Wifi routed to VPN only - not working

Installing and Using OpenWrt
1

Team, hoping somebody might be able to help me out.

The goal is to have an wifi ssid "test_vpn" set up that it routes out through a wireguard VPN.

I'm pretty sure I had this working last night as intended, then had a power outage overnight, router came back up today and now, no good. (thinking about it, I'm pretty sure that's the first reboot since I bumped to 25.12 rc1)

Couple of weird things.

On a reboot, seems like nothing is going out via the wireguard interface

If I run ping -I wlp6s0 google.com from my rig, I get

ping -I wlp6s0 google.com
PING google.com (142.251.129.46) from 192.168.4.104 wlp6s0: 56(84) bytes of data.
From _gateway (192.168.4.1) icmp_seq=1 Destination Port Unreachable

an no traffic sent/recieved on the wireguard interface.

wg show gives

interface: proton_US_out
  public key: aJ0tPFnOBwNS2ppg5Vfem4ugwVNOAif3nAA5fA9VxS4=
  private key: (hidden)
  listening port: 57798

peer: Az021MwJA2cczjrXE+NtxVsQaVq2apEkmccB6iE7RzU=
  endpoint: 149.102.228.29:51820
  allowed ips: 0.0.0.0/0, ::/0

If I restart PBR, then I get this

ping -I wlp6s0 google.com
PING google.com (142.251.128.78) from 192.168.4.104 wlp6s0: 56(84) bytes of data.

It just sits there, but, the wireguard interface now has traffic going over it and if I run wg show, it has a handshake now appear.

interface: proton_US_out
  public key: aJ0tPFnOBwNS2ppg5Vfem4ugwVNOAif3nAA5fA9VxS4=
  private key: (hidden)
  listening port: 53204

peer: Az021MwJA2cczjrXE+NtxVsQaVq2apEkmccB6iE7RzU=
  endpoint: 149.102.228.29:51820
  allowed ips: 0.0.0.0/0, ::/0
  latest handshake: 16 minutes, 26 seconds ago
  transfer: 3.00 KiB received, 1.05 KiB sent

contents of /etc/config/network

wg0 is a self hosted wireguard service to get back into my home lan

Summary 
cat /etc/config/network 

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd30:ed34:40ff::/48'
        option packet_steering '1'
        option dhcp_default_duid '00045144ef3abbbb4938b2f9e94d91724269'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config interface 'wg0'
        option proto 'wireguard'
        option private_key '<key>'
        option listen_port '51821'
        list addresses '192.168.2.1/24'

config wireguard_wg0
        option description 'green_oneplus'
        option public_key '6OwCSUvIQD5jLk9XThEDQ/jYUN6PRaaj9dAbCZxbt2A='
        option private_key '<key>'
        list allowed_ips '192.168.2.1/24'
        option persistent_keepalive '25'

config device
        option type 'bridge'
        option name 'bridge_proton'
        option bridge_empty '1'

config interface 'wifi_vpn'
        option proto 'static'
        option device 'wl0-ap1'
        option ipaddr '192.168.4.1'
        option netmask '255.255.255.0'

config interface 'proton_US_out'
        option proto 'wireguard'
        option private_key '<key>'
        list dns '10.2.0.1'
        list addresses '192.168.4.0/24'

config wireguard_proton_US_out
        option description 'Imported peer configuration'
        option public_key 'Az021MwJA2cczjrXE+NtxVsQaVq2apEkmccB6iE7RzU='
        list allowed_ips '0.0.0.0/0'
        list allowed_ips '::/0'
        option endpoint_host '149.102.228.29'
        option endpoint_port '51820'

