Unable to connect to a Wireguard VPN on clients connected to my OpenWRT router

Installing and Using OpenWrt
1

Hi all, so I am a bit new to OpenWRT and for work, I am supposed to connect to a Wireguard VPN. I use Linux on my main machine.

I have a Gateway from my ISP, which I have the IP passed through to my router and everything is working fine.

When I enable the Wireguard connection on my computers, I cannot connect to the sites on the VPN. However, if I take my laptop to the gateway and plug it in to the gateway (bypassing the router), I am able to connect.

When connecting from behind the router, the behavior seems to mostly be that DNS isn't resolving, because I can get to some of the sites via their VPN IP addresses.

Does anyone have some suggestions as to why this might be happening?

2

It can help if you show us your configs.
Please connect to your OpenWRT device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button

Remember to redact keys, passwords, MAC addresses and any public IP addresses you may have but do not redact private RFC 1918 IP addresses (192.168.X.X, 10.X.X.X and 172.16-32.X.X) as that is not needed:

ubus call system board
cat /etc/config/network
cat /etc/config/dhcp
cat /etc/config/firewall
ip route show
ifstatus wan
3

Ok, here are all the commands in order you listed

{
        "kernel": "6.6.73",
        "hostname": "BananaWRT",
        "system": "ARMv8 Processor rev 4",
        "model": "Bananapi BPI-R3",
        "board_name": "bananapi,bpi-r3",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "24.10.0",
                "revision": "r28427-6df0e3d02a",
                "target": "mediatek/filogic",
                "description": "OpenWrt 24.10.0 r28427-6df0e3d02a",
                "builddate": "1738624177"
        }
}

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd75:b987:f084::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        list ports 'sfp2'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device
        option name 'br-wan'
        option type 'bridge'
        list ports 'eth1'
        list ports 'wan'

config device
        option name 'eth1'
        option macaddr 'c6:cd:95:9a:d5:37'

config device
        option name 'wan'
        option macaddr 'c6:cd:95:9a:d5:37'

config interface 'wan'
        option device 'br-wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'br-wan'
        option proto 'dhcpv6'

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '1000'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'
        option sequential_ip '1'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        option ra_slaac '1'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config host
        option name '70-b5-e8-4f-77-c4'
        option ip '192.168.1.126'
        list mac '70:B5:E8:4F:77:C4'

        
config defaults
        option syn_flood '1'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'Openshift 80'
        option src 'wan'
        option src_dport '80'
        option dest_ip '192.168.1.126'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'Openshift 443'
        option src 'wan'
        option src_dport '443'
        option dest_ip '192.168.1.126'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'Openshift 6443'
        option src 'wan'
        option src_dport '6443'
        option dest_ip '192.168.1.126'
        
default via <redacted> dev br-wan  src <redacted> 
<redacted> dev br-wan scope link  src <redacted> 
192.168.1.0/24 dev br-lan scope link  src 192.168.1.1 

{
        "up": true,
        "pending": false,
        "available": true,
        "autostart": true,
        "dynamic": false,
        "uptime": 6539,
        "l3_device": "br-wan",
        "proto": "dhcp",
        "device": "br-wan",
        "metric": 0,
        "dns_metric": 0,
        "delegation": true,
        "ipv4-address": [
                {
                        "address": "<redacted>",
                        "mask": 22
                }
        ],
        "ipv6-address": [

        ],
        "ipv6-prefix": [

        ],
        "ipv6-prefix-assignment": [

        ],
        "route": [
                {
                        "target": "0.0.0.0",
                        "mask": 0,
                        "nexthop": "<redacted>",
                        "source": "<redacted>"
                }
        ],
        "dns-server": [
                "192.168.11.254"
        ],
        "dns-search": [
                "attlocal.net"
        ],
        "neighbors": [

        ],
        "inactive": {
                "ipv4-address": [

                ],
                "ipv6-address": [

                ],
                "route": [

                ],
                "dns-server": [

                ],
                "dns-search": [

                ],
                "neighbors": [

                ]
        },
        "data": {
                "dhcpserver": "192.168.11.254",
                "leasetime": 600
        }
}
4

You are running an outdated build which has some safety concerns, update to at least 24.10.7 or better 25.12.5

Is your wan ip address a public IP address or something like 192.168.11.X?

The only DNS server you are using seems 192.168.11.254 which might not play well if you have a public IP address.

I suggest on the WAN interface > Advanced tab to disable Peer DNS and add public DNS servers like this:

afbeelding
afbeelding1506×268 18.7 KB

Otherwise I do not see anything out of the ordinary

In your WireGuard config on your PC set the MTU to 1280 and use a public DNS server like 1.1.1.1
If that works you can increase the MTU to a max of 1420 and try a DNS server which comes with the config

5

This resolved it. Thanks so much. I'll look into updating the router next. Is there a good guide for doing that without messing anything up?

6

Curious what was the problem?

Usually you can do an in place upgrade with owut or lucy attended sysupgrade.

I do not have your router but the Pi's might need special attention

I suggest to consult the wiki for your router.

7

I disabled Peer DNS and added the public DNS, it seemed like the local DNS was not resolving correctly? (I am not sure the root of the problem, unfortunately networking is not my strong suit). My router does have a public IP address, so maybe that is what did it?

Originally I added 9.9.9.9 to my desktop network interface to get it to work, but adding it on the WAN interface allows both my computers to access the VPN

8

Yes probably :slight_smile:

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Thanks! :slight_smile: