[SOLVED] Wireguard on LEDE

benje · February 18, 2019, 6:11pm

Hello everybody,

I have a problem with my Wireguard VPN Server on my LEDE Router. It is possible to connect to the Server but on the client i have no internet and no connect to the local server etc.

Normally I used OpenVPN, but after the update to LEDE 18.06 the OpenVPN config get lost...

Firewall config:


config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule 'Allow_OpenVPN_Inbound'
        option target 'ACCEPT'
        option src '*'
        option proto 'udp'
        option dest_port '1194'
        option dest '*'
        option name 'VPN Port'

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option syn_flood '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option network 'lan'

config zone
        option name 'wan'
        option output 'ACCEPT'
        option masq '1'
        option mtu_fix '1'
        option forward 'REJECT'
        option network 'wan wan6'
        option input 'REJECT'

config forwarding
        option src 'lan'
        option dest 'wan'

config include
        option path '/etc/firewall.user'

config zone 'vpn'
        option name 'vpn'
        option network 'vpn0'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option masq '1'
        option forward 'REJECT'

config forwarding 'vpn_forwarding_lan_in'
        option src 'vpn'
        option dest 'lan'

config forwarding 'vpn_forwarding_wan'
        option src 'vpn'
        option dest 'wan'

config rule
        option target 'ACCEPT'
        option src 'wan'
        option proto 'udp'
        option dest_port '1194'
        option name 'Openvpn'

config include 'miniupnpd'
        option type 'script'
        option path '/usr/share/miniupnpd/firewall.include'
        option family 'any'
        option reload '1'

config redirect
        option target 'DNAT'
        option src 'wan'
        option dest 'lan'
        option proto 'tcp'
        option src_dport '443'
        option dest_ip '10.7.4.112'
        option dest_port '443'
        option name 'cloud'

config redirect
        option target 'DNAT'
        option src 'wan'
        option dest 'lan'
        option proto 'tcp'
        option src_dport '80'
        option dest_ip '10.7.4.112'
        option dest_port '80'
        option name 'letsencrypt'
        option enabled '0'

config rule
        option src 'lan'
        option dest 'wan'
        option name 'dashbutton'
        option src_mac '6C:56:97:94:09:CB'
        option src_ip '10.7.4.121'
        option target 'REJECT'

config rule
        option src 'lan'
        option dest 'wan'
        option name 'dashafri'
        option src_mac '00:FC:8B:36:4D:D8'
        option src_ip '10.7.4.122'
        option target 'REJECT'

config rule
        option src '*'
        option target 'ACCEPT'
        option proto 'udp'
        option dest_port '1234'
        option name 'Allow-Wireguard-Inbound'

config zone
        option name 'wg'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option masq '1'
        option forward 'REJECT'
        option network 'wg0'

config forwarding
        option src 'wg'
        option dest 'wan'

config forwarding
        option src 'wg'
        option dest 'lan'

config forwarding
        option src 'lan'
        option dest 'wg'

config forwarding
        option src 'wan'
        option dest 'wg'

config rule
        option enabled '1'
        option target 'ACCEPT'
        option name 'Wireguard'
        option proto 'udp'
        option src '*'
        option dest_port '1234'
        option dest '*'

Network Config:


config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd3d:8b31:1227::/48'

config interface 'lan'
        option type 'bridge'
        option ifname 'eth0'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '10.7.4.1'
        option dns '1.1.1.1 1.0.0.1'

config interface 'wan'
        option ifname 'eth1'
        option proto 'dhcp'

config interface 'wan6'
        option ifname 'eth1'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0 1 2 3 5'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '4 6'

config interface 'vpn0'
        option ifname 'tun0'
        option proto 'none'
        option auto '1'

config interface 'wg0'
        option proto 'wireguard'
        option private_key 'KEY'
        option listen_port '1234'
        list addresses '10.8.4.1/24'

config wireguard_wg0
        option public_key 'other_key'
        list allowed_ips '0.0.0.0/0'
        list allowed_ips '::/0'
        option route_allowed_ips '1'
        option endpoint_port '1234'
        option persistent_keepalive '25'

Anybody know why its not working?

Thanks! B

lleachii · February 18, 2019, 6:43pm

Please explain what peer you're referring to as the "server"
If the peer above is a client, 0.0.0.0/0 is incorrect as allowed IPs
Clients usually don't need a endpoint port

benje · February 18, 2019, 7:26pm

Hello IIeachii,

thank you for your reply:

Please explain what peer you're referring to as the "server"

The "server" is the openwrt Router with LEDE on it. On the Client I inserted the no-ip name with the Port 1234

If the peer above is a client, 0.0.0.0/0 is incorrect as allowed IPs

The settigns above are from the server. Which IP I have to insert there?

Clients usually don't need a endpoint port

Ok, thanks. Without the endpoint port it doesnt work neither.

Thank you!

benje · February 18, 2019, 7:28pm

Here is a Screenshot of the Clientsettings:

lleachii · February 18, 2019, 7:31pm

Assign an IP from the /24. Use /32 for an individual IP.

I don't even see this configured on the client.

You cannot assign 10.8.4.1 on both sides of the connection!

benje · February 18, 2019, 7:43pm

Dammit. I'm an idiot. It works now...
Thank you so much IIeachii!!

lleachii · February 18, 2019, 7:45pm

Glad you got it working!

If your problem is solved, feel free to mark the relevant post as the solution; and edit the title to add "[SOLVED]" to the beginning (click the pencil behind the topic).

grafik

system · February 28, 2019, 7:45pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.