Routing issue openvpn

sturkel · December 14, 2023, 7:48pm

I have two openwrt routers connected with openvpn

Router A:
TP-Link Archer C7 v5 22.03.05
IP: 10.0.10.1
LAN: 10.0.10.0/24
OpenVPN Server 172.16.10.1

Router B:
Xiaomi Redmi Router AX6S 23.05.0
IP: 10.0.0.1
LAN: 10.0.0.0/24
OpenVPN client: 172.16.10.2

I can ping from the Router B router to Router A (172.16.10.1, and 10.0.10.1)
The other way isn't working.
I tried to add static route on Router A(ip route add 10.0.0.0/24 via 172.16.10.1), but still not working.
ip route get 10.0.0.1 from 172.16.10.1 gives me

10.0.0.1 from 172.16.10.1 via 172.16.10.254 dev tun0

, what I think it's fine.
IP forwarding is enabled on both sides.
What do I miss? Is it some config on Router A or B ?

psherman · December 14, 2023, 7:57pm

Let’s see the firewall files from each side.

egc · December 14, 2023, 8:26pm

What you want is often referred to as site-to-site setup.

Using WireGuard is much easier to setup but it can be done with OpenVPN as well.

The problem is from server to client.

In OpenVPN this is done with a client config directory and iroutes to make the server aware of the client LAN(s) so the OpenVPN server process will automatically add them to the server routing table (with the correct client's IP on the tunnel as the gateway) when a client connects.

Un fortunately I do not have more specific instructions as I am now doing this with WireGuard

psherman · December 14, 2023, 8:30pm

I agree with this sentiment... WG is easier to configure (and it is also much more performant). If WG is an option, I'd recommend moving in that direction.

sturkel · December 14, 2023, 9:01pm

Router A:

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone 'lan'
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list device 'tun+'
        option masq '1'

config zone 'wan'
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config redirect
        option target 'DNAT'
        option src 'wan'
        option dest 'lan'
        option proto 'tcp'
        option src_dport '22'
        option dest_port '22'
        option name 'SSH'
        option dest_ip '10.0.10.1'

config rule
        option name 'Allow-OpenVPN-Inbound'
        option target 'ACCEPT'
        option src 'wan'
        option proto 'udp'
        option dest_port '1194'

Router B:

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone 'lan'
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list device 'tun+'

config zone 'wan'
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'ssh wan'
        option dest_port '22'
        option target 'ACCEPT'
        option src 'wan'

config rule 'ovpn'
        option name 'Allow-OpenVPN'
        option src 'wan'
        option dest_port '1194'
        option proto 'udp'
        option target 'ACCEPT'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'Allow-OpenVPN-Inbound'
        list proto 'udp'
        option src 'wan'
        option src_dport '1194'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'SSH'
        list proto 'tcp'
        option src 'wan'
        option src_dport '22'
        option dest_port '22'
        option dest_ip '10.0.0.6'

At this moment migration to wireguard is not a direct option, maybe in the future

trendy · December 15, 2023, 9:45am

Doesn't look right. should be via 172.16.10.2
Provided you have a working OpenVPN connection(server and client), the site to site configuration is pretty straightforward.

sturkel · December 15, 2023, 5:44pm

I'll try to fix openvpn config, but installed wireguard in 5 minutes, and it's working. Didn't know it was so easy to configure.
I keep openvpn on Router B, as it's running there as server for other clients

Still one question; what route should I add to acces Site A from a Site B lan device?
When I tried to ping 10.0.10.1 (route A) a ge a Destination port unreachable

trendy · December 17, 2023, 12:23pm

Make sure all lan hosts use the OpenWrt routers as gateways.
Also that the lan hosts don't have their own firewall blocking packets from other networks.

sturkel · December 17, 2023, 1:20pm

I was focussed on the client, but now it opposite to the openvpn connection. I can ping from Site A to Site B router, but not in the opposite way.
I tried to add the wg network to lan on site b, but it doensn't seem to help

config zone 'lan'
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list device 'tun+'
        list network 'wg_s2s_b' 
        option masq '1'

sturkel · December 19, 2023, 7:47pm

Still struggling to get access to site A lan.
Tried the s2s automated script (https://openwrt.org/docs/guide-user/services/vpn/wireguard/site-to-site) but still no luck.
The only thing I think it's related, is that site a uses vlan (by default of the device)
As suggested on other posts, this is the output of

ubus call system board; \
uci export network; uci export wireless; \
uci export dhcp; uci export firewall; \
ip -4 addr ; ip -4 ro li tab all ; ip -4 ru; \
ls -l  /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*

site A:

