Not needed, their traffic goes to g0 which has masquerade enabled.
@psherman @trendy
Still no success 
,
As @psherman suggested i have entered suggested entry in dhcp file:
root@OpenWrt:~# cat /etc/config/dhcp
config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config dhcp 'gate '
option interface 'gate'
option start '100'
option limit '150'
option leasetime '12h'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
Still having no internet.
Btw when i connect any device with Secure Network, It gets a some ip like this:
Have you restarted the router?
@psherman
@trendy
I checked it again and now looks like dhcp is working
but still no internet 
Following is how firewall config looks like
From this view it looks as if traffic is not routed to g0, Am i correct ?
try turning on masquerading on the lan zone.
let's see the complete configuration again (network, firewall, DHCP, wireless)
@psherman Here it is
cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd28:714c:ff0d::/48'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0.1'
config device
option name 'eth0.1'
option macaddr '50b:f'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option ipaddr '192.168.178.120'
list dns '8.8.8.8'
option gateway '192.168.178.1'
config interface 'wan'
option device 'eth0.2'
option proto 'dhcp'
config interface 'wan6'
option device 'eth0.2'
option proto 'dhcpv6'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '1 2 3 4 6t'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '0 6t'
config interface 'gate'
option proto 'static'
option netmask '255.255.255.0'
option ipaddr '192.168.2.2'
config interface 'g0'
option proto 'wireguard'
option peerdns '0'
list dns '10.0.0.243'
list dns '10.0.0.242'
option defaultroute '0'
option private_key 'mI6ZW+g5'
list addresses '10.16.130.189/24'
config wireguard_g0
option description 'Imported peer configuration'
list allowed_ips '0.0.0.0/0'
option persistent_keepalive '25'
option endpoint_port '1337'
option route_allowed_ips '1'
option public_key 'Y8rZh+Ow0YJDj='
option endpoint_host '138.199.10.17'
cat /etc/config/dhcp
config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config dhcp 'gate'
option interface 'gate'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
cat /etc/config/firewall
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'g0'
option output 'ACCEPT'
list network 'g0'
option input 'REJECT'
option forward 'REJECT'
option masq '1'
config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option masq '1'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config zone
option name 'gate'
option input 'ACCEPT'
option output 'ACCEPT'
list network 'gate'
option forward 'ACCEPT'
config forwarding
option src 'gate'
option dest 'g0'
cat /etc/config/wireless
config wifi-device 'radio0'
option type 'mac80'
option path 'pci0000:00/0000:01:00.0'
option channel '36'
option band '5g'
option htmode 'VHT80'
option cell_density '0'
config wifi-device 'radio1'
option type 'mac81'
option path 'platfo00.wmac'
option channel '1'
option band '2g'
option htmode 'HT20'
option disabled '1'
config wifi-iface 'wifinet2'
option device 'radio0'
option mode 'ap'
option ssid 'Haze'
option encryption 'sae'
option key 'bl$'
option network 'lan'
config wifi-iface 'wifinet3'
option device 'radio0'
option mode 'ap'
option ssid 'Secure'
option encryption 'sae'
option key '!@#$'
option network 'gate'
from a computer on the gate network, can you run the following ping tests:
ping 192.168.2.2
ping 8.8.8.8
ping google.com
@psherman
From my computer, when i connect with Secure SSID , i can ping ping 192.168.2.2
PING 192.168.2.2 (192.168.2.2): 56 data bytes
64 bytes from 192.168.2.2: icmp_seq=0 ttl=64 time=13.435 ms
64 bytes from 192.168.2.2: icmp_seq=1 ttl=64 time=60.579 ms
64 bytes from 192.168.2.2: icmp_seq=2 ttl=64 time=104.505 ms
64 bytes from 192.168.2.2: icmp_seq=3 ttl=64 time=153.279 ms
64 bytes from 192.168.2.2: icmp_seq=4 ttl=64 time=195.456 ms
But for ping 8.8.8.8 this i get:
PING 8.8.8.8 (8.8.8.8): 56 data bytes
ping: sendto: No route to host
ping: sendto: No route to host
Request timeout for icmp_seq 0
for ping google.com this i get:
ping: cannot resolve google.com: Unknown host
ok... so that suggests that we do have a real routing issue. Let me review some more.
remove this from the wg configuration.
restart the router and then also check the status of wg show
2 Likes
WOW ... you guys defiantly are magicians .. it worked 
@psherman here is the output of "wg show"
interface: g0
public key: 3Sxp/w6UGckQ8=
private key: (hidden)
listening port: 38857
peer: Y8rZh+Ow0YJDj8eL+=
endpoint: 138.199.10.17:1337
allowed ips: 0.0.0.0/0
latest handshake: 1 minute, 10 seconds ago
transfer: 978.93 KiB received, 345.89 KiB sent
persistent keepalive: every 25 seconds
This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.