Hello,
I have setup a fresh install of:
OpenWrt 25.12.0 RC5 + plus relevant updates
pbr
luci-app-pbr
wireguard-tools
luci-proto-wireguard
qrencode
And have set up:
Surfshark VPN client on 10.14.0.2/16 port 0.0.0.0/0
Wireguard server on 172.22.22.1/24 port 55443
My relevant devices:
Raspberry Pi running Adguard Home, Jellyfin and a file server on 192.168.1.5
Router running 25.12.0 RC5 on 192.168.1.1 handing out Raspberry Pi’s 192.168.1.5 dns
Mobile phone running wireguard on 192.168.1.15 or mobile connection
The problem I have is when I connect from my mobile phone with wireguard enabled, I am not able to browse the internet for example google.com I get Connection Refused!
But it does let me access my router on 192.168.1.1 and Adguard Home on 192.168.1.5
I would think I should be able to browse the internet as if I was home!
I have followed EGC’s excellent “OpenWRT WireGuard Server Setup guide using LuCi” but guess I did not seen something.
I am also not sure if I have to add a PBR rule or to does it automagically 
Advise please?
root@Router:~# ubus call system board
{
"kernel": "6.12.71",
"hostname": "Router",
"system": "ARMv8 Processor rev 4",
"model": "Dynalink DL-WRX36",
"board_name": "dynalink,dl-wrx36",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "25.12.0-rc5",
"firmware_url": "https://downloads.openwrt.org/",
"revision": "r32673-482ba7230a",
"target": "qualcommax/ipq807x",
"description": "OpenWrt 25.12.0-rc5 r32673-482ba7230a",
"builddate": "1771363837"
}
}
root@Router:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
list ipaddr '127.0.0.1/8'
config globals 'globals'
option dhcp_default_duid *****
option ula_prefix 'fd9d:99b7:30e1::/48'
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
config interface 'lan'
option device 'br-lan'
option proto 'static'
list ipaddr '192.168.1.1/24'
option ip6assign '60'
option multipath 'off'
list dns '192.168.1.5'
config interface 'wan'
option device 'wan'
option proto 'dhcp'
option peerdns '0'
option multipath 'off'
list dns '192.168.1.5'
config interface 'wan6'
option device 'wan'
option proto 'dhcpv6'
option reqaddress 'try'
option reqprefix 'auto'
option norelease '1'
option peerdns '0'
option multipath 'off'
list dns '192.168.1.5'
option disabled '1'
config interface 'SurfS'
option proto 'wireguard'
option private_key *****
list addresses '10.14.0.2/16'
list dns '162.252.172.57'
list dns '149.154.159.92'
option multipath 'off'
config wireguard_SurfS
option description 'London'
option public_key *****
list allowed_ips '0.0.0.0/0'
option endpoint_host 'uk-lon.prod.surfshark.com'
option endpoint_port '51820'
option route_allowed_ips '1'
config interface 'HwgS'
option proto 'wireguard'
option private_key *****
option multipath 'off'
option listen_port '55443'
list addresses '172.22.22.1/24'
config wireguard_HwgS
option public_key *****
option private_key *****
option description 'My Phone'
option endpoint_port '55443'
option persistent_keepalive '25'
list allowed_ips '172.22.22.2/32'
option route_allowed_ips '1'
root@Router:~# cat /etc/config/wireless
config wifi-device 'radio0'
option type 'mac80211'
option path 'platform/soc@0/c000000.wifi'
option band '5g'
option channel '100'
option htmode 'HE80'
option country 'GB'
option cell_density '0'
config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'Andy'''s'
option encryption 'sae-mixed'
option key *****
option ocv '0'
config wifi-device 'radio1'
option type 'mac80211'
option path 'platform/soc@0/c000000.wifi+1'
option band '2g'
option channel '1'
option htmode 'HE20'
option country 'GB'
option cell_density '0'
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid 'Andy'''s'
option encryption 'sae-mixed'
option key *****
option ocv '0'
root@Router:~# cat /etc/config/firewall
config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option mtu_fix '1'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'DROP'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config zone
option name 'SsVpn'
option input 'REJECT'
option output 'ACCEPT'
option forward 'DROP'
list network 'SurfS'
option masq '1'
config forwarding
option src 'lan'
option dest 'SsVpn'
config zone
option name 'HwgS'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option masq '1'
option mtu_fix '1'
list network 'HwgS'
config forwarding
option src 'HwgS'
option dest 'lan'
config forwarding
option src 'HwgS'
option dest 'wan'
config forwarding
option src 'lan'
option dest 'HwgS'
config rule
option src 'wan'
option name 'allow-55443'
list proto 'udp'
option dest_port '55443'
option target 'ACCEPT'
config nat
option name 'SNAT-WGserver'
list proto 'all'
option src 'lan'
option src_ip '172.22.22.0/24'
option target 'MASQUERADE'
root@Router:~# wg show
interface: HwgS
public key: *****
private key: (hidden)
listening port: 55443
peer: qynL6eWd4S3ZjW61lpjff+d/cXSNXdN6BDs+R8cWmWA=
allowed ips: 172.22.22.2/32
persistent keepalive: every 25 seconds
interface: SurfS
public key: *****
private key: (hidden)
listening port: 59384
peer: *****
endpoint: 185.245.82.66:51820
allowed ips: 0.0.0.0/0
latest handshake: 23 seconds ago
transfer: 378.41 KiB received, 229.49 KiB sent
