Wiregard server Firewall configuration for LAN access

Hi There,
I am struggling with my installation of Wiregard server on my router.
My goal is accessing my entire Lan thought the Wiregard VPN from outside.
I was able to get an handshake by forwarding the port (my case 51820) to my router IP 192.168.11.1. But I was only able to see (and ping) that IP not the rest of the network. And when I delete this rule handshake is not working.
I played a lot with my firewall rules and I am lost now.

Wiregard interface name: wg0
Wiregard Network interface name: vpn

This is my config right now:
Firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config zone
	option name 'vpn'
	option input 'ACCEPT'
	option output 'ACCEPT'
	list network 'wg0'
	option forward 'ACCEPT'

config forwarding
	option src 'lan'
	option dest 'vpn'

config forwarding
	option src 'vpn'
	option dest 'wan'

config rule
	option name 'Vpn'
	list proto 'udp'
	option src 'wan'
	option src_port '51820'
	option target 'ACCEPT'

config forwarding
	option src 'vpn'
	option dest 'lan'

Network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd98:cfee:971d::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config device
	option name 'lan1'
	option macaddr '94:10:3e:08:b3:2e'

config device
	option name 'lan2'
	option macaddr '94:10:3e:08:b3:2e'

config device
	option name 'lan3'
	option macaddr '94:10:3e:08:b3:2e'

config device
	option name 'lan4'
	option macaddr '94:10:3e:08:b3:2e'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ipaddr '192.168.11.1'

config device
	option name 'wan'
	option macaddr '94:10:3e:08:b3:2e'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

config interface 'wg0'
	option proto 'wireguard'
	option private_key 'router private key' 
	option listen_port '51820'
	list addresses '192.168.9.1/24'

config wireguard_ 'wgclient'
	list allowed_ips '0.0.0.0/0'
	option endpoint_host 'DDNS'
	option endpoint_port '51820'

config wireguard_wg0
	option description 'Julien'
	option route_allowed_ips '1'
	option persistent_keepalive '25'
	list allowed_ips '192.168.9.10/32'
	option public_key 'Phone public key'
	option private_key 'Hidded'
	option preshared_key 'Phone preshared key'

I am lost now :smiling_face_with_tear:
if somebody can help me please
Thanks

If this is the 'server' side, the following should be removed

The firewall looks fine, but let's see your config from your remote peer device ('Julien').

Hi,
Thanks for your answer:
This is it I just double checked the key and it seems good:

Sorry it is in French

This is the conf file of the phone:

[Interface]
PrivateKey = =
Address = 192.168.9.10/32
DNS = 192.168.11.1

[Peer]
PublicKey = Openwrt public key=
PresharedKey = open wrt Presharde key=
AllowedIPs = 0.0.0.0/0
Endpoint = ddns:51820
PersistentKeepalive = 25

That looks fine.

What is the output of the following:

wg show
interface: wg0

public key: 
  private key: (hidden)
  listening port: 51820

peer: (hidden)
  preshared key: (hidden)
  allowed ips: 192.168.9.10/32
  persistent keepalive: every 25 seconds

This is it :point_up_2:

There is no indication of a successful handshake.

Try connecting again -- if that doesn't change (the peer should indicate a "last handshake" time), you probably have an issue with the keys (or one other possible issue).

Let me know what happens when you try connecting again.

1 Like