Hi @psherman I dont know why but this is not working as i want, i cannot have access from A to B or from B to A... I just have access to the peer i have added previously (192.168.9.2) with local addresses from A to B but from B, i cannot access A. I want to have access to the router of B, and some computers i have there. Is this possible without adding every computer to peers?
What im trying is to connect 192.168.1.1 (B Router) from 192.168.2.0 (A Network)
The map is: I live in another city and i want to have entire access to my town net (both mine).
root@OpenWrt:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd75:07f1:eeb7::/48'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.2.1'
option netmask '255.255.255.0'
option ip6assign '60'
list dns '8.8.8.8'
list dns '8.8.4.4'
config interface 'wan'
option device 'eth1.20'
option proto 'pppoe'
option username 'xxxxxxxxx@digi'
option password 'xxxxxxxxx'
option ipv6 'auto'
config interface 'wan6'
option device 'eth1'
option proto 'dhcpv6'
config 192.168.1.2 'addr'
config device
option type '8021q'
option ifname 'eth1'
option vid '20'
option name 'eth1.20'
option mtu '1500'
config interface 'wg_vpn'
option proto 'wireguard'
option private_key 'xxxxxxxxxxxxxxxx='
option listen_port '51820'
option mtu '1280'
list addresses '192.168.9.1/24'
config wireguard_wg_vpn
option description 'Servidor'
option public_key 'xxxxxxxxxxxxxxxxxxx='
option route_allowed_ips '1'
list allowed_ips '192.168.9.2/32'
list allowed_ips '192.168.1.0/24'
config wireguard_wg_vpn
option public_key 'xxxxxxxxxxxxxxxxxx='
option private_key 'xxxxxxxxxxxxxxxxx='
option description 'Iphone'
option route_allowed_ips '1'
root@OpenWrt:~#
I don't know if im explaining the problem correctly
It appears that you've provided the config for the "A" side of the network. And it seems that this is the 'server' side (i.e. B initiates the connection to A).
Does A 192.168.2.0/24 ever need to be able to initiate connections to B 192.168.1.0/24?
If the answer to the above question is "no", then remove the list line of the below section:
Also, your iPhone peer is missing an allowed_ips -- it should likely be 192.168.9.3/32:
We also need to see the firewall and the remote side configuration (network and firewall files).
So the problem at this point lies with the proxmox server configuration. This is out of scope for these forums, but fundamentally it needs to handle the routing between the WG interface and the local network (likely in conjunction with your main router at that site in the form of static routes added to the routing table).
On the phone side of things, I wouldn't expect it to be able to reach anything on the 192.168.1.0/24 network while it is connected to the WG interface. It's only going to be able to connect to 192.168.2.0/24 and the internet. (although we'd have to also see the phone's configuration, and we'd have to check the handshake status).
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/firewall
wg show
Private Key -- this will be in the interface stanza of the configuration
Public Key -- this will be shared with the 'client' device and will be entered into the peer config section of the config (on the 'client' device itself)
'Client'
Private Key -- this will be in the interface section of the configuration
Public Key -- this will be shared with the 'server' device and will be entered into the peer config section of the config (on the 'server' device itself)
Here's another approach. In your remote PC install sshuttle package and from that machine create a vpn connection to your openwrt router with the following command:
So if you are logging in from the internet you need to put your public ip address, you also need to have port 22 open, your openwrt device needs to be in a dmz zone if it's connected to your main router or configure port forward so it can be able to connect from de internet. Additionally you need to know the internal network's ip in CIDR format.
example:
After that in your remote pc's terminal it should say connected. Leave that tab open and open a new one and send your file using scp or rsync. Remember you are going to be connected directly to your internal network so send you file to the recipient's local ip address.
