Wireguard Handshake did not complete - 22.03.1

Quick_Parsley_6482 · October 21, 2022, 3:36am

First time user of OpenWRT, just got myself a Linksys E8450 wifi6 router and I am loving OpenWRT.

Thank you for creating this, I will never go back to using a regular router again!

I am trying to setup a wireguard Server on my OpenWRT router and connect my mobile devices to it when away from home. My head is spinning trying to get this working.

My configs so far on OpenWRT (server) and iphone (client):
Openwrt interface:

Openwrt Peer:

iphone (client) config:

OpenWRT firewall (please note i have also added the openwrt interface to the LAN zone):

Im not sure what i am doing wrong here..
Please help

psherman · October 21, 2022, 4:05am

There are a bunch of possible issues here.

It is best if you post your config files (directions below), but I'll try to address a few of the issues I can see right away;

Openwrt > Wireguard Interface definition, you should specify the listen port (51820 is the default).
OpenWrt > Wireguard > Peer config, your allowed IPs should be 10.16.8.2/32 and the endpoint port should be left blank.
iPhone > Wireguard > Interface port should be blank
iPhone > Wireguard > Interface Addresses should be 10.16.8.2/32
iPhone > Wireguard > Peer allowed IPs should be 0.0.0.0/0 (if you want to send all traffic from your phone through your tunnel)
iPhone > Wireguard > Interface > DNS Servers should be set to your router's primary address or a public DNS such as 8.8.8.8 or another service of your preference.

After making the changes, restart your router and then try again. If it doesn't fix the problem, please post the following files:

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/network
cat /etc/config/firewall

Quick_Parsley_6482 · October 21, 2022, 5:16am

see below (my question is related to interface wg0)

# cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdbd:9acb:c524::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	list dns '1.1.1.1'
	list dns '9.9.9.9'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'
	option peerdns '0'
	list dns '1.1.1.1'
	list dns '9.9.9.9'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

config device
	option name 'wan'

config interface 'windsribe_VPN'
	option proto 'wireguard'
	option private_key '<redacted>
	list addresses '<redacted>'

config wireguard_windsribe_VPN
	option description 'NYC_GrandCentral_10g'
	option public_key '<redacted>'
	option preshared_key '<redacted>'
	list allowed_ips '0.0.0.0/0'
	option route_allowed_ips '1'
	option endpoint_host 'jfk-384-wg.whiskergalaxy.com'
	option endpoint_port '65142'
	option persistent_keepalive '25'

config interface 'wg0'
	option proto 'wireguard'
	list addresses '10.16.8.1/24'
	option private_key 'YMT7pU+RSqeEFEhdsm4wsjiZY8nxREi6phc4MBWfbU0='
	option delegate '0'

config wireguard_wg0
	option description 'Iphone'
	list allowed_ips '10.16.8.2/24'
	option route_allowed_ips '1'
	option persistent_keepalive '25'
	option preshared_key 'rRi4lq/p2B521GZGU2fhXunmdLRjpLiSxUWUIs3ne24='
	option endpoint_port '1234'
	option public_key '49MZv/VG94OCFnBWAk7kDFo0l1KbAtiRA+Js8+v4UQY='
	option private_key 'ELQKKW5hvE4IWwMxChckNxhfBZ7OnR6qmuMS/UFtR2I='

and

# cat /etc/config/firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'
	option flow_offloading '1'
	option flow_offloading_hw '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'
	list network 'wg0'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'https'
	list proto 'tcp'
	option src 'wan'
	option src_dport '443'
	option dest_ip '192.168.1.4'
	option dest_port '443'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'http'
	list proto 'tcp'
	option src 'wan'
	option src_dport '80'
	option dest_ip '192.168.1.4'
	option dest_port '80'


config zone
	option name 'wsvpn_fw'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'windsribe_VPN'

config forwarding
	option src 'lan'
	option dest 'wsvpn_fw'

config rule
	option name 'Allow-Wireguard-Inbound'
	list proto 'udp'
	option dest_port '51820'
	option target 'ACCEPT'
	option src '*'

psherman · October 21, 2022, 5:24am

It doesn't look like you implemented any of my recommended changes.

In addition to those changes, you have a 'client' VPN configuration... this will likely prevent your 'server' from working. Disable the windsribe_VPN interface in order to test if this is working. If you plan to use both VPNs simultaneously, you will need to use Policy Based Routing to accommodate.

Also, you have apparently not redacted your keys for your wg0 interface and even the iPhone peer. Therefore, you should delete those keys and create fresh key pairs so that you can remain secure.

I don't see any questions... just the configs (thank you for posting, that makes it much easier to see than screen grabs).

Quick_Parsley_6482 · October 21, 2022, 5:33am

Thank you for your quick response, I just applied to changes you suggested and it seems to still fail.

I will test out disabling the VPN to see if your suggestions are fixed it.

However, I do want to have the client VPN enabled, can you give me an pointers/reference materials on how i can have both running at the same time (i.e. send all wg0 and lan traffic thru my windscribe_vpn interface)? would the Policy Based Routing be used to treat wg0 traffic differently?

