Mullvad Wireguard VPN configuration isssues on Raspberry Pi 4B

QuietUmbrage · August 24, 2022, 11:31pm

I am running OpenWRT 21.02.3 on a raspberry pi 4B. I have the inbuilt in ethernet port (eth0) connected to the internet via an 8 port gigabit switch (which is connected to my appartment's router), and a USB to Ethernet adapter (eth1), currently connected to a laptop for testing.

I have already installed drivers for the adapter and confirmed that it is working.

My goal is to use my Mullvad Wireguard VPN and route all traffic from eth1 over the VPN.

I am not using the GUI, and am doing all the configuration via the terminal.

My current config looks like this:

/etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd54:117d:89af::/48'

config interface 'lan'
        option type 'bridge'
	option proto 'dhcp'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
        option ifname 'eth0 eth1'

config interface 'wg0'
    option proto 'wireguard'
    option private_key '████████████████████████████████████████████'
    list addresses '██.██.███.██/██'

config wireguard_wg0
    option description 'mullvad-█████'
    option public_key '████████████████████████████████████████████'
    list allowed_ips '0.0.0.0/0'
    option route_allowed_ips '1'
    option endpoint_port '█████'
    option persistent_keepalive '15'
    option endpoint_host '███.██.███.██'

/etc/config/firewall

config defaults
	option syn_flood	1
	option input		ACCEPT
	option output		ACCEPT
	option forward		REJECT
# Uncomment this line to disable ipv6 rules
#	option disable_ipv6	1

config zone
	option name		lan
	list   network		'lan'
	option input		ACCEPT
	option output		ACCEPT
	option forward		ACCEPT

config zone
        option name             'wg0_zone'
        option input            ACCEPT
        option forward          ACCEPT
        option output           ACCEPT
        option masq             1
        list network            'wg0'

config forwarding
	option src		lan
	option dest		wg0_zone

# NOTE: I have not made any changes to this file below this point

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
	option name		Allow-DHCP-Renew
	option src		wan
	option proto		udp
	option dest_port	68
	option target		ACCEPT
	option family		ipv4

# Allow IPv4 ping
config rule
	option name		Allow-Ping
	option src		wan
	option proto		icmp
	option icmp_type	echo-request
	option family		ipv4
	option target		ACCEPT

config rule
	option name		Allow-IGMP
	option src		wan
	option proto		igmp
	option family		ipv4
	option target		ACCEPT

# Allow DHCPv6 replies
# see https://github.com/openwrt/openwrt/issues/5066
config rule
	option name		Allow-DHCPv6
	option src		wan
	option proto		udp
	option dest_port	546
	option family		ipv6
	option target		ACCEPT

config rule
	option name		Allow-MLD
	option src		wan
	option proto		icmp
	option src_ip		fe80::/10
	list icmp_type		'130/0'
	list icmp_type		'131/0'
	list icmp_type		'132/0'
	list icmp_type		'143/0'
	option family		ipv6
	option target		ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
	option name		Allow-ICMPv6-Input
	option src		wan
	option proto	icmp
	list icmp_type		echo-request
	list icmp_type		echo-reply
	list icmp_type		destination-unreachable
	list icmp_type		packet-too-big
	list icmp_type		time-exceeded
	list icmp_type		bad-header
	list icmp_type		unknown-header-type
	list icmp_type		router-solicitation
	list icmp_type		neighbour-solicitation
	list icmp_type		router-advertisement
	list icmp_type		neighbour-advertisement
	option limit		1000/sec
	option family		ipv6
	option target		ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
	option name		Allow-ICMPv6-Forward
	option src		wan
	option dest		*
	option proto		icmp
	list icmp_type		echo-request
	list icmp_type		echo-reply
	list icmp_type		destination-unreachable
	list icmp_type		packet-too-big
	list icmp_type		time-exceeded
	list icmp_type		bad-header
	list icmp_type		unknown-header-type
	option limit		1000/sec
	option family		ipv6
	option target		ACCEPT

config rule
	option name		Allow-IPSec-ESP
	option src		wan
	option dest		lan
	option proto		esp
	option target		ACCEPT

config rule
	option name		Allow-ISAKMP
	option src		wan
	option dest		lan
	option dest_port	500
	option proto		udp
	option target		ACCEPT

# allow interoperability with traceroute classic
# note that traceroute uses a fixed port range, and depends on getting
# back ICMP Unreachables.  if we're operating in DROP mode, it won't
# work so we explicitly REJECT packets on these ports.
config rule
	option name		Support-UDP-Traceroute
	option src		wan
	option dest_port	33434:33689
	option proto		udp
	option family		ipv4
	option target		REJECT
	option enabled		false

# include a file with users custom iptables rules
config include
	option path /etc/firewall.user


### EXAMPLE CONFIG SECTIONS
# do not allow a specific ip to access wan
#config rule
#	option src		lan
#	option src_ip	192.168.45.2
#	option dest		wan
#	option proto	tcp
#	option target	REJECT

# block a specific mac on wan
#config rule
#	option dest		wan
#	option src_mac	00:11:22:33:44:66
#	option target	REJECT

# block incoming ICMP traffic on a zone
#config rule
#	option src		lan
#	option proto	ICMP
#	option target	DROP

# port redirect port coming in on wan to lan
#config redirect
#	option src			wan
#	option src_dport	80
#	option dest			lan
#	option dest_ip		192.168.16.235
#	option dest_port	80
#	option proto		tcp