/etc/config/firewall

Summary 
cat /etc/config/firewall 

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'
        option flow_offloading '1'
        option flow_offloading_hw '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option src 'lan'
        option dest 'wan'
        option name 'monitors drop packets'
        list src_ip '192.168.2.151'
        option target 'DROP'

config zone
        option name 'wg0_VPN'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'wg0'

config forwarding
        option src 'wg0_VPN'
        option dest 'lan'

config forwarding
        option src 'lan'
        option dest 'wg0_VPN'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'nginx_http'
        option src 'wan'
        option src_dport '80'
        option dest_ip '192.168.2.154'
        option dest_port '81'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'nginx_https'
        option src 'wan'
        option src_dport '443'
        option dest_ip '192.168.2.154'
        option dest_port '444'

config zone
        option name 'wif_VPN_fw_zone'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'wifi_vpn'

config zone
        option name 'wg_vpn_fw_zone'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'proton_US_out'
        option masq '1'
        option mtu_fix '1'

config rule
        option src 'wif_VPN_fw_zone'
        option dest 'lan'
        option name 'vpn_wifi_DNS'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option src 'wif_VPN_fw_zone'
        option dest 'lan'
        option name 'vpn_wifi_DHCP'
        option dest_port '67-68'
        option target 'ACCEPT'

config forwarding
        option src 'wif_VPN_fw_zone'
        option dest 'wg_vpn_fw_zone'

/etc/config/wireless

Summary 
cat /etc/config/wireless 

config wifi-device 'radio0'
        option type 'mac80211'
        option phy 'wl0'
        option cell_density '0'
        option htmode 'HT40'
        option band '2g'
        option channel 'auto'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'test'
        option encryption 'psk2'
        option key '<key>'
        option bss_transition '1'
        option ieee80211k '1'
        option max_inactivity '10'
        option ieee80211r '1'
        option mobility_domain '<key>'
        option reassociation_deadline '1000'
        option ft_over_ds '0'
        option ft_psk_generate_local '1'
        option wnm_sleep_mode '1'
        option wnm_sleep_mode_no_keys '1'
        option proxy_arp '1'

config wifi-device 'radio1'
        option type 'mac80211'
        option phy 'wl1'
        option cell_density '0'
        option country 'US'
        option htmode 'HE160'
        option band '5g'
        option channel 'auto'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'test'
        option encryption 'psk2'
        option key '<key>'
        option bss_transition '1'
        option ieee80211k '1'
        option max_inactivity '10'
        option ieee80211r '1'
        option mobility_domain '<key>'
        option reassociation_deadline '1000'
        option ft_over_ds '0'
        option ft_psk_generate_local '1'
        option wnm_sleep_mode '1'
        option wnm_sleep_mode_no_keys '1'
        option proxy_arp '1'

config wifi-iface 'wifinet2'
        option device 'radio0'
        option mode 'ap'
        option ssid 'test_vpn'
        option encryption 'psk2'
        option network 'wifi_vpn'
        option key '<key>'

Couple of questions:

  1. should the proton wg interface have the same list addresses as the wifi ? (I have the wireguard as 192.168.4.0/24 and the test_VPN wifi set up to 192.168.4.1/24
  2. I need to figure out this DNS and DHCP leak business. I set up a separate DNS and DHCP instances and bound it that interface but got something wrong, it was handing out IP's to the whole wifi.

Couple of good sources:

2

The inbound vpn peer should be /32. Probably 192.168.2.2/32:

Remove the current device and replace it with bridge_proton:

The address here is wrong:

The correct address should be provided by proton, and it must not overlap any of your other subnets.

3

To add your lan interface and wireguard server interface are using the same subnet.
WireGuard is a routed solution all three involved subnets have to be different and non overlapping

How I setup WireGuard:
WireGuard Server Setup Guide
WireGuard Client Setup Guide

1 Like
4

TY @egc and @psherman. Really appreciate your feedback.

Thanks, sorted.

(so this is the IP address that that the wireguard is using on the inside of my lan zone right?)

config interface 'wg0'
        option proto 'wireguard'
        option private_key '<key>'
        option listen_port '51821'
        list addresses '192.168.2.2/32'

Thanks, sorted.

