I already use asus router with wireguard + airvpn.
Works perfect before but since yesterday doesn't work anymore.
Reinstall and upgrade to the latest firmware doesn't help
system log
The log pretty much say you have a working system and you have logged in to luci.
So what is the problem and what did you do before the problem started?
1 Like
did nothing
I have heard that in this forum before…
But still, you don’t say what is wrong?
1 Like
You are ought to use wifi country code and not post your MAC+ access codes on public eternal websites.
How do you know and what function does not work?
2 Likes
Just saying "it doesn't work now" really isn't very helpful and won't get you any answers. How about:
- What were you trying to do?
- How did you try to do it?
- What did you expect to happen?
- What actually happened?
3 Likes
here is my information
logread -e vpn; netstat -l -n -p | grep -e "^udp\s.*\s-$"
Summary
root@OpenWRT:~# service log restart; service network restart; sleep 10
root@OpenWRT:~# logread -e vpn; netstat -l -n -p | grep -e "^udp\s.\s-$"
udp 0 0 0.0.0.0:44491 0.0.0.0: -
udp 0 0 :::44491 :::*
root@OpenWRT:~# pgrep -f -a wg; wg show; wg showconf vpn
Summary
13 kworker/0:1-wg-
14 kworker/0:2-wg-
7527 wg-crypt-WGINTE
interface: WGINTERFACE
public key: XXX
private key: (hidden)
listening port: 44491
peer: XXX
preshared key: (hidden)
endpoint: hidden ip:1637
allowed ips: 0.0.0.0/0, ::/0
latest handshake: 1 minute, 43 seconds ago
transfer: 276 B received, 1.21 KiB sent
persistent keepalive: every 15 seconds
Unable to access interface: No such device
root@OpenWRT:~# ip address show; ip route show table all
Summary
root@OpenWRT:~# ip address show; ip route show table all
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN qlen 1000
link/ether here my mac brd ff:ff:ff:ff:ff:ff
inet6 hidden/64 scope link
valid_lft forever preferred_lft forever
27: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
link/ether here my mac brd ff:ff:ff:ff:ff:ff
inet 192.168.99.1/24 brd 192.168.99.255 scope global br-lan
valid_lft forever preferred_lft forever
inet6 hidden1/60 scope global noprefixroute
valid_lft forever preferred_lft forever
inet6 hidden/64 scope link
valid_lft forever preferred_lft forever
28: eth0.1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
link/ether here my mac brd ff:ff:ff:ff:ff:ff
29: eth0.2@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
link/ether here my mac brd ff:ff:ff:ff:ff:ff
inet 192.168.100.3/24 brd 192.168.100.255 scope global eth0.2
valid_lft forever preferred_lft forever
inet6 hidden/64 scope link
valid_lft forever preferred_lft forever
31: WGINTERFACE: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1320 qdisc noqueue state UNKNOWN qlen 1000
link/[65534]
inet here ip address/32 brd 255.255.255.255 scope global WGINTERFACE
valid_lft forever preferred_lft forever
inet6 hidden/128 scope global
valid_lft forever preferred_lft forever
32: phy1-ap0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
link/ether here my mac brd ff:ff:ff:ff:ff:ff
inet6 hidden/64 scope link
valid_lft forever preferred_lft forever
33: phy0-ap0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
link/ether here my mac brd ff:ff:ff:ff:ff:ff
inet6 hidden/64 scope link
valid_lft forever preferred_lft forever
default via 192.168.100.1 dev eth0.2 src 192.168.100.3
192.168.99.0/24 dev br-lan scope link src 192.168.99.1
192.168.100.0/24 dev eth0.2 scope link src 192.168.100.3
vpn ip via 192.168.100.1 dev eth0.2
local here ip address dev WGINTERFACE table local scope host src here ip address
local 127.0.0.0/8 dev lo table local scope host src 127.0.0.1
local 127.0.0.1 dev lo table local scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local scope link src 127.0.0.1
