Setting up Wireguard server

eshroom · January 20, 2023, 12:31am

I've tried everything I can think of and have searched the forums. I can connect and packets are sent and received by both server and client, however there is no internet when connected via Wireguard.

I am connected to the main router via Wan.

Any help would be very appreciated, thank you!

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option packet_steering '1'
        option ula_prefix 'fda2:59bf:4579::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'

config device
        option name 'lan1'
        option macaddr 'xxx'

config device
        option name 'lan2'
        option macaddr 'xxx'

config device
        option name 'lan3'
        option macaddr 'xxx'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.4.1'
        list dns '192.168.10.1'

config device
        option name 'wan'
        option macaddr 'xxx'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config interface 'wg0'
        option proto 'wireguard'
        option private_key 'xxx'
        option listen_port '1236'
        list addresses '192.168.5.1/24'
        option peerdns '0'
        list dns '192.168.10.100'

config wireguard_wg0
        option description '2'
        option public_key 'xxx'
        list allowed_ips '192.168.5.3'
        option endpoint_port '1236'
        option persistent_keepalive '25'
        option route_allowed_ips '1'

config wireguard_wg0
        option description '3'
        option public_key 'xxx'
        list allowed_ips '192.168.5.4'
        option route_allowed_ips '1'
        option endpoint_port '1236'
        option persistent_keepalive '25'

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
        option channel '1'
        option band '2g'
        option htmode 'HE20'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'OpenWrt 2'
        option encryption 'psk2'
        option key 'xxx'

config wifi-device 'radio1'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0+1'
        option channel '36'
        option band '5g'
        option htmode 'HE80'
        option cell_density '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'OpenWrt'
        option encryption 'psk2'
        option key 'xxx'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option output 'ACCEPT'
        option mtu_fix '1'
        option masq '1'
        option input 'ACCEPT'
        option forward 'ACCEPT'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config forwarding
        option src 'wan'
        option dest 'lan'

config zone
        option name 'wg0'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config forwarding
        option src 'wg0'
        option dest 'wan'

config forwarding
        option src 'wan'
        option dest 'wg0'

krazeh · January 20, 2023, 1:41am

Add list network 'wg0' to the wg0 firewall zone. Delete the forwardings from wan to wg0 and to lan

psherman · January 20, 2023, 2:03am

Are you sure you're getting a connection?
let's see the output from wg show

I'd recommend removing the listen port from the peers. I'd also suggest that you add "/32" to the allowed_ips (i.e. 192.168.5.3/32).

eshroom:

config wireguard_wg0
        option description '2'
        option public_key 'xxx'
        list allowed_ips '192.168.5.3'
        option endpoint_port '1236'
        option persistent_keepalive '25'
        option route_allowed_ips '1'

config wireguard_wg0
        option description '3'
        option public_key 'xxx'
        list allowed_ips '192.168.5.4'
        option route_allowed_ips '1'
        option endpoint_port '1236'
        option persistent_keepalive '25'

Is this the main router for the network, or is there another router in front of this one? If there is another router, how are the two connected?

Is your intent to be able to reach the lan from the remote peers? or is this purely for internet access via your home connection (or wherever this is located).

The above is needed, as @krazeh indicated. Currently your wg network is not associated with a firewall zone.

The DNS in the lan and wireguard interfaces (as well as the option peer dns in the WG interface) don't do anything (unless there is an upstream network connected via the lan port). But while we're at it, where is the 192.168.10.0/24 network (the one that apparently has your DNS server of choice)?

eshroom · January 20, 2023, 11:55am

There is the operator's router sitting upstream which is the 192.168.10.0 network. It is connected from a lan port to the OpenWrt wan (not lan), so I have removed the DNS in the lan and wireguard interfaces, and everything is still working as expected. Thank you.

system · January 30, 2023, 11:55am

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.