# port redirect of remapped ssh port (22001) on wan
#config redirect
#	option src		wan
#	option src_dport	22001
#	option dest		lan
#	option dest_port	22
#	option proto		tcp

### FULL CONFIG SECTIONS
#config rule
#	option src		lan
#	option src_ip	192.168.45.2
#	option src_mac	00:11:22:33:44:55
#	option src_port	80
#	option dest		wan
#	option dest_ip	194.25.2.129
#	option dest_port	120
#	option proto	tcp
#	option target	REJECT

#config redirect
#	option src		lan
#	option src_ip	192.168.45.2
#	option src_mac	00:11:22:33:44:55
#	option src_port		1024
#	option src_dport	80
#	option dest_ip	194.25.2.129
#	option dest_port	120
#	option proto	tcp

With this config I am connected to Mullvad from the Raspberry Pi itself:

root@OpenWRT# curl https://am.i.mullvad.net/connected

You are connected to Mullvad (server █████-wireguard). Your IP address is ███.██.███.███.

However, the laptop is not connected to the VPN. I can still access the internet, but my traffic is not being routed through the tunnel.

Interestingly, when I attempt to use the Mullvad connection testing tools from the laptop, I get an error:

main@arch_linux# curl https://am.i.mullvad.net/connected
curl: (60) SSL certificate problem: certificate is not yet valid
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

Using their web-based tool on the laptop (https://mullvad.net/check) gives me a AxiosError: Network Error.

This makes me think that the tunnel is doing something, im just not sure what.

I have spent several hours trying to get this to work, and have googled around quite a bit. However, I am still very new to OpenWRT. I apologize if I have simply overlooked something obvious or made a simple mistake.

In addition, I am unsure about how this system will behave in the event of an issue with the Mullvad server (e.g. server goes down, account is cancelled, etc.). I want to make sure that if the tunnel fails in some way traffic does not end up being sent outside of the tunnel to the internet.

If you need any additional logs or info, feel free to ask and I will do my best to provide whatever you need.

Thank you.

mk24 · August 25, 2022, 12:57am

The issue here is the same as this one:

Presently you have both Ethernet ports in the br-lan bridge. So LAN users can't be routed through the VPN.

Create a new network called exactly wan with eth0 as its device (remove eth0 from the br-lan ports list). This network can have proto DHCP, or a static IP on your upstream network. Change the LAN IP to something that does not overlap the upstream network and turn the DHCP server on LAN back on. Now there is routing in effect, and you can readily route from lan->vpn instead of lan->wan.

QuietUmbrage · August 25, 2022, 2:09am

I changed the relevant part of /etc/config/network to the following and restarted:

config interface 'wan'
        option type 'bridge'
	option proto 'dhcp'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
        option ifname 'eth0'

config interface 'lan'
        option type 'bridge'
	option proto 'dhcp'
	option ipaddr '192.168.1.2'
	option netmask '255.255.255.0'
	option ip6assign '60'
        option ifname 'eth1'

The laptop now has no internet access.

mk24 · August 25, 2022, 2:13am

This is the old syntax. wan does not need to be a bridge. The lan bridge (which is only needed if you want more than the one Ethernet port in lan) should be defined separately.
proto dhcp means a dhcp client. DHCP servers are defined in /etc/config/dhcp. When an interface is dhcp client, do not set ipaddr or netmask.
IP subnets of lan and wan can't overlap.

QuietUmbrage · August 25, 2022, 2:50am

I looked at /etc/config/dhcp and saw that wan was already defined and had option ignore '1' set, so I removed that option. I then removed the inproper options from /etc/config/network, leaving me with

config interface 'wan'
	option proto 'dhcp'
	option ip6assign '60'
        option ifname 'eth0'

config interface 'lan'
	option proto 'dhcp'
	option ip6assign '60'
        option ifname 'eth1'

This seemed to produce no changes. I also noticed that I no longer see br-lan and br-wan in ip addr - only lo, eth0, eth1, ad wlan0. I expected to see lan and wan, but did not.

mk24 · August 25, 2022, 1:25pm

This is really far from where it needs to be, and rather than trying to fix what you have I think it would be best to flash back to a default configuration and start over.

From the default configuration:

Connect only your PC to the Pi built-in Ethernet and log in at 192.168.1.1
Start up a wifi AP on lan. Disconnect Ethernet cable and connect PC wifi to that AP and log in again.
Edit /etc/config/network (using vi), remove eth0 from the br-lan and add a new wan interface:

config interface 'wan'
    option device 'eth0'
    option proto 'dhcp'

Connect Ethernet cable to your house network. The router and the PC should now have Internet access. (If house network is 192.168.1.0/24 you'll need to change the OpenWrt lan IP to be outside that range).
Install packages needed for second Ethernet port and wireguard.
Add eth1 to the lan bridge. Connecting PC to the USB Ethernet should now be lan-wan routing with Internet access. You may now delete the wifi AP if you want.
Configure wireguard to redirect all Internet to the Mulvad service. This is a conventional installation since the Pi is a lan->wan router the same as if it were the house main router.