local 192.168.99.1 dev br-lan table local scope host src 192.168.99.1
broadcast 192.168.99.255 dev br-lan table local scope link src 192.168.99.1
local 192.168.100.3 dev eth0.2 table local scope host src 192.168.100.3
broadcast 192.168.100.255 dev eth0.2 table local scope link src 192.168.100.3
hidden/64 dev br-lan metric 1024
unreachable hidden/48 dev lo metric 2147483647
hidden dev WGINTERFACE metric 256
fe80::/64 dev eth0 metric 256
fe80::/64 dev eth0.2 metric 256
fe80::/64 dev br-lan metric 256
fe80::/64 dev phy1-ap0 metric 256
fe80::/64 dev phy0-ap0 metric 256
local ::1 dev lo table local metric 0
anycast hidden dev br-lan table local metric 0
local hidden1 dev br-lan table local metric 0
local hidden dev WGINTERFACE table local metric 0
anycast fe80:: dev eth0 table local metric 0
anycast fe80:: dev eth0.2 table local metric 0
anycast fe80:: dev br-lan table local metric 0
anycast fe80:: dev phy1-ap0 table local metric 0
anycast fe80:: dev phy0-ap0 table local metric 0
local hidden dev eth0 table local metric 0
local hidden dev eth0.2 table local metric 0
local hidden dev phy1-ap0 table local metric 0
local hidden dev br-lan table local metric 0
local hidden dev phy0-ap0 table local metric 0
multicast ff00::/8 dev eth0 table local metric 256
multicast ff00::/8 dev br-lan table local metric 256
multicast ff00::/8 dev eth0.2 table local metric 256
multicast ff00::/8 dev WGINTERFACE table local metric 256
multicast ff00::/8 dev phy1-ap0 table local metric 256
multicast ff00::/8 dev phy0-ap0 table local metric 256
root@OpenWRT:~# ip rule show; ip -6 rule show; nft list ruleset
Summary
0: from all lookup local
32766: from all lookup main
32767: from all lookup default
0: from all lookup local
32766: from all lookup main
table inet fw4 {
chain input {
type filter hook input priority filter; policy drop;
iifname "lo" accept comment "!fw4: Accept traffic from loopback"
ct state established,related accept comment "!fw4: Allow inbound established and related flows"
tcp flags syn / fin,syn,rst,ack jump syn_flood comment "!fw4: Rate limit TCP syn packets"
iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
iifname "eth0.2" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
iifname "WGINTERFACE" jump input_WGZONE comment "!fw4: Handle WGZONE IPv4/IPv6 input traffic"
jump handle_reject
}
chain forward {
type filter hook forward priority filter; policy drop;
ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
iifname "eth0.2" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
iifname "WGINTERFACE" jump forward_WGZONE comment "!fw4: Handle WGZONE IPv4/IPv6 forward traffic"
jump handle_reject
}
chain output {
type filter hook output priority filter; policy accept;
oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state established,related accept comment "!fw4: Allow outbound established and related flows"
oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
oifname "eth0.2" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
oifname "WGINTERFACE" jump output_WGZONE comment "!fw4: Handle WGZONE IPv4/IPv6 output traffic"
}
chain prerouting {
type filter hook prerouting priority filter; policy accept;
iifname "br-lan" jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment"
}
chain handle_reject {
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject comment "!fw4: Reject any other traffic"
}
chain syn_flood {
limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit"
drop comment "!fw4: Drop excess packets"
}
chain input_lan {
jump accept_from_lan
}
chain output_lan {
jump accept_to_lan
}
chain forward_lan {
jump accept_to_WGZONE comment "!fw4: Accept lan to WGZONE forwarding"
