No Internet with WireGuard Interface

[KSofen]

On OpenWrt setting up OpenVPN is straightforward. WireGuard is tricky and even if you get everything right and tick every box - it won’t work if your time clock is off.

[KSofen]

Sounds like you know it all. I’ll leave you to it.

[Linux-DADDY]

@mk24

Open another terminal on your laptop and SSH in. Install tcpdump package. Run tcpdump on the router in your ssh session: tcpdump -vv -i vpn_tunnel host 8.8.8.8. Then in the other terminal (which is logged into the PC operating system), ping 8.8.8.8.

root@OpenWrt:~# tcpdump -vv -i vpn_tunnel host 8.8.8.8
tcpdump: listening on vpn_tunnel, link-type RAW (Raw IP), snapshot length 262144 bytes

It's nothing in the log. I've even tried with the DNS 1.1.1.1 but i got same results here.

root@OpenWrt:~# ping -I 10.2.0.2 8.8.8.8
PING 8.8.8.8 (8.8.8.8) from 10.2.0.2: 56 data bytes

It got stuck at there.

@mk24

(well maybe. I guess you would also need a rule with option src 10.2.0.2 table 102 to use the proper table. Actually that may be the problem all along-- do you have an option src 192.168.5.0/24 as that is no longer the source address after NAT)

i Will try that later will let you know.

[Linux-DADDY]

Is something wrong with you? I do not think anyone would love your messages at this point.

[Linux-DADDY]

@mk24

(well maybe. I guess you would also need a rule with option src 10.2.0.2 table 102 to use the proper table. Actually that may be the problem all along-- do you have an option src 192.168.5.0/24 as that is no longer the source address after NAT)

Brother this is the fix, it is working now. Thank you.
WireGuard is working now.
Umm, Let me use it for a few hours or days, And as of now i do no want to close this post as mark solved, i want to wait for a few days. @nitinjs Hey do you need any help now? wireguard is working now.

[Linux-DADDY]

If someone still have issues with WireGuard and firewall, then you can do as i did here. I will post luci ui + config.

NETWORK

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd7f:6d76:74be::/48'

config interface 'wan'
        option device 'eth0.1'
        option proto 'dhcp'

config interface 'wan6'
        option device 'eth0.1'
        option proto 'dhcpv6'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.2'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '10.0.0.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0 6t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '2 4 6t'

config interface 'wf_home'
        option proto 'static'
        option ipaddr '10.0.3.1'
        option netmask '255.255.255.0'

config interface 'wf_wireguard'
        option proto 'static'
        option ipaddr '10.0.5.1'
        option netmask '255.255.255.0'

config interface 'wireguard_jp'
        option proto 'wireguard'
        option private_key '+='
        list dns '10.2.0.1'
        list addresses '10.2.0.2/24'

config wireguard_wireguard_jp
        option description 'ProtonVPN WireGuard Japan FREE-218011'
        option public_key '/='
        list allowed_ips '0.0.0.0/0'
        option endpoint_host '37.19.205.145'
        option endpoint_port '51820'

config route
        option interface 'wireguard_jp'
        option target '0.0.0.0/0'
        option table '102'
        option source '10.2.0.1/24'

config route
        option interface 'wireguard_jp'
        option target '0.0.0.0/0'
        option table '102'
        option source '10.2.0.2'

config rule
        option in 'wf_wireguard'
        option lookup '102'

config interface 'wf_free'
        option proto 'static'
        option ipaddr '10.0.7.1'
        option netmask '255.255.255.0'

FIREWALL

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'
        option drop_invalid '1'
        option flow_offloading '1'
        option flow_offloading_hw '1'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config zone
        option name 'wf_free'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'wf_free'

config zone
        option name 'wf_home'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'wf_home'

config zone
        option name 'wf_wg'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'wf_wireguard'

config zone
        option name 'wg_jp'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'wireguard_jp'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'WF_Home DNS'
        option src 'wf_home'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'WF_Home DHCP'
        list proto 'udp'
        option src 'wf_home'
        option dest_port '67'
        option target 'ACCEPT'

config forwarding
        option src 'wf_home'
        option dest 'wan'

config rule
        option name 'WF_WireGuard DNS'
        option src 'wf_wg'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'WF_WireGuard DHCP'
        list proto 'udp'
        option src 'wf_wg'
        option dest_port '67'
        option target 'ACCEPT'

config forwarding
        option src 'wf_wg'
        option dest 'wg_jp'

config rule
        option name 'WF_FREE DNS'
        option src 'wf_free'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'WF_FREE DHCP'
        list proto 'udp'
        option src 'wf_free'
        option dest_port '67'
        option target 'ACCEPT'

DHCP

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'wf_home'
        option interface 'wf_home'
        option start '100'
        option limit '150'
        option leasetime '12h'

config dhcp 'wf_wireguard'
        option interface 'wf_wireguard'
        option start '100'
        option limit '150'
        option leasetime '12h'

config dhcp 'wf_free'
        option interface 'wf_free'
        option start '100'
        option limit '150'
        option leasetime '12h'

Now the screenshots.

And Again, For the routing config here, please check the /etc/config/network

Thank you for everyone who helped me here.

[Linux-DADDY]

As far i know, I do not need to set this up now, But as you asked some qus i have to reply, here.

@Sechorda

Is the SSID broadcasting from the router itself? I.E a Router/AP combo, or is the router and AP separate devices? Are they both running openwrt?

In one Router and yes in that router it is running wireguard+AP+SSID.

@Sechorda

Do you have two different lans separated by vlans, and bridged/linked to the SSID's?

I am not sure.

@Sechorda

Does SSID1 give you an IP in a different subnet than SSID2? Are there appropriate firewall rules in place for denying/allowing desired traffic between these networks?

Yes i do get different IP's.
AS I am not sure about all of your qus, you can still check my config to get your ans, Thank you.