{
        "kernel": "5.10.176",
        "hostname": "OpenWrt",
        "system": "Qualcomm Atheros QCA956X ver 1 rev 0",
        "model": "TP-Link Archer C7 v5",
        "board_name": "tplink,archer-c7-v5",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "22.03.5",
                "revision": "r20134-5f15225c1e",
                "target": "ath79/generic",
                "description": "OpenWrt 22.03.5 r20134-5f15225c1e"
        }
}
package network

config interface 'loopback'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'
        option device 'lo'

config globals 'globals'
        option ula_prefix 'fdf5:1b53:ed5b::/48'

config interface 'lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option device 'br-lan'
        option ipaddr '10.0.10.1'

config interface 'wan'
        option proto 'dhcp'
        option macaddr '20:CF:30:CE:3F:17'
        option device 'eth0.2'

config interface 'wan6'
        option proto 'dhcpv6'
        option device 'eth0.2'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '2 3 4 5 0t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '1 0t'

config interface 'vpn0'
        option proto 'none'
        option auto '1'
        option device 'tun0'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config interface 'wg_s2s_a'
        option proto 'wireguard'
        option private_key '***'
        option listen_port '51820'

config wireguard_wg_s2s_a 's2s_vpn_site_b'
        option public_key '***'
        option preshared_key '***'
        option description 'Site B, ***'
        list allowed_ips '10.0.0.0/24'
        list allowed_ips 'fd07:3be2:1033::/48'
        option route_allowed_ips '1'
        option persistent_keepalive '25'
        option endpoint_host '***'
        option endpoint_port '51820'

package wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option hwmode '11a'
        option path 'pci0000:00/0000:00:00.0'
        option country 'NL'
        option legacy_rates '0'
        option txpower '13'
        option channel '149'
        option htmode 'VHT40'
        option noscan '1'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid '****'
        option wpa_disable_eapol_key_retries '1'
        option key '***'
        option disassoc_low_ack '0'
        option ieee80211w '1'
        option encryption 'psk2'

config wifi-device 'radio1'
        option type 'mac80211'
        option country 'NL'
        option __toggle 'Enable'
        option path 'platform/ahb/18100000.wmac'

config wifi-device 'radio2'
        option type 'mac80211'
        option channel '11'
        option hwmode '11g'
        option path 'platform/ahb/18100000.wmac'
        option txpower '20'
        option legacy_rates '0'
        option htmode 'HT20'
        option country 'NL'

config wifi-iface 'wifinet2'
        option ssid '***'
        option device 'radio2'
        option mode 'ap'
        option key '***'
        option network 'lan'
        option encryption 'psk2+tkip+ccmp'
        option disassoc_low_ack '0'

package dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option localservice '1'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv6 'server'
        option ra 'server'
        option ra_management '1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

package firewall

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone 'lan'
        option name 'lan'
        list network 'lan'
        list network 'wg_s2s_a'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list device 'tun+'

config zone 'wan'
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config redirect
        option target 'DNAT'
        option src 'wan'
        option dest 'lan'
        option proto 'tcp'
        option src_dport '22'
        option dest_port '22'
        option name 'SSH'
        option dest_ip '10.0.10.1'

config rule
        option name 'Allow-OpenVPN-Inbound'
        option target 'ACCEPT'
        option src 'wan'
        option proto 'udp'
        option dest_port '1194'

config rule 'wg_s2s_51820'
        option name 'Allow-WireGuard-51820'
        option src 'wan'
        option dest_port '51820'
        option proto 'udp'
        option target 'ACCEPT'

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
7: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    inet 10.0.10.1/24 brd 10.0.10.255 scope global br-lan
       valid_lft forever preferred_lft forever
9: eth0.2@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    inet ***/22 brd 62.238.67.255 scope global eth0.2
       valid_lft forever preferred_lft forever
default via 62.238.67.254 dev eth0.2  src ***
10.0.0.0/24 dev wg_s2s_a scope link
10.0.10.0/24 dev br-lan scope link  src 10.0.10.1
62.238.64.0/22 dev eth0.2 scope link  src ***
*** via 62.238.67.254 dev eth0.2
broadcast 10.0.10.0 dev br-lan table local scope link  src 10.0.10.1
local 10.0.10.1 dev br-lan table local scope host  src 10.0.10.1
broadcast 10.0.10.255 dev br-lan table local scope link  src 10.0.10.1
broadcast 62.238.64.0 dev eth0.2 table local scope link  src ***
local *** dev eth0.2 table local scope host  src ***
broadcast 62.238.67.255 dev eth0.2 table local scope link  src ***
broadcast 127.0.0.0 dev lo table local scope link  src 127.0.0.1
local 127.0.0.0/8 dev lo table local scope host  src 127.0.0.1
local 127.0.0.1 dev lo table local scope host  src 127.0.0.1
broadcast 127.255.255.255 dev lo table local scope link  src 127.0.0.1
0:      from all lookup local
32766:  from all lookup main
32767:  from all lookup default
lrwxrwxrwx    1 root     root            16 Apr 27  2023 /etc/resolv.conf -> /tmp/resolv.conf
-rw-r--r--    1 root     root            47 Dec 19 20:26 /tmp/resolv.conf
-rw-r--r--    1 root     root           210 Dec 19 20:26 /tmp/resolv.conf.d/resolv.conf.auto

