Traffic not flowing through Wireguard

Installing and Using OpenWrt Network and Wireless Configuration
1

I am a noob trying to setup wireguard on openwrt. I followed the below links to setup, but for whatever reason traffic is not flowing trhough wireguard interface. I read other forum posts and got all the needed info for you to let me know what i am doing wrong. Any help would be appreciated. Note i dont understand technical jargon, if there is a setting that needs to be changed pls send me the command or the path to make the change in LUCI

``
System
Hostname OpenWrt
Model Linksys WRT3200ACM
Architecture ARMv7 Processor rev 1 (v7l)
Target Platform mvebu/cortexa9
Firmware Version OpenWrt 23.05.3 r23809-234f1a2efa / LuCI openwrt-23.05 branch git-24.073.29889-cd7e519
Kernel Version 5.15.150
Local Time 2024-08-13 01:47:08
Uptime 20h 45m 19s
Load Average 0.06, 0.06, 0.01

root@OpenWrt:~# ubus call system board
{
        "kernel": "5.15.150",
        "hostname": "OpenWrt",
        "system": "ARMv7 Processor rev 1 (v7l)",
        "model": "Linksys WRT3200ACM",
        "board_name": "linksys,wrt3200acm",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.3",
                "revision": "r23809-234f1a2efa",
                "target": "mvebu/cortexa9",
                "description": "OpenWrt 23.05.3 r23809-234f1a2efa"
				
root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdb6:f6e7:56f8::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device
        option name 'wan'
        option macaddr '62:38:e0:b7:c9:10'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'
        option peerdns '0'
        list dns '8.8.8.8'
        list dns '8.8.4.4'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config interface 'nordvpntun'
        option proto 'none'
        option device 'tun0'

config interface 'wg2'
        option proto 'wireguard'
        option private_key '*******'
        list addresses '10.5.0.2'
        option mtu '1500'
        option metric '10'
        list dns '103.86.96.100'
        list dns '103.86.99.100'

config wireguard_wg2
        option description 'us10117.nordvpn.com'
        list allowed_ips '0.0.0.0/0'
        option route_allowed_ips '1'
        option endpoint_host '185.255.130.103'
        option endpoint_port '51820'
        option persistent_keepalive '25'
        option public_key '*******'

root@OpenWrt:~#

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option syn_flood '1'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'vpnfirewall'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'nordvpntun'

config forwarding
        option src 'lan'
        option dest 'vpnfirewall'

config zone
        option name 'wgfirewall'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wg2'

config forwarding
        option src 'lan'
        option dest 'wgfirewall'

root@OpenWrt:~#

root@OpenWrt:~# ip ro
default via 10.0.0.1 dev wan proto static src 10.0.0.15
10.0.0.0/24 dev wan proto kernel scope link src 10.0.0.15
192.168.1.0/24 dev br-lan proto kernel scope link src 192.168.1.1

interface: wg2
  public key: ********
  private key: (hidden)
  listening port: 49422

peer: *****
  endpoint: 185.255.130.103:51820
  allowed ips: 0.0.0.0/0
  latest handshake: 8 seconds ago
  transfer: 92 B received, 180 B sent
  persistent keepalive: every 25 seconds
2

Remove the metric, then reboot and try again.

3

Thanks a lot for making it work, You are amazing !!!
May i ask a follow-up question or should i open another thread,
Can openwrt have operating profiles, so i can switch between using wireguard or UDP or no vpn. When i try to stop wireguard(WG) internet stops working, i cant activate openvpn UDP to connect to internet. Currently i use a crude method, i have a backup of openvpn, WG and stock openwrt. I restore from that backup depending on what is needed. Is there an elegant way to handle this

4

For the remaining question, a new thread makes the most sense.

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Thanks! :slight_smile:

5

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.