Hi, I'm struggling to make this work:
Peer1 (ISP1's router has port forwarding configured for wireguard):
clients ↔ OpenWrt router with NAT ↔ ISP1 router with NAT ↔ Internet
192.168.17.0/24 ↔ 192.168.17.1 | 192.168.1.254 ↔ 192.168.1.1|DSL ↔ Internet
Peer2
RaspPi with WG ↔ ISP2 router with NAT ↔ Internet
192.168.2.2/24 ↔ 192.168.2.1/24|DSL ↔ Internet
I want clients to connect to internet through ISP2
clients ↔ OpenWrt ↔ [(10.10.10.1) wg tunnel (10.10.10.2)] ↔ RaspPi ↔ ISP2 router ↔ Internet
The scenario is similar to this one, but I want to use wireguard instead of openvpn.
With this configuration I get the tunnel up and I can ping both rpi and ISP2' router from openwrt.
But tracert 8.8.8.8 is routed through ISP1.
/etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix '<ula_prefix>'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0.1'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option ipaddr '192.168.17.1'
config device
option name 'eth0.2'
option macaddr '00:18:84:88:13:25'
config interface 'wan'
option device 'eth0.2'
option proto 'static'
option ipaddr '192.168.1.254'
option netmask '255.255.255.0'
option broadcast '192.168.1.255'
option gateway '192.168.1.1'
config interface 'wan6'
option device 'eth0.2'
option proto 'dhcpv6'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0 1 2 3 6t'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '4 6t'
config interface 'wg0'
option proto 'wireguard'
option private_key '<private_key>'
option listen_port '51820'
option force_link '1'
list addresses '10.10.10.1/24'
config wireguard_wg0
option description 'rpi'
option public_key '<public_key>'
option route_allowed_ips '1'
option persistent_keepalive '25'
list allowed_ips '10.10.10.2/32'
list allowed_ips '192.168.2.0/24'
If for the peer configuration in openwrt I change the above to this:
Allowed IPs: 0.0.0.0/0
Then I don't even get the handshake
config wireguard_wg0
option description 'rpi'
option public_key '<public_key>'
option route_allowed_ips '1'
option persistent_keepalive '25'
list allowed_ips '0.0.0.0/0'
but I guess I need 0.0.0.0/0 for the final end to end.
What am I doing wrong? Any help will be much appreciated.
/etc/config/firewall is the other file that I believe will be needed.
As you can see everything is enabled for now. lan -> wg is accepted, and masq is being used for wg:
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
config zone
option name 'wan'
option output 'ACCEPT'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
option input 'ACCEPT'
option forward 'ACCEPT'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config rule
option name 'Support-UDP-Traceroute'
option src 'wan'
option dest_port '33434:33689'
option proto 'udp'
option family 'ipv4'
option target 'REJECT'
option enabled 'false'
config include
option path '/etc/firewall.user'
config zone
option name 'wgzone'
option output 'ACCEPT'
list network 'wg0'
option input 'ACCEPT'
option forward 'ACCEPT'
option masq '1'
config forwarding
option src 'lan'
option dest 'wgzone'
The configuration for peer2 is as follows:
[Interface]
Address = 10.10.10.2/24
PrivateKey = <PrivateKey>
[Peer]
# openwrt
Endpoint = public.net:51820
AllowedIPs = 10.10.10.1/32, 192.168.17.0/24
PublicKey = <PublicKey>
PersistentKeepalive = 25
[Peer]
# different tunnel that works fine
Endpoint = public.net:51821
AllowedIPs = 10.10.10.3/32, 192.168.1.0/24
PublicKey = <PublicKey>
PersistentKeepalive = 25