(I thought I could skip the bridge and bind the device directly to the ssid, I had been playing around with this in testing and figured if I had one ssid hanging off this, I could skip the bridge?, meh works now)

config interface 'wifi_vpn'
        option proto 'static'
        option device 'bridge_proton'
        option ipaddr '192.168.4.1'
        option netmask '255.255.255.0'

fixed, re-imported my config file and that was the address it had.

(I remember when I was first setting this up, I looked at that address and was like "oh that looks wrong" and changed it, my bad. I'm thinking this is the address I'm using inside the proton infrastructure?)

config interface 'proton_US_out'
        option proto 'wireguard'
        option private_key '<key>'
        list dns '10.2.0.1'
        list addresses '10.2.0.2/32'

hm, ok, so my lan is set up as 192.168.2.1/24. so my incoming wg0 interface should be something different, so 192.168.3.1/32?

Then I have my wifi vpn subnet at 192.168.4.1/24?

I extended the little network map from here: https://openwrt.org/docs/guide-user/network/network_configuration

+--------------------------+-----------------------------------------------+-----------------------------------------------------------------------------+---------+----------------------+-------------------------------+----------------------+
| LuCI → Network           | Comment                                       | Example                                                                     |         | self hosted wg       | proton vpn account "outbound" |                      |
+--------------------------+-----------------------------------------------+-----------------------------------------------------------------------------+---------+----------------------+-------------------------------+----------------------+
| Firewall                 | Rules for traffic between zones               | Forwarding Rules, Traffic Rules, Custom Rules                                         |                      |                               |                      |
+--------------------------+-----------------------------------------------+------------------------------+--------------------------------------------------------+----------------------+-------------------------------+----------------------+
| Firewall / Interfaces    | Network zone configuration                    | WAN (Zone)                   | LAN (Zone)                                             | wg0                  | proton_US_out                 | wif_VPN_fw_zone      |
+--------------------------+-----------------------------------------------+----------------------+-------+--------------------------------------------------------+----------------------+-------------------------------+----------------------+
| Interfaces → Interfaces  | IP configuration                              | WAN (192.168.1.5/24) | WAN6  | LAN (192.168.2.1/24)                                   | wg0 (192.168.2.2/32) | proton_US_out (10.2.0.2/32)   | wifi_vpn (...4.1/24) |
|                          |                                               |                      |       |                                                        | or (192.168.3.1/32)  |                               |                      |
+--------------------------+-----------------------------------------------+----------------------+-------+--------------------------------------------------------+----------------------+-------------------------------+----------------------+
| Interfaces → Devices     | Devices and bridge configuration              | eth0                         | br-lan (bridge config)                                 |                      |                               | bridge_proton        |
+--------------------------+-----------------------------------------------+------------------------------+-----------------------------------+----------+---------+----------------------+-------------------------------+----------------------+
| Switch / Wireless        | VLANs and wireless SSIDs                      | VLAN 2 (eth0.2)              | VLAN 1 (eth0.1)                   | test     | test    |                      |                               | test_vpn             |
+--------------------------+-----------------------------------------------+------------------------------+--------+--------+--------+--------+----------+---------+----------------------+-------------------------------+----------------------+
| Switch / Wireless        | Internal jack labels and radio labels         | WAN (Interface)              | LAN 1  | LAN 2  | LAN 3  | LAN 4  | radio0   | radio1  |                      |                               | radio0               |
+--------------------------+-----------------------------------------------+------------------------------+--------+--------+--------+--------+----------+---------+----------------------+-------------------------------+----------------------+
| -                        | Common vendor labels on backside of a device  | “Internet”                   | “1”    | “2”    | “3”    | “4”    | “b/g/n”  | “n/ac”  |                      |                               | “b/g/n”              |
+--------------------------+-----------------------------------------------+------------------------------+--------+--------+--------+--------+----------+---------+----------------------+-------------------------------+----------------------+

I also had to adjust this firewall rule. from option input 'REJECT' to option input 'ACCEPT', with reject active I wasn't able to get an IP address on any network device

config zone
        option name 'wif_VPN_fw_zone'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'wifi_vpn'

Need to work through DNS and DHCP leaks to make sure that's working now.