I have openwrt 23.05.5 running on Aruba AP-303H.
lan and wan configured as below,
I have a wireguard server setup in cloud (oracle cloud) by using pivpn (curl -L https://install.pivpn.io | bash)
In pivpn, we run command pivpn add on the server to create profiles. And it will show a qr code we can scan on the wireguard client (such as iphone)
I tested above on my iphone client and everything works.
Now I would like to make openwrt dial a connection to wireguard server automatically and keep it on always. So that all clients connected to openwrt will assume the remote cloud wireguard server wan ip.
VPN_ADDR="10.119.75.3/24"
VPN_ADDR6="fd11:5ee:bad:c0de::a77:4b03/64"
VPN_KEY=<PrivateKey from above>
VPN_PUB=<PublicKey from above>
VPN_PSK=<PresharedKey from above>
VPN_IF="vpn"
VPN_SERV=<my vpn server>
VPN_PORT=<my vpn server port>
VPN_ADDR="10.119.75.3/24"
VPN_ADDR6="fd11:5ee:bad:c0de::a77:4b03/64"
VPN_KEY=<PrivateKey from above>
VPN_PUB=<PublicKey from above>
VPN_PSK=<PresharedKey from above>
skipped 2. Key management steps
uci rename firewall.@zone[0]="lan"
uci rename firewall.@zone[1]="wan"
uci del_list firewall.wan.network="${VPN_IF}"
uci add_list firewall.wan.network="${VPN_IF}"
uci commit firewall
service firewall restart
uci -q delete network.${VPN_IF}
uci set network.${VPN_IF}="interface"
uci set network.${VPN_IF}.proto="wireguard"
uci set network.${VPN_IF}.private_key="${VPN_KEY}"
uci add_list network.${VPN_IF}.addresses="${VPN_ADDR}"
uci add_list network.${VPN_IF}.addresses="${VPN_ADDR6}"
uci -q delete network.wgserver
uci set network.wgserver="wireguard_${VPN_IF}"
uci set network.wgserver.public_key="${VPN_PUB}"
uci set network.wgserver.preshared_key="${VPN_PSK}"
uci set network.wgserver.endpoint_host="${VPN_SERV}"
uci set network.wgserver.endpoint_port="${VPN_PORT}"
uci set network.wgserver.persistent_keepalive="25"
uci set network.wgserver.route_allowed_ips="1"
uci add_list network.wgserver.allowed_ips="0.0.0.0/0"
uci add_list network.wgserver.allowed_ips="::/0"
uci commit network
service network restart
Restarted openwrt but internet not working
root@OpenWrt:~# logread -e vpn; netstat -l -n -p | grep -e "^udp\s.*\s-$"
Wed Jan 1 13:08:25 2025 daemon.notice netifd: Interface 'vpn' has lost the connection
Wed Jan 1 13:08:27 2025 daemon.notice netifd: Interface 'vpn' is now down
Wed Jan 1 13:08:27 2025 daemon.notice netifd: Interface 'vpn' is setting up now
Wed Jan 1 13:08:27 2025 daemon.notice netifd: Interface 'vpn' is now down
Wed Jan 1 13:08:31 2025 daemon.notice netifd: Interface 'vpn' is setting up now
Wed Jan 1 13:08:36 2025 daemon.notice netifd: vpn (3957): Try again: `xxxxxxxx:xxxx'. Trying again in 1.00 seconds...
Wed Jan 1 13:08:40 2025 daemon.notice netifd: Interface 'vpn' is now up
Wed Jan 1 13:08:40 2025 daemon.notice netifd: Network device 'vpn' link is up
Wed Jan 1 13:08:40 2025 user.notice firewall: Reloading firewall due to ifup of vpn (vpn)
udp 0 0 0.0.0.0:60724 0.0.0.0:* -
udp 0 0 :::60724 :::* -
root@OpenWrt:~#
I tried that too.
Basically created new interface named wg0 with Protocol as Wireguard VPN and then on the new interface used Import configuration option where i pasted the contents of my conf file which auto filled in all details
Saved and restarted.
But, RX: 0 B (0 Pkts.) TX: 0 B (0 Pkts.)
The best way to see what is happening is to review your config.
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/firewall
wg show
Remove the gateway and dns from the lan interface.
Add:
option route_allowed_ips '1'
You do not have a handshake.
Make sure you have disabled WG on any other devices -- each connected peer must be unique, so if any of your other devices are using the same keys and address, that will conflict.
You may have a key issue. Verify that the keys are correct, double check for any errors.
@psherman which interface I should set google dns on?
Now my router itself don't resolve google.com (but I can ping 8.8.8.8 from router)
I set 8.8.8.8 as dns on my windows pc network card and internet works.