jump accept_to_lan
}
chain helper_lan {
}
chain accept_from_lan {
iifname "br-lan" counter packets 510 bytes 37702 accept comment "!fw4: accept lan IPv4/IPv6 traffic"
}
chain accept_to_lan {
oifname "br-lan" counter packets 173 bytes 13741 accept comment "!fw4: accept lan IPv4/IPv6 traffic"
}
chain input_wan {
meta nfproto ipv4 udp dport 68 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCP-Renew"
icmp type echo-request counter packets 0 bytes 0 accept comment "!fw4: Allow-Ping"
meta nfproto ipv4 meta l4proto igmp counter packets 0 bytes 0 accept comment "!fw4: Allow-IGMP"
meta nfproto ipv6 udp dport 546 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCPv6"
ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { mld-listener-query . no-route, mld-listener-report . no-route, mld-listener-done . no-route, mld2-listener-report . no-route } counter packets 0 bytes 0 accept comment "!fw4: Allow-MLD"
icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply, nd-router-solicit, nd-router-advert } limit rate 1000/second counter packets 1 bytes 72 accept comment "!fw4: Allow-ICMPv6-Input"
icmpv6 type . icmpv6 code { packet-too-big . no-route, parameter-problem . no-route, nd-neighbor-solicit . no-route, nd-neighbor-advert . no-route, parameter-problem . admin-prohibited } limit rate 1000/second counter packets 12 bytes 832 accept comment "!fw4: Allow-ICMPv6-Input"
jump reject_from_wan
}
chain output_wan {
jump accept_to_wan
}
chain forward_wan {
icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
icmpv6 type . icmpv6 code { packet-too-big . no-route, parameter-problem . no-route, parameter-problem . admin-prohibited } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
meta l4proto esp counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: Allow-IPSec-ESP"
udp dport 500 counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: Allow-ISAKMP"
jump reject_to_wan
}
chain accept_to_wan {
meta nfproto ipv4 oifname "eth0.2" ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage"
oifname "eth0.2" counter packets 465 bytes 33406 accept comment "!fw4: accept wan IPv4/IPv6 traffic"
}
chain reject_from_wan {
iifname "eth0.2" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
}
chain reject_to_wan {
oifname "eth0.2" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
}
chain input_WGZONE {
jump reject_from_WGZONE
}
chain output_WGZONE {
jump accept_to_WGZONE
}
chain forward_WGZONE {
jump reject_to_WGZONE
}
chain accept_to_WGZONE {
meta nfproto ipv4 oifname "WGINTERFACE" ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage"
oifname "WGINTERFACE" counter packets 0 bytes 0 accept comment "!fw4: accept WGZONE IPv4/IPv6 traffic"
}
chain reject_from_WGZONE {
iifname "WGINTERFACE" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject WGZONE IPv4/IPv6 traffic"
}
chain reject_to_WGZONE {
oifname "WGINTERFACE" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject WGZONE IPv4/IPv6 traffic"
}
chain dstnat {
type nat hook prerouting priority dstnat; policy accept;
}
chain srcnat {
type nat hook postrouting priority srcnat; policy accept;
oifname "eth0.2" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
oifname "WGINTERFACE" jump srcnat_WGZONE comment "!fw4: Handle WGZONE IPv4/IPv6 srcnat traffic"
}
chain srcnat_wan {
meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic"
}
chain srcnat_WGZONE {
meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 WGZONE traffic"
}
chain raw_prerouting {
type filter hook prerouting priority raw; policy accept;
}
chain raw_output {
type filter hook output priority raw; policy accept;
}
chain mangle_prerouting {
type filter hook prerouting priority mangle; policy accept;
