Wireguard and clients internet access

Installing and Using OpenWrt Network and Wireless Configuration
1

Hello openwrt network experts.

I have a router connected to ISP with openwrt installed, and configured wireguard. Each client connects to the router without any problems and can ping each other. The problem is that a client connected to the openwrt router cannot get to the internet via wg interface.

Here is the configuration information:

/etc/config/network 
root@OpenWrt:~# cat /etc/config/network 

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdfc:7211:ab09::/48'

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ipaddr '192.168.10.17'
	option igmp_snooping '1'

config interface 'wan'
	option ifname 'eth0.2'
	option proto 'dhcp'

config device 'wan_eth0_2_dev'
	option name 'eth0.2'
	option macaddr '10:fe:ed:94:22:eb'

config interface 'wan6'
	option ifname 'eth0.2'
	option proto 'dhcpv6'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '2 3 4 5 0t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '1 0t'

config interface 'wgh'
	option proto 'wireguard'
	option private_key '<private>'
	option listen_port '13666'
	list addresses '10.1.1.1/24'
	list addresses 'fdf1:7610:d152:3a9c::1/64'

config wireguard_wgh
	option public_key '<private>'
	option description 'sophi'
	option route_allowed_ips '1'
	option persistent_keepalive '25'
	list allowed_ips '10.1.1.4/32'

config wireguard_wgh
	option public_key '<private>'
	option description 'ann'
	option route_allowed_ips '1'
	option persistent_keepalive '25'
	list allowed_ips '10.1.1.2/32'

config wireguard_wgh
	option public_key '<private>'
	option description 'black horse'
	list allowed_ips '10.1.1.3/32'
	option route_allowed_ips '1'
	option persistent_keepalive '25'

config wireguard_wgh
	option public_key '<private>'
	option description 'kyler'
	option persistent_keepalive '25'
	list allowed_ips '10.1.1.5/32'
	option preshared_key '<private>'
	option route_allowed_ips '1'

config wireguard_wgh
	option public_key '<private>'
	option description 'sophi_test'
	option persistent_keepalive '25'
	list allowed_ips '10.1.1.6/32'

root@OpenWrt:~#
/etc/config/firewall 
root@OpenWrt:~# cat /etc/config/firewall 

config defaults
	option syn_flood '1'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone 'lan'
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option network 'lan wgh'
	option masq '1'

config zone 'wan'
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option mtu_fix '1'
	option network 'wan wan6'
	option forward 'REJECT'

config forwarding 'lan_wan'
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.user'

config rule 'wg'
	option name 'Allow-WireGuard'
	option src 'wan'
	option dest_port '<custom port>'
	option proto 'udp'
	option target 'ACCEPT'

root@OpenWrt:~#
OpenWRT router: wg show 
root@OpenWrt:~# wg show
interface: wgh
  public key: <private>
  private key: (hidden)
  listening port: <custom port>

peer: <private>
  endpoint: <IP:PORT>
  allowed ips: 10.1.1.6/32
  latest handshake: 11 seconds ago
  transfer: 1.01 MiB received, 4.35 MiB sent
  persistent keepalive: every 25 seconds

peer: <private>
  endpoint: <IP:PORT>
  allowed ips: 10.1.1.2/32
  latest handshake: 1 minute, 33 seconds ago
  transfer: 32.28 KiB received, 112.80 KiB sent
  persistent keepalive: every 25 seconds

peer: <private>
  endpoint: <IP:PORT>
  allowed ips: 10.1.1.4/32
  latest handshake: 11 hours, 13 minutes, 24 seconds ago
  transfer: 277.88 KiB received, 1.60 MiB sent
  persistent keepalive: every 25 seconds

peer: <private>
  preshared key: (hidden)
  allowed ips: 10.1.1.5/32
  persistent keepalive: every 25 seconds

peer: <private>
  allowed ips: 10.1.1.3/32
  persistent keepalive: every 25 seconds
root@OpenWrt:~#
OpenWRT router: wg showconf wgh 
root@OpenWrt:~# wg showconf wgh
[Interface]
ListenPort = <custom port>
PrivateKey = <private>

[Peer]
PublicKey = <private>
AllowedIPs = 10.1.1.4/32
Endpoint = <IP:PORT>
PersistentKeepalive = 25

[Peer]
PublicKey = <private>
AllowedIPs = 10.1.1.2/32
Endpoint = <IP:PORT>
PersistentKeepalive = 25

[Peer]
PublicKey = <private>
AllowedIPs = 10.1.1.3/32
PersistentKeepalive = 25

[Peer]
PublicKey = <private>
PresharedKey = <private>
AllowedIPs = 10.1.1.5/32
PersistentKeepalive = 25

[Peer]
PublicKey = <private>
AllowedIPs = 10.1.1.6/32
Endpoint = <IP:PORT>
PersistentKeepalive = 25
root@OpenWrt:~#

One of the client configuration:

WG client sophi 
sophi ~ # cat /etc/wireguard/wg1h.conf 
[Interface]
PrivateKey = <private>
Address = 10.1.1.6/24
DNS = 1.1.1.1

[Peer]
PublicKey = <private>
# AllowedIPs = 0.0.0.0/0 # <--- THIS DOES NOT WORK: unable to up interface
AllowedIPs = 10.1.1.0/24
Endpoint = <WG SERVER IP:PORT>
PersistentKeepalive = 30
sophi ~ #
ping statistics from sophi client 
ping -c3 -I wg1h 10.1.1.1
PING 10.1.1.1 (10.1.1.1) from 10.1.1.6 wg1h: 56(84) bytes of data.
64 bytes from 10.1.1.1: icmp_seq=1 ttl=64 time=13.5 ms
64 bytes from 10.1.1.1: icmp_seq=2 ttl=64 time=22.7 ms
64 bytes from 10.1.1.1: icmp_seq=3 ttl=64 time=13.2 ms

--- 10.1.1.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 13.241/16.491/22.711/4.399 ms

sophi ~ # ping -c3 -I wg1h 8.8.8.8
PING 8.8.8.8 (8.8.8.8) from 10.1.1.6 wg1h: 56(84) bytes of data.

--- 8.8.8.8 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2082ms

sophi ~ #

Is is possible to get the internet access from the client WG interface?
Thank you in advance.

2

You removed masquerade from wan firewall zone and added it in lan zone. That is not correct, and as a result not even the local connected lan hosts won't work. Remove masquerade from lan and add it back to wan.
Also please use the "Preformatted text </>" button for logs, scripts, configs and general console output.
grafik
Please edit your post accordingly. Thank you! :slight_smile:

3

Thanks for the reply.

I have just set masquerading to the wan zone and remove it from the lan zone via web UI, but it did not help, unfortunately.

foo
foo976×334 23.8 KB 

sophi ~ # ping -c3 -I wg1h 8.8.8.8
PING 8.8.8.8 (8.8.8.8) from 10.1.1.6 wg1h: 56(84) bytes of data.

--- 8.8.8.8 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2062ms

sophi ~ # wg
interface: wg1h
  public key: <private>
  private key: (hidden)
  listening port: 39673

peer: <private>
  endpoint: <private>
  allowed ips: 10.1.1.0/24
  latest handshake: 1 minute, 14 seconds ago
  transfer: 604.24 KiB received, 129.19 KiB sent
  persistent keepalive: every 30 seconds
sophi ~ #
4

You'll need to allow 0.0.0.0/0

5

Thanks.
I needed to compile kernel modules for nftables and nftables itself to enable wireguard with 0.0.0.0/0.
Now it works!

1 Like
6

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.