Wireguard 5.15.146-1 & 5.15.137-1 Error exporting (importing) configuration from file

There is a configuration file

Summary

[Interface]
PrivateKey = kH0MjeVblaru7JC/QXeYbla=bla2bVblagNI24=
Address = 172.16.0.2/32
Address = 2606:4700:110:86f2:5088:3fb5:3f78:b843/128
DNS = 1.1.1.1, 1.0.0.1, 2606:4700:4700::1111, 2606:4700:4700::1001
MTU = 1280
[Peer]
PublicKey = bmXOC+F1Fxbla9dyiblaHblaUtzH0JuVblah2wPfgyo=
AllowedIPs = 0.0.0.0/0
AllowedIPs = ::/0
Endpoint = engage.cloudflareclient.com:2408

The following parameters are not entered in the required lines (import via Luci):

[Interface]

Summary

Address = 172.16.0.2/32
MTU = 1280

[Peer]

Summary

AllowedIPs = 0.0.0.0/0

I hope that the keys you've shared in this post are not real (or have been otherwise manipulated). If they're the real keys, they should be destroyed since they can now be assumed compromised due to exposure on the internet.

Meanwhile, this appears to be a 'client' type connection to a commercial VPN. I'm not sure why you would need to export this from OpenWrt, as it would not be useful as an exported entity. (I can understand the need to import, but export is meaningless here).

Can you describe specifically what your goal is here?

The keys are not working))) And yes. If you look from this angle, then maybe imports)))
Drag the file with the mouse onto the window in Luci.
Strange implementation. Usually a dialogue with opening a file is implemented, but here it’s drag and drop.
Also in 2 windows.
The function is there, but it doesn't work correctly.
Purpose of the post. If the function exists, it should work correctly so that you don’t have to enter this data manually later.

Also, very often after a connection break, the WG interface does not rise automatically or even manually. It says that the interface was not found. Although the WAN is up and running at this time without any problems.
A complete reboot of the router is required to restore operation.

Let’s review the config that you’ve got running now.

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/firewall
root@OpenWrt:~# ubus call system board
{
        "kernel": "5.15.146",
        "hostname": "OpenWrt",
        "system": "ARMv8 Processor rev 4",
        "model": "Xiaomi Mi Router AX3000T",
        "board_name": "xiaomi,mi-router-ax3000t",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "SNAPSHOT",
                "revision": "r24813-622340f6c1",
                "target": "mediatek/filogic",
                "description": "OpenWrt SNAPSHOT r24813-622340f6c1"
        }
}
root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdb3:9a12:de06::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device
        option name 'wan'
        option macaddr 'a4:a9:ba:bu:by:ba'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config interface 'CloudFlare'
        option proto 'wireguard'
        option private_key 'kH0MjeVzblapru7JblaeYcZdfblu8l2bVblagNI24='
        list dns '1.1.1.1'
        list dns '1.0.0.1'
        list dns '2606:4700:4700::1111'
        list dns '2606:4700:4700::1001'
        option mtu '1280'
        list addresses '172.16.0.2/32'
        list addresses '2606:4700:110:86f2:5088:3fb5:3f78:b843/128'

config wireguard_CloudFlare
        option description 'wgcf-profile.conf'
        option public_key 'bmXblaF1FxEbladyibla5/1SUbla0JuVbla2wPfgyo='
        option endpoint_host 'engage.cloudflareclient.com'
        option endpoint_port '2408'
        option route_allowed_ips '1'
        option persistent_keepalive '25'
        list allowed_ips '0.0.0.0/0'
        list allowed_ips '::/0'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option syn_flood '1'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'
        list network 'CloudFlare'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

root@OpenWrt:~#

But the data I wrote about in these lines was entered manually and naturally everything works.
The equipment to which this router is connected reboots once a day at the same time. After this, problems occur with the WG interface, but not every time.

You can use the file I posted for tests. Naturally, the VPN will not work due to fake keys, but how the Luci interface handles it in the plugin settings will be visible.

5.15.147-1 still the same...

Except for the MTU settings everything in my config is imported correctly:

Add Interface
specify name and protocol
Create interface 
load configuration
[Interface]
# Device: Useful Rhino
PrivateKey = YGaBrXXXXXXX=
Address = 10.68.89.7/32,fc00:bbbb:bbbb:bb01::5:5906/128
DNS = 10.64.0.1
MTU = 1280

[Peer]
PublicKey = oxJ2XXXXXXXXXXX=
AllowedIPs = 0.0.0.0/0,::0/0
Endpoint = 149.40.50.98:51820
PersistentKeepalive = 25

Because in your file the data for IPV4 and 6 is entered on one line, but in mine IPV4 and IPV6 are in separate lines. Likewise,
MTU is not processed as a separate line)))

As I already confirmed, MTU is not processed but otherwise it looks like it is working as intended.