}
chain mangle_postrouting {
type filter hook postrouting priority mangle; policy accept;
}
chain mangle_input {
type filter hook input priority mangle; policy accept;
}
chain mangle_output {
type route hook output priority mangle; policy accept;
}
chain mangle_forward {
type filter hook forward priority mangle; policy accept;
iifname "eth0.2" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 ingress MTU fixing"
oifname "eth0.2" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 egress MTU fixing"
iifname "WGINTERFACE" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone WGZONE IPv4/IPv6 ingress MTU fixing"
oifname "WGINTERFACE" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone WGZONE IPv4/IPv6 egress MTU fixing"
}
}
root@OpenWRT:~# uci show network; uci show firewall; crontab -l
Summary
network.loopback=interface
network.loopback.device='lo'
network.loopback.proto='static'
network.loopback.ipaddr='127.0.0.1'
network.loopback.netmask='255.0.0.0'
network.globals=globals
network.globals.ula_prefix='hidden::/48'
network.@device[0]=device
network.@device[0].name='br-lan'
network.@device[0].type='bridge'
network.@device[0].ports='eth0.1'
network.@device[1]=device
network.@device[1].name='eth0.1'
network.@device[1].macaddr='hidden'
network.lan=interface
network.lan.device='br-lan'
network.lan.proto='static'
network.lan.ipaddr='192.168.99.1'
network.lan.netmask='255.255.255.0'
network.lan.ip6assign='60'
network.lan.dns='8.8.8.8' '8.8.4.4'
network.wan=interface
network.wan.device='eth0.2'
network.wan.proto='dhcp'
network.wan.peerdns='0'
network.wan6=interface
network.wan6.device='eth0.2'
network.wan6.proto='dhcpv6'
network.@switch[0]=switch
network.@switch[0].name='switch0'
network.@switch[0].reset='1'
network.@switch[0].enable_vlan='1'
network.@switch_vlan[0]=switch_vlan
network.@switch_vlan[0].device='switch0'
network.@switch_vlan[0].vlan='1'
network.@switch_vlan[0].ports='1 2 3 4 6t'
network.@switch_vlan[1]=switch_vlan
network.@switch_vlan[1].device='switch0'
network.@switch_vlan[1].vlan='2'
network.@switch_vlan[1].ports='0 6t'
network.WGINTERFACE=interface
network.WGINTERFACE.proto='wireguard'
network.WGINTERFACE.private_key='hidden'
network.WGINTERFACE.addresses='hidden'
network.WGINTERFACE.dns='10.128.0.1' 'hidden'
network.WGINTERFACE.force_link='1'
network.WGINTERFACE.mtu='1320'
network.@wireguard_WGINTERFACE[0]=wireguard_WGINTERFACE
network.@wireguard_WGINTERFACE[0].description='Imported peer configuration'
network.@wireguard_WGINTERFACE[0].public_key='hidden'
network.@wireguard_WGINTERFACE[0].preshared_key='hidden'
network.@wireguard_WGINTERFACE[0].allowed_ips='0.0.0.0/0' '::/0'
network.@wireguard_WGINTERFACE[0].persistent_keepalive='15'
network.@wireguard_WGINTERFACE[0].endpoint_host='hidden vpn ip'
network.@wireguard_WGINTERFACE[0].endpoint_port='1637'
firewall.@defaults[0]=defaults
firewall.@defaults[0].input='REJECT'
firewall.@defaults[0].output='ACCEPT'
firewall.@defaults[0].forward='REJECT'
firewall.@defaults[0].synflood_protect='1'
firewall.@zone[0]=zone
firewall.@zone[0].name='lan'
firewall.@zone[0].network='lan'
firewall.@zone[0].input='ACCEPT'
firewall.@zone[0].output='ACCEPT'
firewall.@zone[0].forward='ACCEPT'
firewall.@zone[1]=zone
firewall.@zone[1].name='wan'
firewall.@zone[1].network='wan' 'wan6'
firewall.@zone[1].input='REJECT'
firewall.@zone[1].output='ACCEPT'
firewall.@zone[1].forward='REJECT'
firewall.@zone[1].masq='1'
firewall.@zone[1].mtu_fix='1'
firewall.@rule[0]=rule
firewall.@rule[0].name='Allow-DHCP-Renew'
firewall.@rule[0].src='wan'
firewall.@rule[0].proto='udp'
firewall.@rule[0].dest_port='68'
firewall.@rule[0].target='ACCEPT'
firewall.@rule[0].family='ipv4'
firewall.@rule[1]=rule
