Wireguard is active but not present.(MT1300)

[Fastlane]

Hello everyone,

Just upgraded my MT1300 (Beryl) to vanilla OpenWRT via UBoot.

Tried to setup OpenWRT as advised here:

How To Set Up A VPN On A Router // Wireguard on OpenWrt

Ive got the latest handshake about every 20 to 60 seconds. And I see a TX/ there, so its active?
But its not masking my IP at all. My VPN host, whatsmyip and everything all say I have the same IP as before I connect.

I did add a DNS server in WAN and adding some zones. As advised by the YT vid.
Thats it.

|Hostname|OpenWrt|

|Model|GL.iNet GL-MT1300
|Architecture|MediaTek MT7621 ver:1 eco:3|
|Target Platform|ramips/mt7621|
|Firmware Version|OpenWrt 22.03.3 r20028-43d71ad93e / LuCI openwrt-22.03 branchgit-22.361.69894-438c598|
|Kernel Version|5.10.161|

Why wont it mask my IP?
Thanks in advance.
Take care.

[Fastlane]

Firewall zones.

[psherman]

let's see the config...

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/network
cat /etc/config/firewall

[Fastlane]

Had to use putty to do this on windows but here goes:

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option packet_steering '1'
        option ula_prefix 'fd5a:00e0:b9a0::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'
        option peerdns '0'
        list dns '1.1.1.1'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config interface 'NWV23'
        option proto 'dhcp'
        option peerdns '
        list dns '

config interface 'FREEDOM1'
        option proto 'wireguard'
        option private_key 'redacted'
        option listen_port 'redacted'
        list addresses redacted
        option peerdns ''
        list dns 'redacted'

config wireguard_FREEDOM1
        option public_key 'bZPUlxtmXeHwbpU25g3oWQSu9ffJkmAjwz7QjwnxVAA='
        list allowed_ips '0.0.0.0/0'
        option persistent_keepalive '25'
        option endpoint_host '72.17.88.14'
        option endpoint_port '1443'
        option description 'Home FL'

and firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'
        list network 'NWV23'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'VPN1'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'FREEDOM1'
        option input 'REJECT'
        option masq '1'

config forwarding
        option src 'lan'
        option dest 'VPN1'

Cool, learned lots of new stuff today. Never ran on a terminal for a network device before.

Thank you.

[psherman]

Remove the listen port, peerdns and dns lines below (the dns doesn't have an effect here).

@Fastlane

config interface 'FREEDOM1'
        option proto 'wireguard'
        option private_key 'redacted'
        option listen_port '59793'
        list addresses redacted
        option peerdns '0'
        list dns '1.1.1.1'

add route_allowed_ips '1'to the peer config stanza.

@Fastlane

config wireguard_FREEDOM1
        option public_key 'bZPUlxtmXeHwbpU25g3oWQSu9ffJkmAjwz7QjwnxVAA='
        list allowed_ips '0.0.0.0/0'
        option persistent_keepalive '25'
        option endpoint_host '72.17.88.14'
        option endpoint_port '1443'
        option description 'Home FL'

Then restart the wireguard interface and try again.

[Fastlane]

When you say remove you mean the post here right? Done.

By 1 gather you mean turn it on. Done.

Whoa, that did it.
Thanks psherman!
You're the best.

That was fast. Can you explain to me what allowing routes does and why that matters?

[psherman]

@Fastlane

That was fast. Can you explain to me what allowing routes does and why that matters?

You've set 0.0.0.0/0 as the allowed IPs. You can kind of think of this as a basic firewall to allow all IPs to go through the tunnel. However, this doesn't actually setup the routing table to route unless you either manually create routes or enable the route_allowed_ips option which inserts the route into the rouitng table.

Glad it's working now!