Setup wireguard server suggestions

octopus · November 10, 2025, 9:23am

I am trying to set up wireguard server (ipv4/ipv6) but can't connect from wan/internet side.
Trying from LAN side the client connects just fine.
I have an exclamation mark in zones and wan (see picture)
I have used "OpenWRT WireGuard Server Setup guide using LuCi" guide by "@egc" and alternative setup "2b"

Need suggestions to be able to connect from internet

CONFIGS:
ubus call system board

{
        "kernel": "6.6.110",
        "hostname": "Defcon",
        "system": "ARMv8 Processor rev 4",
        "model": "GL.iNet GL-MT6000",
        "board_name": "glinet,gl-mt6000",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "24.10.4",
                "revision": "r28959-29397011cc",
                "target": "mediatek/filogic",
                "description": "OpenWrt 24.10.4 r28959-29397011cc",
                "builddate": "1760891865"
        }
}

cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd65:xxxx:a308::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        list ports 'lan5'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.46.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'eth1'
        option proto 'dhcp'

config interface 'wan6'
        option device 'eth1'
        option proto 'dhcpv6'
        option reqaddress 'try'
        option reqprefix 'auto'
        option norelease '1'
        option sourcefilter '0'

config interface 'TRB140'
        option proto 'static'
        option device '@wan'
        option ipaddr '192.168.25.2'
        option netmask '255.255.255.0'

config device
        option type 'bridge'
        option name 'br-guest'
        option bridge_empty '1'

config interface 'guest'
        option proto 'static'
        option device 'br-guest'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'
        option gateway '192.168.1.1'

config interface 'tun21'
        option proto 'none'
        option device 'tun21'

config interface 'wgserver'
        option proto 'wireguard'
        option private_key '>KEY<'
        option listen_port '56468'
        list addresses '172.22.28.1/24'
        list addresses 'fda9:65bd:f903::1/64'

config wireguard_wgserver
        option description 'johan24'
        option public_key '>KEY<'
        option private_key '>KEY<'
        option preshared_key '>KEY<'
        list allowed_ips '172.22.28.2/32'
        list allowed_ips 'fda9:65bd:f903::2/128'
        option endpoint_port '56468'
        option persistent_keepalive '25'
        option route_allowed_ips '1'
        option endpoint_host 'xxx.xxxxx.se'

config wireguard_wgserver
        option description 'johanlaptop'
        option public_key '>KEY<'
        option private_key '>KEY<'
        option preshared_key '>KEY<'
        list allowed_ips '172.22.28.3/32'
        list allowed_ips 'fda9:65bd:f903::3/128'
        option route_allowed_ips '1'
        option endpoint_port '56468'
        option persistent_keepalive '25'
        option endpoint_host 'xxx.xxxxx.se'

config wireguard_wgserver
        option description 'johanpc'
        option public_key '>KEY<'
        option private_key '>KEY<'
        option preshared_key '>KEY<'
        option route_allowed_ips '1'
        option endpoint_port '56468'
        option persistent_keepalive '25'
        list allowed_ips 'fda9:65bd:f903::4/128'
        list allowed_ips '172.22.28.4/32'
        option endpoint_host 'xxx.xxxxx.se'

config wireguard_wgserver
        option description 'rt-ax86u'
        option public_key '>KEY<'
        option private_key '>KEY<'
        option preshared_key '>KEY<'
        list allowed_ips '172.22.28.5/32'
        list allowed_ips 'fda9:65bd:f903::5/128'
        option route_allowed_ips '1'
        option endpoint_port '56468'
        option persistent_keepalive '25'
        option endpoint_host 'xxx.xxxxx.se'

config wireguard_wgserver
        option description 'reserv1'
        option public_key '>KEY<'
        option private_key '>KEY<'
        option preshared_key '>KEY<'
        list allowed_ips '172.22.28.6/32'
        list allowed_ips 'fda9:65bd:f903::6/128'
        option route_allowed_ips '1'
        option endpoint_port '56468'
        option persistent_keepalive '25'
        option endpoint_host 'xxx.xxxxx.se'

cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option band '2g'
        option channel '1'
        option htmode 'HE40'
        option cell_density '0'
        option txpower '20'
        option country 'SE'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'Defcon.2'
        option encryption 'sae-mixed'
        option key '>KEY<'
        option ocv '0'
        option dtim_period '3'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi+1'
        option band '5g'
        option channel '128'
        option htmode 'HE160'
        option country 'SE'
        option cell_density '0'
        option txpower '23'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'Defcon.5'
        option encryption 'sae-mixed'
        option dtim_period '3'
        option key '>KEY<'
        option ocv '0'