firewall.@rule[1].name='Allow-Ping'
firewall.@rule[1].src='wan'
firewall.@rule[1].proto='icmp'
firewall.@rule[1].icmp_type='echo-request'
firewall.@rule[1].family='ipv4'
firewall.@rule[1].target='ACCEPT'
firewall.@rule[2]=rule
firewall.@rule[2].name='Allow-IGMP'
firewall.@rule[2].src='wan'
firewall.@rule[2].proto='igmp'
firewall.@rule[2].family='ipv4'
firewall.@rule[2].target='ACCEPT'
firewall.@rule[3]=rule
firewall.@rule[3].name='Allow-DHCPv6'
firewall.@rule[3].src='wan'
firewall.@rule[3].proto='udp'
firewall.@rule[3].dest_port='546'
firewall.@rule[3].family='ipv6'
firewall.@rule[3].target='ACCEPT'
firewall.@rule[4]=rule
firewall.@rule[4].name='Allow-MLD'
firewall.@rule[4].src='wan'
firewall.@rule[4].proto='icmp'
firewall.@rule[4].src_ip='fe80::/10'
firewall.@rule[4].icmp_type='130/0' '131/0' '132/0' '143/0'
firewall.@rule[4].family='ipv6'
firewall.@rule[4].target='ACCEPT'
firewall.@rule[5]=rule
firewall.@rule[5].name='Allow-ICMPv6-Input'
firewall.@rule[5].src='wan'
firewall.@rule[5].proto='icmp'
firewall.@rule[5].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type' 'router-solicitation' 'neighbour-solicitation' 'router-advertisement' 'neighbour-advertisement'
firewall.@rule[5].limit='1000/sec'
firewall.@rule[5].family='ipv6'
firewall.@rule[5].target='ACCEPT'
firewall.@rule[6]=rule
firewall.@rule[6].name='Allow-ICMPv6-Forward'
firewall.@rule[6].src='wan'
firewall.@rule[6].dest='*'
firewall.@rule[6].proto='icmp'
firewall.@rule[6].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type'
firewall.@rule[6].limit='1000/sec'
firewall.@rule[6].family='ipv6'
firewall.@rule[6].target='ACCEPT'
firewall.@rule[7]=rule
firewall.@rule[7].name='Allow-IPSec-ESP'
firewall.@rule[7].src='wan'
firewall.@rule[7].dest='lan'
firewall.@rule[7].proto='esp'
firewall.@rule[7].target='ACCEPT'
firewall.@rule[8]=rule
firewall.@rule[8].name='Allow-ISAKMP'
firewall.@rule[8].src='wan'
firewall.@rule[8].dest='lan'
firewall.@rule[8].dest_port='500'
firewall.@rule[8].proto='udp'
firewall.@rule[8].target='ACCEPT'
firewall.@zone[2]=zone
firewall.@zone[2].name='WGZONE'
firewall.@zone[2].input='REJECT'
firewall.@zone[2].output='ACCEPT'
firewall.@zone[2].forward='REJECT'
firewall.@zone[2].masq='1'
firewall.@zone[2].mtu_fix='1'
firewall.@zone[2].network='WGINTERFACE'
firewall.@forwarding[0]=forwarding
firewall.@forwarding[0].src='lan'
firewall.@forwarding[0].dest='WGZONE'
crontab: can't open 'root': No such file or directory
I don't have online access
Is wireguard up ?
I don't have online access, so I can't check
I see in airvpn client area my device connect to server . but i don't have internet
traceroute 1.1.1.1
traceroute to 1.1.1.1 (1.1.1.1), 30 hops max, 46 byte packets
1 192.168.100.1 (192.168.100.1) 0.420 ms 0.520 ms 0.080 ms
2 ip (ip) 4.580 ms 4.020 ms 3.440 ms
3 here I hide my ip mask 2.940 ms 3.620 ms 3.820 ms
4 here I hide my ip mask 3.920 ms 4.180 ms 3.560 ms
5 internet provider (ip) 4.320 ms 4.420 ms 4.120 ms
6 internet provider (ip) 8.360 ms 4.080 ms 4.160 ms
7 cloudflare.xxx.net (ip) 4.780 ms 4.160 ms 5.320 ms
8 one.one.one.one (1.1.1.1) 3.620 ms 4.200 ms 3.640 ms
It looks like everything now works?
looks that works, but don't work. It's no joke i don't have access
I checked in any device
DNS?
nslookup google.com
above traceroute go through my internet provider! but must through wireguard
From the lan/wifi client it should go to wireguard only according to your configuration, there is no lan-wan forward, so only direct connections from the router can bypass wg.
Run the network diagnostics from lan client, router itself can access wan
I don't use windows, here is no problem with devices
any device don't have internet such as iphone, android