Wireguard doesn't work after reboot until firewall reloaded

tmarschner · February 22, 2025, 12:19am

Hi there,

I have a Wireguard tunnel set up between a pfSense box and an OpenWRT router. Both ends are configued to authorize their peer's respective lan networks and the tunnel subnet. Both ends use DDNS and I am using the wireguard_watchdog and a pfSense equivalent to keep the remote ip addresses fresh. I've added the wireguard interface to the lan zone on the openwrt router. Everything works great at this point. I can ping lan hosts on both ends over the tunnel. Things go south however afer a reboot of the OpenWRT router. I can't ping any host on the OpenWRT LAN except for the tunnel interface and the router lan interface. Only if I restart/reload the firewall can I get the tunnel working again. If instead of putting the wireguard interface in the lan zone I add the wireguard device to the "covered devices" option for the lan zone can I get this to work, meaning that the tunnel comes back completely after a reboot. I can ping any lan host from either end.

I've not come across this issue in any of my online searching. I do have this workaround but I am wondering if I have something else misconfigured that is causing this problem.

Thanks for any insight you can provide.

Tom

psherman · February 22, 2025, 7:11am

Let's take a look at your config to see if we can spot the issue.

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

tmarschner · February 22, 2025, 5:34pm

Hi psherman,

Thanks for the reply. Here is the config for a non-working setup where after an OpenWRT reboot I can't ping OpenWRT lan hosts from the far side of the tunnel. In this config the wireguard interface has been added to the lan zone.

I've also included at the end screenshots of a portion of the gui firewall status immediately after a reboot and another taken after the firewall was reloaded. Note that the wgvpn device is initially missing as an ingress device but shows up after the firewall has been reloaded.

Cheers,
Tom

root@OpenWrt:~# ubus call system board
{
        "kernel": "5.10.176",
        "hostname": "OpenWrt",
        "system": "Qualcomm Atheros QCA956X ver 1 rev 0",
        "model": "TP-Link Archer A7 v5",
        "board_name": "tplink,archer-a7-v5",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "22.03.5",
                "revision": "r20134-5f15225c1e",
                "target": "ath79/generic",
                "description": "OpenWrt 22.03.5 r20134-5f15225c1e"
        }
}

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix '*:*:*::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '172.31.0.1'

config device
        option name 'eth0.2'
        option macaddr '*:*:*:*:*:*'

config interface 'wan'
        option device 'eth0.2'
        option proto 'dhcp'
        option broadcast '1'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option vid '1'
        option ports '0t 2 3 4 5'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '0t 1'
        option vid '2'

config interface 'wgvpn'
        option proto 'wireguard'
        option private_key '*****'
        option listen_port '51820'
        list addresses '10.8.6.2/24'
        option auto '0'

config wireguard_wgvpn
        option description 'S'
        option public_key '*****'
        option preshared_key '******'
        list allowed_ips '10.8.6.0/24'
        list allowed_ips '10.100.1.0/24'
        option route_allowed_ips '1'
        option endpoint_host '*.*.com'
        option endpoint_port '51821'
        option persistent_keepalive '25'

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'pci0000:00/0000:00:00.0'
        option band '5g'
        option htmode 'VHT80'
        option channel 'auto'
        option country 'US'
        option cell_density '0'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/ahb/18100000.wmac'
        option band '2g'
        option htmode 'HT20'
        option channel 'auto'
        option cell_density '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option encryption 'psk2'
        option key '********'
        option ssid '*******'

config wifi-iface 'wifinet3'
        option device 'radio0'
        option mode 'ap'
        option network 'lan'
        option encryption 'psk2'
        option key '*******'
        option ssid '*******'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        list dhcp_option '6,8.8.8.8,1.1.1.1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list device 'tun+'
        list network 'lan'
        list network 'wgvpn'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Allow-OpenVPN'
        list proto 'udp'
        option src 'wan'
        option dest_port '1194'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-WG'
        list proto 'udp'
        option src 'wan'
        option dest_port '51820'
        option target 'ACCEPT'
        option family 'ipv4'

Input chain immediately after reboot:

Input chain after firewall reload:

[As a new user I am unable to embed other image so I will describe the change.]

After a firewall reload the line

#Ingress device name is br-lan

becomes

#Ingress device name in set { br-lan, wgvpn }

psherman · February 22, 2025, 5:38pm

What is happening with the OpenVPN interface? Is that active? It appears that you're running a server, which should be fine, but might there be a conflict here somewhere?

egc · February 22, 2025, 7:56pm

tmarschner:

config interface 'wgvpn'
        option proto 'wireguard'
        option private_key '*****'
        option listen_port '51820'
        list addresses '10.8.6.2/24'
        option auto '0'

Remove option auto '0'

tmarschner · February 22, 2025, 11:49pm

I disabled the OpenVPN server and the problem remains. I was using an ntp hotplug to start the interface (via ubus) but this also didn't help so I reverted back to startup on boot. Should an "ifup" event be generated when the wireguard tunnel comes up? I don't see anything in the logs.