Not able to connect Wireguard with Guest Wi-Fi: No Internet

sunilalw2007 · September 12, 2024, 4:37pm

Dear All,
I am trying to connect Wiregurd VPN with my configured Guest network.
[OpenWrt Wiki] Guest Wi-Fi basics

I have applied some configuration by exploring few articles over there.
I have taken configuration idea from link below:
https://forum.openwrt.org/t/stop-connecting-to-internet-if-wireguard-service-is-stopped-not-working/175877

My Goal is to connect my Guest Wi-Fi with Wireguard only. if Wireguard down no internet should be there.

Below is my configuration, kindly correct me if I missed anything. at present Wi-Fi 1 and 2 working fine without any issue but Guest internet No Internet

Your help very much appreciated.

Network:

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'XXXXXX:XX:XX/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config interface 'wg0'
        option proto 'wireguard'
        option private_key 'GFXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX='
        list dns '1.1.1.1'
        list dns '1.0.0.1'
        option mtu '1280'
        list addresses 'XXX;XX:X:X:X:XXX:X::X/128'
        list addresses 'XX.XX.XX.XX/32'
        #option delegate '0'
        #option nohostroute '1'

config wireguard_wg0
        option description 'peer'
        option public_key 'bmXXXXXXXXXXXXXXXXXXXXXXXXXXXXX='
        option endpoint_host 'XXXXXXXXXXXXXXX'
        option endpoint_port 'XXXX'
        list allowed_ips '::/0'
        list allowed_ips '0.0.0.0/0'
        option route_allowed_ips '0'
        option persistent_keepalive '15'

config device 'guest_dev'
        option type 'bridge'
        option name 'br-guest'
        option bridge_empty '1'

config interface 'guest'
        option proto 'static'
        option device 'br-guest'
        option ipaddr '192.168.3.1/24'
        option netmask '255.255.255.0'

config route
        option interface 'wg0'
        option target '0.0.0.0/0'
        option table '3'

config rule
        option src '192.168.3.0/24'
        option lookup '3'

Firewall:

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'vpnlan'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        list network 'wg0'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config redirect 'dns_int'
        option name 'Intercept-DNS'
        option family 'any'
        option proto 'tcp udp'
        option src 'lan'
        option src_dport '53'
        option target 'DNAT'

config include 'pbr'
        option fw4_compatible '1'
        option type 'script'
        option path '/usr/share/pbr/firewall.include'

config zone 'guest'
        option name 'guest'
        option network 'guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config forwarding 'guest_wan'
        option src 'guest'
        option dest 'wan'

config rule 'guest_dns'
        option name 'Allow-DNS-Guest'
        option src 'guest'
        option dest_port '53'
        option proto 'tcp udp'
        option target 'ACCEPT'

config rule 'guest_dhcp'
        option name 'Allow-DHCP-Guest'
        option src 'guest'
        option dest_port '67'
        option proto 'udp'
        option family 'ipv4'
        option target 'ACCEPT'

Wireless:

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        option channel '1'
        option band '2g'
        option htmode 'HT20'
        option cell_density '3'
        option country 'IN'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid '24'
        option encryption 'psk2'
        option key 'password'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        option channel '36'
        option band '5g'
        option htmode 'VHT80'
        option cell_density '3'
        option country 'IN'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid '5G'
        option encryption 'psk2'
        option key 'password'

config wifi-iface 'guest'
        option device 'radio0'
        option mode 'ap'
        option network 'guest'
        option ssid 'Guest'
        option encryption 'sae'
        option key 'password'

Boilerplate4U · September 12, 2024, 5:19pm

I’m just guessing, but you want to connect your guest Wi-Fi to the internet through a WireGuard tunnel, right? And if the WireGuard tunnel drops, the guest Wi-Fi should lose its internet connection too (aka a "kill switch")?

First follow-up question: Are you sure the other end has internet routing (i.e. a default gateway) for your WireGuard tunnel?

brada4 · September 12, 2024, 7:16pm

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/dhcp

sunilalw2007 · September 13, 2024, 1:03am

Thanks @brada4, please find below
ubus call system board

{
        "kernel": "5.15.162",
        "hostname": "OpenWrt",
        "system": "MediaTek MT7621 ver:1 eco:3",
        "model": "D-Link DIR-2640 A1",
        "board_name": "dlink,dir-2640-a1",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.4",
                "revision": "r24012-d8dd03c46f",
                "target": "ramips/mt7621",
                "description": "OpenWrt 23.05.4 r24012-d8dd03c46f"
        }
}

cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'
        option confdir '/tmp/dnsmasq.d'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        option ra_slaac '1'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'guest'
        option interface 'guest'
        option start '100'
        option limit '150'
        option leasetime '1h'

@Boilerplate4U You are right, I am much technical so not sure about your follow up question, please advise what I have to share with you to verify this.
Thanks.