ips '1'
Remove masquerading from the Wireguard firewall zone:
Reboot and test again.
I made these changes but am seeing the same behavior. I did re-add the tunnel via the QR code again after the changes.
Let’s see the output of
wg show
interface: wg0
public key: REDACT
private key: (hidden)
listening port: 51820
peer: REDACT
endpoint: REDACT:58986
allowed ips: (none)
latest handshake: 18 minutes, 48 seconds ago
transfer: 360 B received, 21.29 KiB sent
persistent keepalive: every 25 seconds
peer: REDACT
allowed ips: 10.0.0.10/32
persistent keepalive: every 25 seconds
This shows that you got a connection, but the allowed ips none gives a clue that I missed earlier. You have the same address on 2 peers. Change one of them so they don’t conflict. Then reboot and try again.
You mean 10.0.0.10/32, right? What's another valid address I can use? Thanks.
Right. Any address in that subnet (10.0.0.0/24) other than .1 and .10 which are in use already in the config. So .9 would be fine. Make sure you update the address of the interface on the peer itself.
This was the answer! Thank you!