If you have a config file which is not adhering to the standard it apparently cannot be processed :frowning:

No. This is a processing error by the plugin.
My file clearly states what this parameter is.
And where did you get the idea that your file is correct, and not mine? Because it coincided almost 100% with the plugin’s processing algorithm?
But that's not true.
MTU in a new line with an explicitly specified parameter in which line it should be imported, but this does not happen.

Line
Address =
Must write data in the plugin field of the same name, the following line
Address =
You must write the corresponding data in a new field of the same name.
And so on.
MTU to the MTU line, but this does not happen.
Mm yes.
My file is more correct than yours due to the fact that not all providers work with the IPV6 protocol.
Any user can remove them from my file before importing, but from yours only the one who knows what the IPV4 and 6 addresses look like and where one ends and the other begins.
In general, you need to repair the plugin.

        list addresses '172.16.0.2/32'
        list addresses '2606:4700:110:86f2:5088:3fb5:3f78:b843/128'

This is how it looks in the config, added manually through the plugin interface in Luci.
This can also be done by directly editing the file, I suspect that you have it all in one line, both IPV4 and IPV6, and it’s good if the plugin processes this correctly during its work, and not just when importing data.

And in your file there is no DNS address for IPV6, there is only for IPV4.
Is this also correct?)))

Endpoint = 149.40.50.98:51820

IPV6????

This is how it looks when I import my config and it is just as it expected

config interface 'wg_mullv_us'
	option proto 'wireguard'
	option private_key 'YGaBrMXXXXXX='
	list addresses '10.68.89.7/32'
	list addresses 'fc00:bbbb:bbbb:bb01::5:5906/128'
	list dns '10.64.0.1'

config wireguard_wg_mullv_us
	option description 'mullvad-us-bos-wg-101.conf'
	option public_key 'oxJ2XXXXXXXXXXXXXX='
	list allowed_ips '0.0.0.0/0'
	list allowed_ips '::0/0'
	option persistent_keepalive '25'
	option route_allowed_ips '1'
	option endpoint_host '149.40.50.98'
	option endpoint_port '51820'

when I import my config file (well it is not mine it is actually one I get from Mullvad my VPN provider) in the standard Windows or Android client it is also imported and working

But feel free to make a pull request

I understand why your file is imported almost “correctly” and I indicated where there are shortcomings in your file that are not related to the work of the plugin, but are related to the work of your VPN provider, where there is not enough IPV6 data for correct operation, but nevertheless it works according to IPV4.

        list addresses '2606:4700:110:86f2:5088:3fb5:3f78:b843/128'
        list addresses '172.16.0.2/32'

This should be added on import, but only one line is imported (which comes first) and the rest are ignored.
And in Luci’s web interface it is there and works.

P.S.
In your file, everything is written on one line, both IPv4 and IPv6. The plugin itself looks for the beginning and end of addresses and creates the correct lines in the config. In my case, these lines are already written separately (correctly), but the plugin ignores everything except the first one.

It appears to be a WARP config generated by wgcf (https://github.com/ViRb3/wgcf). It may have helped if the OP made note of that. In any case, setting up a WARP WG VPN on an OpenWrt device works here.

Lastly, IPv6 will need some form of NAT for IPv6 installed, as WARP only issues a single /128 IP for the peer config. IPv4 on the other hand can simply be configured to use masquerade. This is normal and expected behavior. IPv6 will only work on the OpenWrt otherwise.

2 Likes

This is all good, I can find someone who can configure the file for the plugin, but I want to find someone who can repair the plugin.
Be that as it may, the MTU parameter is not imported, but it should be. Maybe some other ones are not imported, but I don’t know about that yet.)))

Why?

  • You setup IPv6 NAT on the WG interface?
  • You have native IPv6?
  • Your config should guess if you have PPPoE, cellular, etc. - hence somehow knowing the MTU is correct? :wink:

Just to be clear, what plugin are you referring to - I assume you mean the code on the LuCI web GUI to import a WG config, correct?

The Wiki says the package is maintained by the LuCI developers. See:

Feel free to file an issue: https://github.com/openwrt/luci/issues

Everything is correct since by directly editing the file this can be done without any Luci interface.