Wireguard client issues

Installing and Using OpenWrt
1

I’ve been having trouble setting up a Wireguard client and I appreciate your help.

I have OpenWrt 24.10.0 running on a Raspberry Pi 4B, but I tried the same setup back on 23.05 with similar results.

I’ve tried Proton and Mullvad also with the same results.

Some results:
Peer handshakes, but that’s al.
Cannot ping 1.1.1.1 in clients.
In the router:
ping 1.1.1.1 succeeds
ping openwrt.org fails
ping -I eth0 1.1.1.1 (lan) fails
ping -I eth1 1.1.1.1 (wan) succeeds
ping -I wg0 1.1.1.1 (vpn) succeeds

Here are my config files:

/etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.10.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ipv6 '0'
	option delegate '0'

config interface 'WAN'
	option proto 'dhcp'
	option device 'eth1'
	option peerdns '0'
	list dns '10.64.0.1'
	option ipv6 '0'

config interface 'wg0'
	option proto 'wireguard'
	option private_key '******redacted******'
	list addresses '10.72.253.26/32'
	list dns '10.64.0.1'

config wireguard_wg0
	option description 'Imported peer configuration'
	option public_key '8c9M6w1BQbgMVr/Zgrj4GwSdU6q3qfQfWs17kMLC9y4='
	list allowed_ips '0.0.0.0/0'
	option endpoint_host '169.150.198.66'
	option endpoint_port '51820'

/etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

/etc/config/firewall

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'
	list network 'WAN'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'vpn'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wg0'

config forwarding
	option src 'lan'
	option dest 'vpn'

I also tried
list allowed_ips '192.168.10.1/0'

Thanks in advance

2

The problem is almost certainly dns related. Add a public resolver to your dnsmasq config.

3

Added
list server '1.1.1.1'
And
list server '10.64.0.1'
(one at a time) to
config dnsmasq
Did I understand right your suggestion?
Anyhow it changed nothing.

I wasn't leaning into thinking it's a DNS problem myself because I can't even ping IPs in clients.
The weirdest part was ping 1.1.1.1 succeeding in the router.

Any other tests that I can try?

4

Additional info:
It looks like the VPN isn't even handshaking unless I do ping -I wg0 1.1.1.1

5

Somehow I missed "Route Allowed IPs" in the peer config. Enabling it did the trick.
Maybe it's not as optional as LuCi seems to think.

6

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.