/tmp/resolv.conf.d:
-rw-r--r--    1 root     root           210 Dec 19 20:26 resolv.conf.auto
==> /etc/resolv.conf <==
search lan
nameserver 127.0.0.1
nameserver ::1

==> /tmp/resolv.conf <==
search lan
nameserver 127.0.0.1
nameserver ::1

==> /tmp/resolv.conf.d <==
head: /tmp/resolv.conf.d: I/O error

==> /tmp/resolv.conf.d/resolv.conf.auto <==
# Interface wan
default from isp
# Interface wan6
default from isp

Site B

{
        "kernel": "5.15.134",
        "hostname": "OpenWrt",
        "system": "ARMv8 Processor rev 4",
        "model": "Xiaomi Redmi Router AX6S",
        "board_name": "xiaomi,redmi-router-ax6s",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.0",
                "revision": "r23497-6637af95aa",
                "target": "mediatek/mt7622",
                "description": "OpenWrt 23.05.0 r23497-6637af95aa"
        }
}
package network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd07:3be2:1033::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '10.0.0.1'

config device
        option name 'wan'
        option macaddr '3c:cd:57:21:eb:5d'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config device
        option name 'tun1'
        option ipv6 '0'

config interface 'wg_s2s_b'
        option proto 'wireguard'
        option private_key '***'
        option listen_port '51820'

config wireguard_wg_s2s_b 's2s_vpn_site_a'
        option public_key '***'
        option preshared_key '***'
        option description 'Site A'
        list allowed_ips '10.0.10.0/24'
        list allowed_ips 'fdf5:1b53:ed5b::/48'
        option route_allowed_ips '1'
        option persistent_keepalive '25'
        option endpoint_host '***'
        option endpoint_port '51820'

package wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/18000000.wmac'
        option band '2g'
        option htmode 'HT20'
        option cell_density '0'
        option channel '1'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid '***'
        option wmm '0'
        option encryption 'psk2+tkip+ccmp'
        option key '***'

config wifi-device 'radio1'
        option type 'mac80211'
        option path '1a143000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
        option channel '36'
        option band '5g'
        option htmode 'HE80'
        option cell_density '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid '***'
        option encryption 'psk2+tkip+ccmp'
        option key '***'

config wifi-iface 'wifinet2'
        option device 'radio0'
        option mode 'ap'
        option ssid '***'
        option encryption 'psk2+tkip+ccmp'
        option isolate '1'
        option key '***'
        option network 'lan'

package dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'
		
config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

package firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone 'lan'
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list device 'tun+'
        list network 'lan'
        list network 'wg_s2s_b'

config zone 'wan'
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'ssh wan'
        option dest_port '22'
        option target 'ACCEPT'
        option src 'wan'

config rule 'ovpn'
        option name 'Allow-OpenVPN'
        option src 'wan'
        option dest_port '1194'
        option proto 'udp'
        option target 'ACCEPT'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'Allow-OpenVPN-Inbound'
        list proto 'udp'
        option src 'wan'
        option src_dport '1194'

config rule 'wg_s2s_51820'
        option name 'Allow-WireGuard-51820'
        option src 'wan'
        option dest_port '51820'
        option proto 'udp'
        option target 'ACCEPT'

