Need help with Wireguard set up - No handshake

Installing and Using OpenWrt
1

Hey guys,
I am tyring to configure wireguard in my netgear nighthawk x4 AC200, model: EX7300v2
it is a Wi-Fi mesh extender, with one ethernet port. The router can act as an extender or as an access point.
I once managed to get a handshake with mullvad servers, i tried to tweak the settings, i messed it up, it stopped working. I tried a clean install, still it wouldn't work, and i thought i could ask for some help from the community once again.
the wireguard interface ha sdata being transmitted, but not received packets hence no handshake.
whenever i have checked the box for 'route allowed ips', i loose internet access through the wifi
Any help would be appreciated.
here are my configuration files

root@OpenWrt:~# ubus call system board
{
        "kernel": "5.15.167",
        "hostname": "OpenWrt",
        "system": "Qualcomm Atheros QCA550X ver 1 rev 0",
        "model": "Netgear EX7300 v2",
        "board_name": "netgear,ex7300-v2",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.5",
                "revision": "r24106-10cc5fcd00",
                "target": "ath79/generic",
                "description": "OpenWrt 23.05.5 r24106-10cc5fcd00"
        }
}
root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdc6:6c76:76d9::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'

config interface 'WGINTERFACE'
        option proto 'wireguard'
        option private_key 'redacted'
        option force_link '1'
        list addresses '10.73.189.133/32'
        list addresses 'fc00:bbbb:bbbb:bb01::a:bd84/128'
        option mtu '1280'
        list dns '10.64.0.1'

config wireguard_WGINTERFACE
        option description 'hk-hkg-wg-202'
        option public_key 'zmhMPHfkgo+uQxP+l919Gw7cj5NTatg9nMU37eEUWis='
        option endpoint_host '103.125.233.3'
        option endpoint_port '51820'
        option persistent_keepalive '25'
        list allowed_ips '0.0.0.0/0'
        list allowed_ips '::0/0'

config wireguard_WGINTERFACE
        option description 'al-tia-wg-001.conf'
        option public_key 'bPfJDdgBXlY4w3ACs68zOMMhLUbbzktCKnLOFHqbxl4='
        list allowed_ips '0.0.0.0/0'
        list allowed_ips '::0/0'
        option endpoint_host '31.171.153.66'
        option endpoint_port '51820'
        option persistent_keepalive '25'
        option disabled '1'

config wireguard_WGINTERFACE
        option description 'ph-mnl-wg-001.conf'
        option public_key 'hORxMf/YMmN2/8VWOnTCdgGzGfEyXUEQQ5EBfoCyFDM='
        list allowed_ips '0.0.0.0/0'
        list allowed_ips '::0/0'
        option endpoint_host '129.227.118.162'
        option endpoint_port '51820'
        option disabled '1'

config wireguard_WGINTERFACE
        option description 'us-chi-wg-303.conf'
        option public_key 'DfmNHT84TTS6JcJJfZJwT7tZZVgKIKRJU/2AE5sJ6A4='
        list allowed_ips '0.0.0.0/0'
        list allowed_ips '::0/0'
        option endpoint_host '68.235.46.64'
        option endpoint_port '51820'
        option persistent_keepalive '25'
        option disabled '1'

config interface 'wan'
        option proto 'dhcp'
        option device 'eth0'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'WGZONE'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'WGINTERFACE'

config forwarding
        option src 'lan'
        option dest 'WGZONE'

config forwarding
        option src 'lan'
        option dest 'wan'

root@OpenWrt:~# ip route show
default via 192.168.1.1 dev eth0  src 192.168.1.2
103.125.233.3 via 192.168.1.1 dev eth0
192.168.1.0/24 dev eth0 scope link  src 192.168.1.2
192.168.2.0/24 dev br-lan scope link  src 192.168.2.1
root@OpenWrt:~# wg show
interface: WGINTERFACE
  public key: yOBKb2pTNP9gW4VY3ls7NNNB7OlSl7EwXR/ofIopxT0=
  private key: (hidden)
  listening port: 50188

peer: zmhMPHfkgo+uQxP+l919Gw7cj5NTatg9nMU37eEUWis=
  endpoint: 103.125.233.3:51820
  allowed ips: 0.0.0.0/0, ::/0
  transfer: 0 B received, 46.25 KiB sent
  persistent keepalive: every 25 seconds

thank you in advanced

2

anyone please :confused:

3

There's nothing obviously wrong with your config, which means you may have a key issue.

Try using the same configuration on your phone or computer. If the handshake and connectivity still fail, check the keys and addresses.

4

I just tried this
i noticed a lot of the servers i was trying, would take super long to connect from the computer app, i looked for a server that connected softly with the app, and tried it's address to the router. it worked!!
thank you so much, this was bothering me for days

5

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.