config wifi-iface 'wifinet2'
        option device 'radio0'
        option mode 'ap'
        option ssid 'Defcon.2-guest'
        option encryption 'sae-mixed'
        option key '>KEY<'
        option ocv '0'
        option network 'guest'
        option dtim_period '3'

cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone 'lan'
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list device 'tun21'
        list network 'lan'
        list network 'wgserver'

config zone 'wan'
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'
        option masq6 '1'
        list masq_src 'fda9:65bd:f903::0/64'
        option masq '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'guest'

config forwarding
        option src 'guest'
        option dest 'wan'

config rule
        option src 'guest'
        option name 'Allow-DNS-Guest'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option src 'guest'
        option name 'Allow-DHCP-Guest'
        list proto 'udp'
        option dest_port '67'
        option target 'ACCEPT'

config rule
        option src 'lan'
        option dest 'wan'
        option name 'Block-8.8.8.8'
        option target 'REJECT'
        option family 'ipv4'
        list dest_ip '8.8.8.8'

config rule
        option src 'lan'
        option dest 'wan'
        option name 'Block-8.8.4.4'
        option target 'REJECT'
        option family 'ipv4'
        list dest_ip '8.8.4.4'

config rule 'ovpn'
        option name 'ALLOW-OpenVPN'
        option src 'wan'
        option proto 'udp'
        option dest_port '2196'
        option target 'ACCEPT'

config zone
        option name 'wgserver'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'wgserver'

config forwarding
        option src 'wgserver'
        option dest 'lan'

config forwarding
        option src 'wgserver'
        option dest 'wan'

config forwarding
        option src 'lan'
        option dest 'wgserver'

wg show

nterface: wgserver
  public key: >KEY<
  private key: (hidden)
  listening port: 56468

peer: >KEY<
  preshared key: (hidden)
  endpoint: [2001:9b1:dfe:a100:4997:bc14:d589:52c7]:56468
  allowed ips: 172.22.28.2/32, fda9:65bd:f903::2/128
  latest handshake: 46 minutes, 14 seconds ago
  transfer: 51.77 KiB received, 131.00 KiB sent
  persistent keepalive: every 25 seconds

peer: >KEY<
  preshared key: (hidden)
  endpoint: [2001:xxx:41::c934:xxxx]:56468
  allowed ips: 172.22.28.3/32, fda9:65bd:f903::3/128
  transfer: 0 B received, 66.20 KiB sent
  persistent keepalive: every 25 seconds

peer: >KEY<
  preshared key: (hidden)
  endpoint: [2001:xxx:41::c934:xxxx]:56468
  allowed ips: 172.22.28.4/32, fda9:65bd:f903::4/128
  transfer: 0 B received, 66.48 KiB sent
  persistent keepalive: every 25 seconds

peer: >KEY<
  preshared key: (hidden)
  endpoint: [2001:xxx:41::c934:xxxx]:56468
  allowed ips: 172.22.28.5/32, fda9:65bd:f903::5/128
  transfer: 0 B received, 66.48 KiB sent
  persistent keepalive: every 25 seconds

peer: >KEY<
  preshared key: (hidden)
  endpoint: [2001:xxx:41::c934:xxxx]:56468
  allowed ips: 172.22.28.6/32, fda9:65bd:f903::6/128
  transfer: 0 B received, 66.20 KiB sent
  persistent keepalive: every 25 seconds

egc · November 10, 2025, 11:14am

The exclamation mark is because you also use masq6 on the wan interface that is normal.

Start by deleting the endpoint address on all the peers:

The wgserver network is present in two zones, a network can only be present in one zone probably delete it here:

octopus:

config zone 'lan'
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list device 'tun21'
        list network 'lan'
        list network 'wgserver'    <<<<<< DELETE

and the most important omission:
The traffic rule to allow traffic on the wgserver port 56468 is missing, add that rule reboot and test again.

Have you checked that you have a public wan IP address, see the introduction paragraph of the guide

octopus · November 10, 2025, 3:01pm

Thank you for your help!

I have changed all setting and it's working, can connect with ipv6 to wireguards,
missed "allow traffic"
Only need to change DNS severs I use https-dns-proxy and that dns is used.

config rule
	option src 'wan'
	option name 'Allow-56468'
	list proto 'udp'
	option dest_port '56468'
	option target 'ACCEPT'

In my test router I have ipv4 CGNAT and public ipv6.
I shall change router when this is configured,
still have some program left to install and config.

egc · November 11, 2025, 2:13pm

Great to hear it is working

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Thanks!

system · November 21, 2025, 2:13pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.