Wireguard - Accessing the LAN behind Wireguard server

Larg0 · March 8, 2020, 3:02pm

Hello everyone!
My desired setup is pretty straightforward. I have one router/access point with OpenWRT installed in my home. I want to be able to access this router and LAN network behind it.

I followed install and setup guide here -> https://openwrt.org/docs/guide-user/services/vpn/wireguard/start and managed to configure 2 peers to be able to connect to the router via WG (laptop and android mobile). This is cool and all but now I want to access the LAN behind this router (several hosts). I followed another guide -> https://www.ericlight.com/wireguard-part-two-vpn-routing.html to setup access to LAN behind WG peer.
Thing is, I have the same configuration for peers connecting to WG router (except of course different peer IP's) but I'm able to access LAN only from one of them (my android mobile WG peer). I compared route configs on both of them and they are the same.
What can be the issue here?

(Please let me know what configs to paste in. Thanks!)

psherman · March 8, 2020, 4:43pm

Please post the following files
/etc/config/network (redact your wg keys and any public IP address, but don’t change anything else)
/etc/config/firewall

Larg0 · March 8, 2020, 6:23pm

Thanks for replying! Here are the files:

network:

config globals 'globals'

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config device 'lan_dev'
	option name 'eth0.1'
	option macaddr '2c:30:33:34:15:d8'

config interface 'wan'
	option ifname 'eth0.2'
	option proto 'dhcp'

config device 'wan_dev'
	option name 'eth0.2'
	option macaddr '2c:30:33:34:15:d9'

config interface 'wan6'
	option ifname 'eth0.2'
	option proto 'dhcpv6'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0 1 2 3 6t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '4 6t'

config interface 'Wireguard'
	option proto 'wireguard'
	option private_key '<private'
	option listen_port '55055'
	list addresses '10.9.0.1/24'

config wireguard_Wireguard
	option route_allowed_ips '1'
	option persistent_keepalive '25'
	option public_key '<private>'
	list allowed_ips '10.9.0.2/32'

config wireguard_Wireguard
	option public_key '<private>'
	list allowed_ips '10.9.0.3/32'
	option route_allowed_ips '1'
	option persistent_keepalive '25'

firewall:

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        option network 'wan wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'
config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config include
        option path '/etc/firewall.user'

config rule
        option src 'wan'
        option target 'ACCEPT'
        option proto 'udp'
        option dest_port '55055'
        option name 'Wireguard'

config zone
        option name 'wg'
        option input 'ACCEPT'
        option forward 'ACCEPT'
        option output 'ACCEPT'
        option masq '1'
        option network 'wg0 Wireguard'

config forwarding
        option src 'wg'
        option dest 'wan'

config forwarding
        option src 'wan'
        option dest 'wg'

config forwarding
        option src 'wg'
        option dest 'lan'

config forwarding
        option src 'lan'
        option dest 'wg'

psherman · March 8, 2020, 6:32pm

config zone
        option name 'wg'
        option input 'ACCEPT'
        option forward 'ACCEPT'
        option output 'ACCEPT'
        option masq '1'
        option network 'wg0 Wireguard'

remove option masq '1' and from the zone section, remove wg0 (since that is not actually the name of any of your interfaces).

Larg0 · March 8, 2020, 7:00pm

Changed as you suggested and restarted firewall. Issue unfortunately still remains. I can only connect to OpenWRT router. Nothing beyond that. I'm attaching my laptop WG config which I'm using to establish tunnel:

Address = 10.9.0.2/24, 192.168.1.1/24
PrivateKey = <private>
DNS = 10.9.0.1

[Peer]
PublicKey = <private>
# PresharedKey = PRE-SHARED_KEY
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = <router public ip>:55055

psherman · March 8, 2020, 7:08pm

change 10.9.0.2/24 to 10.9.0.2/32 and remove 192.168.1.1/24 entirely

Change this to 192.168.1.1

remove the IPv6 IPs (::/0)

Also, how are you testing this? Is it from inside your network or are you testing from a remote location and/or over cellular? You should really test this from outside the network because of the way the routing works.

Larg0 · March 8, 2020, 7:20pm

Also, how are you testing this? Is it from inside your network or are you testing from a remote location and/or over cellular? You should really test this from outside the network because of the way the routing works.

Yeah, I'm using the cellular network to test this right now as I'm at home

Also I think those changes fixed my issue! I can connect to hosts in LAN. Thank you very much!

psherman · March 8, 2020, 7:21pm

Glad it worked!

system · March 18, 2020, 7:21pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.