I have been trying for some time to correctly expose my home network with the outside world via a WireGuard tunnel and have ended up with the following cofiguration
Problem:
Clients in my home network, routed through an OpenWrt router using a WireGuard tunnel to a VPS, cannot access most websites, except for a few like Google and YouTube. The router itself has full internet access, including DNS resolution, but the issue persists for connected clients.
Setup:
OpenWrt Router: Acts as the local router in my home network and serves as a WireGuard client.
WWAN: The OpenWrt router connects as a client to an external network. I do not have access to the router of this external network.
VPS: Used as the WireGuard server and for setting up port forwarding.
Current Configuration:
The WireGuard tunnel is active, and all traffic is routed through it (allowed IPs: 0.0.0.0/0).
The OpenWrt router can successfully ping external addresses (e.g., ping 8.8.8.8).
DNS resolution works on the router (e.g., nslookup example.com 8.8.8.8 returns correct results).
Problem:
Clients in the home network cannot access websites outside the network (e.g., curl example.com fails).
However, some sites like Google and YouTube are accessible from the home network.
Additional Details:
Routing table (ip route show):
default dev wireguard scope link
10.0.0.0/24 dev wireguard scope link src 10.0.0.2
10.1.1.0/24 dev br-lan scope link src 10.1.1.1
192.168.178.0/24 dev phy0-sta0 scope link src 192.168.178.85
212.227.64.18 via 192.168.178.1 dev phy0-sta0
Relevant Configuration Files:
/etc/config/network:
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd5c:757a:4a0c::/48'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '10.1.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
config interface 'wwan'
option proto 'dhcp'
option peerdns '0'
list dns '1.1.1.1'
list dns '8.8.8.8'
option hostname '*'
config interface 'wireguard'
option proto 'wireguard'
option private_key 'xxx'
list addresses '10.0.0.2/24'
option peerdns '0'
list dns '1.1.1.1'
list dns '8.8.8.8'
option mtu '1412'
config wireguard_wireguard
option public_key 'xxx'
option route_allowed_ips '1'
option endpoint_host '212.227.64.18'
option endpoint_port '51820'
option persistent_keepalive '25'
option description 'wg-server'
option preshared_key 'xxx'
list allowed_ips '0.0.0.0/0'
/etc/config/firewall:
bash
KopierenBearbeiten
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'DROP'
option synflood_protect '1'
config zone 'lan'
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
config zone
option name 'wg'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'wireguard'
option masq '1'
option mtu_fix '1'
config zone 'wan'
option name 'wan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list device 'tun+'
list network 'wwan'
config forwarding
option src 'lan'
option dest 'wg'
config forwarding
option src 'wg'
option dest 'lan'
Furthermore if you want to be able to connect to the router itself, if you are connected via WG, you need to add the following rule also:
iptables -I INPUT -i wg0 -j ACCEPT
Your MTU is way to high, max is 1420 when you have slow or intermittent traffic and can reach some websites but not others, use a lower MTU e.g. 1280 on both sides.
Reboot after changing
Disclaimer I do have a working VPS but am not an expert
Since you seem to have a Fritzbox as modem, I suggest setting the mtu to 1300, that should suffice.
I had issues with some Fritzboxes in front of an OpenWrt-Router running Wireguard in the past and the 1300 mtu helped in 100% of the cases with the issue of some websites not/slowly loading, videos not playing, etc.
I usually tested for this by connecting to the OpenWrt router via ssh through the Wireguard tunnel and then issuing commands with long output like logread. It would hang up the connection after X lines and I had to reconnect via ssh again.
So for config interface wireguard in your network config, set the option mtu '1300'
You can use trace path and trace route to test the pipe for how big a packet can be. I don't have the option on top of my mind but you can specifi it and see if you really need 1280 or if you could go slightly bigger.