Hello, dear friends! I have just started my acquaintance with OpenWRT and I like it!
I want to set up WireGuard for OpenWRT, but so that everything goes through a VPN.
I installed "luci-proto-wireguard", "kmod-wireguard" and "wireguard-tools". I went to the interfaces and added the wireguard interface with the parameters of my vpn (private, public key, Preshared Key, address, port, AllowedIPs, DNS). Created a zone covered by a vpn network, and an authorized lan source. In the VPN control panel, I see that the router is connected, but all packets do not go through the VPN. Please tell me, what am I doing wrong? What can I try to do? I've tried a bunch of instructions, but it seems like I'm missing something.
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/firewall
wg show
1 Like
BusyBox v1.36.1 (2024-07-15 22:14:18 UTC) built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt 23.05.4, r24012-d8dd03c46f
-----------------------------------------------------
root@OpenWrt:~# ubus call system board
{
"kernel": "5.15.162",
"hostname": "OpenWrt",
"system": "MediaTek MT7628AN ver:1 eco:2",
"model": "TP-Link TL-WR842N v5",
"board_name": "tplink,tl-wr842n-v5",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "23.05.4",
"revision": "r24012-d8dd03c46f",
"target": "ramips/mt76x8",
"description": "OpenWrt 23.05.4 r24012-d8dd03c46f"
}
}
root@OpenWrt:~#
root@OpenWrt:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd25:be03:e222::/48'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0.1'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.3'
option netmask '255.255.255.0'
option ip6assign '60'
config device
option name 'eth0.2'
option macaddr 'e8:48:**:**:**:**'
config interface 'wan'
option device 'eth0.2'
option proto 'dhcp'
config interface 'wan6'
option device 'eth0.2'
option proto 'dhcpv6'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '1 2 3 4 6t'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '0 6t'
config interface 'wg0_int'
option proto 'wireguard'
option private_key 'gL7Ci7Jl**********************************'
list addresses '10.8.0.6/24'
list dns '1.1.1.1'
config wireguard_wg0_int
option description 'Imported node configuration'
option public_key 'm6HSko**********************************'
option preshared_key 'OOD8FDF**********************************'
list allowed_ips '0.0.0.0/0'
list allowed_ips '::/0'
option endpoint_host '217.**.**.**'
option endpoint_port '51820'
option persistent_keepalive '25'
option private_key 'gL7Ci7Jl**********************************'
root@OpenWrt:~# cat /etc/config/firewall
config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config zone
option name 'wg0_zone'
option input 'REJECT'
option output 'ACCEPT'
option forward 'ACCEPT'
option masq '1'
option mtu_fix '1'
list network 'wg0_int'
config forwarding
option src 'lan'
option dest 'wg0_zone'
root@OpenWrt:~#
root@OpenWrt:~# wg show
interface: wg0_int
public key: IWnBaUWr**********************************
private key: (hidden)
listening port: 48464
peer: m6HSkon5**********************************
preshared key: (hidden)
endpoint: 217.**.**.**:51820
allowed ips: 0.0.0.0/0, ::/0
latest handshake: 15 seconds ago
transfer: 276 B received, 860 B sent
persistent keepalive: every 25 seconds
root@OpenWrt:~#
You're missing one line for this peer config...
add:
option route_allowed_ips '1'
Then reboot and try again.
1 Like
Thanks, it works! It seems logical, and it seemed to me that I set this parameter in the web interface, but apparently some other parameters were incorrect. Thank you very much!
You’re welcome!
If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Thanks! 
1 Like
This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.