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
3: wan@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    inet ***/21 brd 82.176.127.255 scope global wan
       valid_lft forever preferred_lft forever
9: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    inet 10.0.0.1/24 brd 10.0.0.255 scope global br-lan
       valid_lft forever preferred_lft forever
11: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN qlen 500
    inet 172.16.0.1/24 scope global tun0
       valid_lft forever preferred_lft forever
default via 82.176.127.254 dev wan  src ***
10.0.0.0/24 dev br-lan scope link  src 10.0.0.1
10.0.10.0/24 dev wg_s2s_b scope link
*** via 82.176.127.254 dev wan
82.176.120.0/21 dev wan scope link  src ***
172.16.0.0/24 dev tun0 scope link  src 172.16.0.1
local 10.0.0.1 dev br-lan table local scope host  src 10.0.0.1
broadcast 10.0.0.255 dev br-lan table local scope link  src 10.0.0.1
local *** dev wan table local scope host  src ***
broadcast 82.176.127.255 dev wan table local scope link  src ***
local 127.0.0.0/8 dev lo table local scope host  src 127.0.0.1
local 127.0.0.1 dev lo table local scope host  src 127.0.0.1
broadcast 127.255.255.255 dev lo table local scope link  src 127.0.0.1
local 172.16.0.1 dev tun0 table local scope host  src 172.16.0.1
broadcast 172.16.0.255 dev tun0 table local scope link  src 172.16.0.1
0:      from all lookup local
32766:  from all lookup main
32767:  from all lookup default
lrwxrwxrwx    1 root     root            16 Oct  9 21:45 /etc/resolv.conf -> /tmp/resolv.conf
-rw-r--r--    1 root     root            47 Dec 19 19:22 /tmp/resolv.conf
-rw-r--r--    1 root     root           210 Dec 19 19:24 /tmp/resolv.conf.d/resolv.conf.auto

/tmp/resolv.conf.d:
-rw-r--r--    1 root     root           210 Dec 19 19:24 resolv.conf.auto
==> /etc/resolv.conf <==
search lan
nameserver 127.0.0.1
nameserver ::1

==> /tmp/resolv.conf <==
search lan
nameserver 127.0.0.1
nameserver ::1

==> /tmp/resolv.conf.d <==
head: /tmp/resolv.conf.d: I/O error

==> /tmp/resolv.conf.d/resolv.conf.auto <==
# Interface wan
default from isp
# Interface wan6
default from isp

What crucial step did I miss, as everywhere I read that the automated scrip is working out of the box

trendy · December 20, 2023, 9:53pm

Can you explain a bit better what is not working? Ping from which IP to what IP? What are the host OS? Is there any host firewall?

sturkel · December 21, 2023, 10:40am

Ping from Site B to Site a not working. So ping from 10.0.0.1(= openwrt SiteB) to 10.0.10.1(=openwrt SiteA) doesn't work, but from SiteA to SiteB is working.

egc · December 21, 2023, 11:21am

Note that LAN clients could have their own firewall and will not allow traffic from other subnets by default.

You have to make sure the LAN clients you are pinging will allow traffic from the other side.

I noticed your WG interfaces do not have an IP address, strictly speaking it might not be necessary in this case but having their own IP addresses makes troubleshooting easier.
I always add an IP address to the WG interface (the WG subnet must be different from client and server as this is a routed solution) but that is just my personal preference

trendy · December 21, 2023, 11:55am

On router A do this:
okg update; opkg install tcpdump; tcpdump -i wg_s2s_a -c 50 -vn
Then start a ping from the other router.

sturkel · December 21, 2023, 2:05pm

tcpdump doesnt see any packages.
from A to B I get

14:04:44.069602 IP (tos 0x0, ttl 64, id 59599, offset 0, flags [DF], proto ICMP (1), length 84)
    10.0.10.1 > 10.0.0.1: ICMP echo request, id 3642, seq 0, length 64

trendy · December 21, 2023, 2:09pm

This is also not working, as there is no reply coming back.
What is the output of wg show on both routers?

sturkel · December 21, 2023, 2:24pm

interface: wg_s2s_a
  public key: ***
  private key: (hidden)
  listening port: 51820

peer: ***
  preshared key: (hidden)
  endpoint: ***:51820
  allowed ips: 10.0.0.0/24, fd07:3be2:1033::/48
  latest handshake: 1 minute, 32 seconds ago
  transfer: 187.48 KiB received, 275.14 KiB sent
  persistent keepalive: every 25 seconds

interface: wg_s2s_b
  public key: ***
  private key: (hidden)
  listening port: 51820

peer: ***
  preshared key: (hidden)
  endpoint: ***:51820
  allowed ips: 10.0.10.0/24, fdf5:1b53:ed5b::/48
  latest handshake: 1 minute, 39 seconds ago
  transfer: 275.14 KiB received, 190.86 KiB sent
  persistent keepalive: every 25 seconds

trendy · December 21, 2023, 2:32pm

On router A use ping -I 10.0.10.1 10.0.0.1
On router B use ping -I 10.0.0.1 10.0.10.1

sturkel · December 21, 2023, 2:39pm

With the extra interface its working on both sides, but I guess there is some route missing?

trendy · December 21, 2023, 2:41pm

No it is fine. Since there is no IP address in the link between them, the router will randomly use a source IP for the packet, which may not be the one from lan interface, hence it will be dropped.
Or you can try to remove the route allowed IPs in peer configuration and add a static route manually with the proper source address.