I set up a small computer with two NICs running OpenWRT as my main router. Everything is configured fine so far - I guess:
Public Internet --> OpenWRT eth0
public IPv6 address, public IPv6 prefix
CGNAT IPv4 address
LAN --> OpenWRT eth1
handing internal IPv4 addresses to different VLANs
delegating public IPv6 prefix into different VLANs
I want to run a Wireguard server on my router to give external clients access to my LAN (i.e. one of the VLANs).
I configured it with an IPv4 address and to listen on the default port (51820). I then forwarded that port from my router to the Wireguard IPv4 address.
So far I followed different tutorials but the problem seems to be that I cannot get a handshake between my phone (client app, iOS) and my router (Wireguard server). My phone is connecting to the external public IPv6 address of my router.
I guess that is what I am doing wrong?! But I cannot find out the right configuration...
Is IPv4 on wireguard correct in my use case? Is some kind of NAT from IPv6 to IPv4 missing?
Do I have to give the Wireguard server and peers IPv6 addresses only? Do they need to get a prefix delegated? If so, how?! Do they get ULA addresses?!
As you don't have a public ipv4 address then you either need to run the wireguard tunnel over ipv6 (it can carry ipv4 inside) or set up a remote host somewhere (e.g. a VPS) that does have a public ipv4 address and use that was as a 'hub'.
Outside the tunnel will be all v6 in this case. Inside the tunnel can carry v4 or v6 or both at the same time. For simply accessing a home LAN you can use v4 in the conventional way. Most but not all ISPs that support v6 will pass through incoming connections all the way to your router. There is no need to "forward ports" with v6 since there is no NAT.
Run tcpdump on the Wireguard listen port to see if any requests from the phone are received. The phone must be running on a separate Internet connection such as through its phone company. It will not work to test while the phone is connected to your home WiFi.
Does the Wireguard-Interface need an IPv4 or IPv6 (public? local?) address? Who does the tunnelling of IPv4 traffic inside the IPv6 tunnel? OpenWRT? Is a package needed?
I have a VPS (several, really) with public IPv4 addresses. But I thought - as I have a public IPv6 address on my WAN port - I could do without them by directly connecting the client to my router via IPv6.
The wireguard tunnel itself runs over ipv6 so the peer endpoints will be ipv6. What you put inside the tunnel is separate, so if you l want ipv4 then give the interfaces ipv4 addresses.
Does your mobile provider use ipv6 on their network?
Of course my phone is on a separate connection - not my WiFi.
What you are saying does not sound to apply to my case: My router itself (WAN-port) gets a public IP assigned. Prefixes are delegated to LAN-devices. The wireguard interface does not get a prefix/IPv6 address. So the connection from outside to port 51820 should terminate at my router - never reaching the wireguard interface???
The Wireguard IP for encrypted (outer) packets is the public IPv6 held by the wan interface on your router where Wireguard is listening. This would be configured into the phone, or entered into a DDNS server so that your router can be found by name.
As is the case for v4, the firewall needs a rule to allow UDP input from wan on the listen_port. This can be constrained to v6 only with the family option. If you don't specify the family, both V4 and V6 connections to Wireguard will be accepted, though V4 is not useful since it is not publicly reachable.
When a properly encrypted (keys match) Wireguard packet arrives at the public listen port, the Wireguard kernel process will decrypt it and pass the inner IPv4 packet to the internal wg interface, where it can be forwarded to the lan.
Right, time to see some configs then. Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
Networks should only be in one firewall zone. If you have two networks in the same zone and want to allow traffic to pass between them then forward needs to be accept.
This setting in the firewall was necessary to allow traffic on the port from WAN to my router:
config rule
option name 'Wireguard port'
list proto 'udp'
option src 'wan'
option dest_port '51280'
option target 'ACCEPT'
As well as this setting in the firewall to allow connectivity to the devices on my LAN:
config zone
option input 'REJECT'
option output 'ACCEPT'
option forward 'ACCEPT'
option name 'Heimnetz'
list network 'Heimnetzwerk'
list network 'HeimnetzVPN'
Now my phone connects via the public IPv6 to the Wireguard server on my router and is able to access IPv4 LAN devices. Pretty sure that I still got a misconfiguration in my firewall (too many zones?!) so that web-access via VPN is not possible.
