[solved] Wireguard config for noobies

Easy enough to test. Use tcpdump to sniff traffic on all of your router's interfaces in turn, including the WireGuard interface, and observe the flow of the traffic.

DNS lookups happen on port 53. You can also see traffic on other ports, e.g. 80 (HTTP) and 443 (HTTPS). You can see the origin and destination addresses and work out whether or not your traffic is using the VPN.

root@OpenWrt:~# tcpdump -ni wg0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wg0, link-type RAW (Raw IP), capture size 262144 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel
root@OpenWrt:~# tcpdump -ni wg0 host 192.168.1.80
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wg0, link-type RAW (Raw IP), capture size 262144 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel

but still the phone can browse all the time, so i screwed it up somehow somewhere, the phone is actually connected to my home wifi, not the cellphone provider network, does that do any difference? also it was unable to browse anything when i turned off the wireguard phone app interface...in the meantime im going to remove everything wg related and test again tomorrow since i need to leave in a few minutes...

If the phone and router are on the same network, then WireGuard (or any VPN, really) is pointless. Unless you're in a super-secure corporate or government location, a LAN-based VPN is rather, um, extreme.

However, you can still test it, and verify if you've configured it correctly, by telling your phone to connect to your router's LAN interface instead of the WAN interface. By default WireGuard listens on all interfaces. Make sure your router's firewall is configured with appropriate rules to allow traffic flow between the LAN and WireGuard zones.

Yea i know that, my idea is to set up wireguard to access my tvshows/music on my samba share on my nas when im travelling, afaik its a VERY bad idea to expose anything samba on internet...but ofc when setting something you want to test it before actually using it...ill do more tests tomorrow

Unless you have a crippling data plan from your provider, just turn off WiFi on your phone and test it as if you're travelling. Then you can test it - and troubleshoot it - with live configuration details instead of having to do a "proof of concept" whose details will only change anyway.

So im getting to this again since i can reboot the router as many times i want atm and i decided to start from scratch and keep it simple and add extras later testing every step, doing this addition to the network file

and restarting im able to connect, i still dont see any RX/TX neither on luci or on ifconfig but ill keep that on hold for now since im getting traffic correctly, cant test actually the connection from outside (and yea, cellphone provider is mega restricting in this shitty country, BUT i get wifi on the metro/train so i was planing to use that with wireguard, you get the idea) but i was wondering, other guides also suggest to create a firewall zone, and a different guide i see here tells to simply add the wg interface to the lan zone, for my use case seems the easier solution but it is needed at all? also, since wireguard is on the router itself, do i also need to open a port for the service to work or it can handle the port opening itself being in the same device? thanks in advance for any help :smiley:

Your choices for firewall zones will depend on your use case. In my use case I specifically put the VPN in a separate zone and use the firewall to govern which traffic I'm willing to permit. Decide what you want to allow, then base your configuration on that choice.

As for allowing the connection from the outside, the default OpenWRT configuration will block unsolicited connections from the WAN. If you haven't changed that, then you'll need to allow an inbound connection on the WireGuard port. If you're configuring with LuCI, if you omit the destination zone then it will default to the destination being the router. If you're configuring on the command line, omit the "option dest" directive.

Setting it as part of the lan zone i can set any rule on that lan zone and will also apply to wireguard im guessing, right? this is a home network so usually i try to keep things simple so placing wireguard on the lan zone is enough for me, after all if the device allready have the keys its because i trusted the decive when copying the key myself...
So, for my use im gonna place wireguard on the lan zone and also open the port and report later today or tomorrow about the tx/rx weird thing (wich its probably related to the fact that im testing it from inside the network and maybe there are some forwarding rule acting before wireguard)