Also noted on the keys, I will be refreshing those.

psherman · October 21, 2022, 5:36am

Not unexpected since you have the other VPN connection running.

Let me know what happens.

Here is policy based routing:

And you can find a lot of practical info on this by searching the forums.

Good deal!

Quick_Parsley_6482 · October 25, 2022, 1:57am

So i was able to get the handshake to work (disabled the other windscribe interface), however I cannot access the internet or other LAN devices. I know that DNS is sending the requests to my adgaurd (as i see the queries show up on there). I added the wg0 interface to the LAN firewall zone.

psherman · October 25, 2022, 2:08am

put the Wireguard network into its own firewall zone (edit: don't forget to remove it from the lan zone). It can be accept for all (input, output, forward). Turn on masquerading. Enable forwarding from the lan zone to the wg zone and from the wg zone > lan zone.

Quick_Parsley_6482 · October 25, 2022, 2:30am

Tried this and and didnt work:

See below firewall - I setup "wg0_fw" zone and did accept for all (in, out and forward), FROM source is LAN and TO source is WAN and LAN (i tried it with just LAN and it didnt work either)

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'
	option flow_offloading '1'
	option flow_offloading_hw '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wg0_fw'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'wg0'
	option masq '1'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'https'
	list proto 'tcp'
	option src 'wan'
	option src_dport '443'
	option dest_ip '192.168.1.4'
	option dest_port '443'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'http'
	list proto 'tcp'
	option src 'wan'
	option src_dport '80'
	option dest_ip '192.168.1.4'
	option dest_port '80'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'sftp'
	option src 'wan'
	option src_dport '222'
	option dest_ip '192.168.1.4'
	option dest_port '222'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'postgres'
	option src 'wan'
	option src_dport '5432'
	option dest_ip '192.168.1.4'
	option dest_port '5432'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'Plex'
	option src 'wan'
	option src_dport '32400'
	option dest_ip '192.168.1.4'
	option dest_port '32400'

config rule
	option name 'Allow-Wireguard-Inbound'
	list proto 'udp'
	option target 'ACCEPT'
	option src 'wan'
	option dest_port '53510'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option src 'wan'
	option name 'wireguard'
	option dest_ip '192.168.1.1'
	option src_dport '53510'
	option dest_port '53510'

config forwarding
	option src 'lan'
	option dest 'wan'

config forwarding
	option src 'wg0_fw'
	option dest 'lan'

config forwarding
	option src 'lan'
	option dest 'wg0_fw'

config forwarding
    option src 'wg0_fw'
    option dest 'wan'

psherman · October 25, 2022, 2:34am

Remove this... it's not necessary since you have the Allow-Wireguard-Inbound rule.

Quick_Parsley_6482:

config redirect
	option dest 'lan'
	option target 'DNAT'
	option src 'wan'
	option name 'wireguard'
	option dest_ip '192.168.1.1'
	option src_dport '53510'
	option dest_port '53510'

Meanwhile, I apologize, I may have had my wires crossed... please confirm if this is the 'server' side or the 'client' peer side... that may be clear if you can share the complete network file as it stands now.

Quick_Parsley_6482 · October 25, 2022, 2:41am

Updated the firewall are suggested, please see below for the network:

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdbd:9acb:c524::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	list dns '1.1.1.1'
	list dns '9.9.9.9'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'
	option peerdns '0'
	list dns '192.168.1.1'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

config device
	option name 'wan'

config interface 'wg0'
	option proto 'wireguard'
	option private_key 'redacted'
	option listen_port '53510'
	list addresses '10.16.8.1/32'
	option peerdns '0'
	list dns '192.168.1.1'

config wireguard_wg0
	option description 'Phone'
	option preshared_key 'redacted'
	option public_key 'redacted'
	option private_key 'redacted'
	option persistent_keepalive '25'
	option route_allowed_ips '1'
	list allowed_ips '0.0.0.0/0'

mk24 · October 25, 2022, 2:43am

The first thing to consider for this project is whether you have a true public IP address on wan or if the ISP is using carrier grade NAT. Incoming connections are not possible with CGNAT.

The test is to run a whatsmyip check and see if the result is the same as the address shown for your WAN interface in the main status page or ip addr show

Quick_Parsley_6482 · October 25, 2022, 2:51am

Yes it is the same and I have duckdns setup as my endpoint to be able to connect. With the help of @psherman I was able to get the client to connect and even send my dns queries to my adguard, however, I am unable to open any website or access other devices on my LAN.

Quick_Parsley_6482 · October 25, 2022, 3:28am

@psherman I missed a setting. I had the openwrt >wireguard > peer > allowed ip as 0.0.0.0/0 instead of 10.16.8.2/32

Its working now, I can access lan and internet. such a silly thing to miss.

Thank you for your all your help! Saved me days of headache

Time to setup other peers! thank you again!

system · November 4, 2022, 3:29am

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.