Wireguard, handshakes works but traffic not tunneled

Installing and Using OpenWrt Network and Wireless Configuration
21

I tried using the config of a working peer (of course disconnecting it first), to eliminate any issue on the server side, and it still behaves the same, connected to the tunnel, can reach the server router config page with 10.4.0.1, handshakes stable and successful, but still no traffic routed to the tunnel.

I can connect to the tunnel other devices using data from the ISP router of where the OpenWRT router is, so no port issues.

I think I eliminated any possibility of issues on the ISP router where OpenWRT is, and on the server side, this means that the issue in only in the OpenWRT configuration, it should probably be something in the routing or firewall settings.

This is still driving me crazy, any help or hint still appreciated.

22

From here, remove the lines listen_port peerdns and metric.

Use route_allowed_ips here instead of installing routes separately. This should add 3 routes to the main routing table:
0.0.0.0/1 via wg0 (this and the next one routes the whole Internet with a higher priority than the 0.0.0.0/0 route)
128.0.0.0/1 via wg0
PEER_IP/32 via wan (the "hole punch" so encrypted packets have a way out via the local ISP)

Check that the routes are set up after Wireguard starts.
If you want a "kill switch" so that the LAN has no Internet access unless the VPN is working, remove the lan->wan forward in the firewall so there is only lan->vpn.

23

Added, but what really solved the problem was checking force link in the wireguard interface.

Now I am trying to reach out to the configuration page of the router from the tunnel, so I added to NAT rules:

Protocol any
Outbound zone LAN
Source address 192.168.4.0 (wg server network)
Destination address 192.168.10.1 (wan of openWRT)
Action masquerade

But it doesn't work, any help here?

I am doing this because on ddwrt on another router connected to the same tunnel, the way to achieve it is by using this route in the firewall commands

iptables -t nat -I POSTROUTING -s 192.168.4.0/24 -o $(get_wanface) -j MASQUERADE

24

This should not be required.

Let’s see the latest config files (network and firewall) from the openwrt side.

25

This is how you would log into the server remotely. You could also use any other IP that is held by the server and has a firewall zone that allows input to port 80.

26

Hi Peter, not sure I've been clear in the explanation.
While connecting to the tunnel with my mobile
I can browse to 192.168.4.1 to see the router (ddwrt) where the server is hosted
I can browse to 192.168.2.1 to see the router (ddwrt) that is a peer
But I can't browse to 192.168.10.1 to see the router (openwrt) that is a peer

to allow the second case, 192.168.2.1, I had to add
SERVER SIDE
iptables -t nat -I POSTROUTING -s 192.168.2.0/24 -o $(get_wanface) -j MASQUERADE
PEER SIDE
iptables -t nat -I POSTROUTING -s 192.168.4.0/24 -o $(get_wanface) -j MASQUERADE

So now since I want to achieve the same on openWRT (WAN 192.168.10.1) I Added
SERVER SIDE
iptables -t nat -I POSTROUTING -s 192.168.10.0/24 -o $(get_wanface) -j MASQUERADE
and if OpenWRT would run DDWRT I would add again
iptables -t nat -I POSTROUTING -s 192.168.4.0/24 -o $(get_wanface) -j MASQUERADE

but this is not a DDWRT router so I am looking to do the same here.

In any case, this is the config

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdfe:433a:3cb6::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'
        option ipv6 '0'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.10.1'
        option force_link '0'
        list dns '192.168.3.1'

config interface 'wan'
        option device 'eth1'
        option proto 'dhcp'

config interface 'wan6'
        option device 'eth1'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '1 2 3 4 0'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '5 0'

config interface 'wwan'
        option proto 'dhcp'
        option peerdns '0'
        list dns '1.1.1.1'

config interface 'wg0'
        option proto 'wireguard'
        option listen_port '51820'
        option private_key REDACTED
        list addresses '10.4.0.10/24'
        option force_link '1'
        option peerdns '0'
        list dns '192.168.3.1'
        option mtu '1200'

config wireguard_wg0
        option description 'Imported peer configuration'
        option public_key REDACTED
        list allowed_ips '0.0.0.0/0'
        option persistent_keepalive '25'
        option endpoint_host REDACTED
        option endpoint_port '51820'
        option route_allowed_ips '1'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'
        list network 'wwan'
        option masq '1'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'vpn'
        option output 'ACCEPT'
        option masq '1'
        option mtu_fix '1'
        option input 'REJECT'
        option forward 'REJECT'
        list network 'wg0'

config forwarding
        option src 'lan'
        option dest 'vpn'

THIS IS WHAT I ADDED AND DOESNT WORK
config nat
        option name 'ForwardToWRT'
        option src_ip '192.168.4.0'
        option dest_ip '192.168.10.1'
        option target 'MASQUERADE'
        list proto 'all'
        option src 'lan'
27

Generally you would use the tunnel endpoint IPs to log into the other Wireguard clients. To route into a remote's LAN IP range you need that route installed on the wg server router, which is a dd-wrt issue.

Using masquerade changes the source IP so that a route back to that source is not needed on the far end. But this makes the process one-way.

1 Like
28

I can't reach out to the router config page even with the tunnel IP. I'm not sure what's wrong here honestly.