So i was still being unable to get rx/tx and also i was unable to actually connect from outside (so it wasnt actually using the wg interface apparently, luckily from outside i wasnt getting any packet thru so apparently security wasnt compromised) and i wasnt sure why, i was using the @iplaywithtoys first super simple setup and didnt work until i set the /32 on both ip addresses (i also set "0.0.0.0/0, ::/0" on the android client on the peer section for allowed ips), i now i have what seems a working setup (with rx/tx and all) BUT i may have a small problem in the future, my wan ipv4 is probably not fixed and i have a ddns client set on my router and its working fine, if i access the address it goes to my ip and all but if i use that address on the android client endpoint field i get no traffic at all, i know that this is totally NOT RELATED to openwrt but maybe someone can give me some tips of what to do in this situation, as example i was thinking, usually ISPs give static ipv6 nowadays? if i understand correctly the information provided by the router i get an ipv6 PD of /64, assuming my ipv6 is static (not sure yet if its an industry standard, if i understand ipv6 correctly my isp needs to be super cheap and shitty not to give me a static PD to the point of making his own job more complex just because) i can set the router with the external ipv6:port and my problem is solved?

If you're worried about your IPv4 address changing, then a dynamic DNS provider might be useful.

As for IPv6, I haven't yet played with WireGuard and IPv6 so can't offer specific advice there.

Yea, i actually have a dyndns with dynu, i have it set to update on the same router and all, but when i use the dyn adress instead of the ip on the endpoint field on the phone the problem is that it dont work and i dont know why, the ip adress works fine...(and again, i totally know its some issue with the android client and totally NOT RELATED to openwrt, maybe someone had the same problem and could help)

Are you testing this hostname from inside your network, or outside?

You have to test the hostname from outside of your network, likely.

Hello, I have a SonyExperia...with Android (ihate it) ..next time IOS...but the Wireguard client here is woking perfect for me (Android CLient), beeing connected over WLAN or beeing not at home and connect via dyndns adress to homebase =D
...no problem here .....I know, this wont help..but maybe check your config again...

1 Like

So i finally decided to spend some extra to use 4g for a few hours and after testing several things i enabled "option route_allowed_ips '1'" on my peer (on the router network file) and now i can connect with the dyn address, but im wondering, on some other forum someone answered that its a bad idea to use that option in general, is it dangerous or bad in the sense that it can "break" my network or cause route loops or stuff like that?

I use for external access port 500 (but of course you can use what you want, 500 is just good, as its the normal IPSEC port and is rarly blocked by firewalls in companys) and only did a forward to the wg internface, as wireguard is not chatty...it replys only if the keys and IP of client is correct, otherwise it drops incomming packets ..what is a very cool feature... after forward rule set, all worked out of the box ...proofed to be stable of many many hours.. asap my phone comes in with its wireguard keys and ip is correct set...no problem here, if you have security concerns, make a quick check of your firewall https://www.grc.com/intro.htm good Luck!

Route allowed IPs ...... caused me no problem..if you refer to the option in the WG internface in Luci where you setup the clients, keys, subnet etc...I think its necessary, for the Internet is reachable ....to your WG clients....if Im wrong, pelase someone correct me

1 Like

Picture of my setup, hope it can help you, it works since weeks great:

37

1 Like

YES YES!!! THIS IS WHAT I ACTUALLY NEEDED, AN EXAMPLE OF AN ACTUALLY WORKING SETUP!! MY MAN TYVVVVM!!! now it works, i have internet, access to internal hosts, access to the router interface itself, all actually going thru the tunnel since i see TX/RX and the load on the router actually goes heavily up and all, im going to take note of this settings for future reference too since its working, networking is kinda not my thing so i totally appreciate your help, if you ever travel to argentina i owe you a pizza (or empanadas if you like) and a pair of beers!! TYVVVM :smiley:

1 Like

Thank you, glad I could help a little bit, my teacher was leachii LOL and reading and trying, I must say, I had some stuggles too in the beginning, but wireguard is so cool, also my Macs are using wireguard with Wireguard from MacPorts.org, and mobile Macs and Phones too, also roaming works, if I switch off my Phone, and asap I swicth it on, it reconnects automaticly to the wg interface, I love Wireguard!!! it was all worth the hassle, Happy evening & Cheers

1 Like

No té preocupes amigo...que tengas una buena semana y adelante :wink: Saludos a Argentina, desde Berlin, Alemania