Problem with Wireguard and Openwrt

Installing and Using OpenWrt
1

Witam,
mam problem z połączeniem Wireguard (na ustawieniach Surfshark). Skonfigurowane wg jednego z poradników. Konfiguracja zaimportowana z pliku. Co ciekawe, konfiguracja na telefonie działa bez problemu, natomiast router nie odbiera pakietów.

Hello,
I've got a problem with Wireguard working on OpenWrt. I did configure wg interface using one of the guides. Configuration was imported from *.conf file but it doesn't work. No received packets. I did try same configuration on mobile phone, and it's working properly. That's my configuration:

surfshark
surfshark662×126 6.19 KB

root@OpenWrt:/etc/config# ubus call system board
{
        "kernel": "6.6.86",
        "hostname": "OpenWrt",
        "system": "ARMv8 Processor rev 4",
        "model": "Zyxel EX5601-T0 ubootmod",
        "board_name": "zyxel,ex5601-t0-ubootmod",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "24.10-SNAPSHOT",
                "revision": "r28627-0b392b925f",
                "target": "mediatek/filogic",
                "description": "OpenWrt 24.10-SNAPSHOT r28627-0b392b925f",
                "builddate": "1745693631"
        }
}
root@OpenWrt:/etc/config# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdbd:2ffb:a165::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.2.254'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option gateway '192.168.2.254'

config interface 'wan'
        option device 'eth1'
        option proto 'pppoe'
        option username 'XXXXXXXXXXXXXX'
        option password 'XXXXXXXXXXXXXX'
        option ipv6 'auto'

config interface 'wan6'
        option device 'eth1'
        option proto 'dhcpv6'

config interface 'wgserver'
        option proto 'wireguard'
        option private_key 'XXXXXXXXXXXXXX'
        option listen_port '55443'
        list addresses '172.22.22.1/24'
        option mtu '1400'

config wireguard_wgserver
        option description 'gerard-telefon'
        option public_key 'XXXXXXXXXXXXXX'
        option private_key 'XXXXXXXXXXXXXX'
        list allowed_ips 'XXXXXXXXXXXXXX'
        option route_allowed_ips '1'
        option endpoint_port '55443'
        option persistent_keepalive '25'

config wireguard_wgserver
        option public_key 'XXXXXXXXXXXXXX'
        option private_key 'XXXXXXXXXXXXXX'
        option description 'Gerard_laptop'
        list allowed_ips 'XXXXXXXXXXXXXX'
        option route_allowed_ips '1'
        option endpoint_port '55443'
        option persistent_keepalive '25'

config interface 'wg0'
        option proto 'wireguard'
        option private_key 'XXXXXXXXXXXXXX'
        list addresses '10.14.0.2/16'
        list dns '162.252.172.57'
        list dns '149.154.159.92'

config wireguard_wg0
        option description 'Imported peer configuration'
        option public_key 'XXXXXXXXXXXXXX'
        list allowed_ips '0.0.0.0/0'
        list allowed_ips '::/0'
        option endpoint_host 'pl-waw.prod.surfshark.com'
        option endpoint_port '51820'
        option route_allowed_ips '1'
        option persistent_keepalive '25'

root@OpenWrt:/etc/config# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option band '2g'
        option channel '1'
        option htmode 'HE40'
        option country 'PL'
        option txpower '20'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'Family'
        option encryption 'psk2'
        option key 'XXXXXXXXXXXXXX'
        option ieee80211r '1'
        option nasid 'ap2542'
        option mobility_domain '111A'
        option ft_over_ds '0'
        option ft_psk_generate_local '1'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi+1'
        option band '5g'
        option channel '116'
        option htmode 'HE80'
        option country 'PL'
        option txpower '20'
        option cell_density '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'Family'
        option encryption 'psk2'
        option key 'XXXXXXXXXXXXXX'
        option ieee80211r '1'
        option nasid 'ap2545'
        option mobility_domain '111A'
        option ft_over_ds '0'
        option ft_psk_generate_local '1'

root@OpenWrt:/etc/config# cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option mtu_fix '1'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'
        list network 'wg0'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option src 'wan'
        option name 'allow-55443'
        list proto 'udp'
        option dest_port '55443'
        option target 'ACCEPT'

config zone
        option name 'wgserver'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'wgserver'

config forwarding
        option src 'wgserver'
        option dest 'lan'

config forwarding
        option src 'wgserver'
        option dest 'wan'

config forwarding
        option src 'lan'
        option dest 'wgserver'

config nat
        option name 'SNAT-WGserver'
        list proto 'all'
        option src 'lan'
        option src_ip 'cat /etc/config/firewall'
        option target 'MASQUERADE'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'NPM-443'
        option src 'wan'
        option src_dport '443'
        option dest_ip '192.168.2.21'
        option dest_port '443'

root@OpenWrt:/etc/config# wg show
interface: wg0
  public key: cat /etc/config/firewall
  private key: (hidden)
  listening port: 41129

peer: vBa3HK7QXietG64rHRLm085VMS2cAX2paeAaphB/SEU=
  endpoint: 45.134.212.250:51820
  allowed ips: 0.0.0.0/0
  transfer: 0 B received, 48.42 KiB sent
  persistent keepalive: every 25 seconds

interface: wgserver
  public key: cpuORYaepaAhS+hsjOJe76sE0KPxSnkQMhckzqwqEj0=
  private key: (hidden)
  listening port: 55443

peer: NOwOoExzeZCogSHBBqgpS8xmyYvWh7zZJikj6+K/alQ=
  endpoint: 37.31.30.65:54968
  allowed ips: 172.22.22.2/32
  transfer: 43.50 KiB received, 27.04 KiB sent
  persistent keepalive: every 25 seconds

peer: GQg0Owm0U76DVni6KAiDpnmzMGi7SrTej3BUqbTNOT4=
  allowed ips: 172.22.22.3/32
  persistent keepalive: every 25 seconds

What could be wrong?

2

unrelated, but install stable 24.10.1 instead.

4

Assuming this is a router which has its WAN port connected to the internet then remove option gateway

For setting up WireGuard maybe my notes can be helpful, see:

Instructions for setting up WireGuard as a "Server" and as a "Client" also when having that setup concurrently

Edit: seeing how you have setup the WG server you probably did find my notes :slight_smile:

If you are sure this same config works form your phone then the config and keys should be good.
Are you sure you have disabled the VPN on the phone as a config can only be used by one device at the same time.

But often the fact that there is no traffic can be attributed to wrong keys

1 Like
5

Yes, I did use your notes, and you gave me solution as well.
Removing option gateway '192.168.2.254' from lan was solution, thanks !

2 Likes