Wireguard peer/client unable to connect to router/server/peer

Hello everyone.

I have a set up as follows:
2 VLANs - 192.168.1.x for trusted devices that access the internet directly via my router; 192.168.2.x for guests and IOT devices that can only access the internet through a commercial VPN provider.

I would like to enable connections into my home network using wireguard so that I can access local devices while I am away from home, using the Wireguard app on my phone.

I have tried several guides but unable to find a solution that works. I imagine my configs are all mixed up now from trying different things. Any ideas what I am doing wrong?

Observed results:

  • No handshake occurs
  • Data is transmitted by phone (a few kbs) but nothing is received.
  • nmap shows the following:
    PORT STATE SERVICE
    51820/tcp closed unknown
    51820/udp open|filtered unknown

Configs below:

/etc/config/network
config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdee:e1a2:9fc4::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	option ipv6 '0'
	list ports 'eth0'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config interface 'lan'
	option device 'br-lan.1'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option delegate '0'
	list dns_search 'lan'
	list dns '192.168.1.100'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'
	option reqaddress 'try'
	option reqprefix 'auto'
	option peerdns '0'

config bridge-vlan
	option device 'br-lan'
	option vlan '1'
	list ports 'eth0:t'
	list ports 'lan1:u*'

config bridge-vlan
	option device 'br-lan'
	option vlan '2'
	list ports 'eth0:t'
	list ports 'lan2:u*'
	list ports 'lan3:u*'
	list ports 'lan4:u*'

config interface 'vlan2'
	option proto 'static'
	option device 'br-lan.2'
	option ipaddr '192.168.2.1'
	option netmask '255.255.255.0'
	option delegate '0'
	option defaultroute '0'

config interface 'wgmvad'
	option proto 'wireguard'
	option private_key ''
	option defaultroute '0'
	option delegate '0'
	list addresses ']'
	option force_link '1'

config device
	option name 'br-lan.1'
	option type '8021q'
	option ifname 'br-lan'
	option vid '1'
	option ipv6 '0'
	option acceptlocal '1'

config device
	option name 'br-lan.2'
	option type '8021q'
	option ifname 'br-lan'
	option vid '2'
	option ipv6 '0'

config device
	option name 'lan1'
	option acceptlocal '1'

config device
	option name 'wgmvad'
	option acceptlocal '1'
	option sendredirects '1'
	option ipv6 '0'

config wireguard_wgmvad
	option description ']'
	option public_key ''
	list allowed_ips '0.0.0.0/0'
	option endpoint_host ''
	option endpoint_port '51820'

config interface 'wg0'
	option proto 'wireguard'
	option private_key ''
	option listen_port '51820'
	list addresses '192.168.99.1/24'

config wireguard_wg0
	option description 'test2'
	option public_key 'gCuaHg'
	option private_key '2Djqq='
	option persistent_keepalive '25'
	list allowed_ips '0.0.0.0/0'
	option route_allowed_ips '1'


/etc/config/firewall
config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'
	list network 'vlan2'
	list network 'wg0'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config forwarding
	option src 'lan'
	option dest 'wan'

config include 'pbr'
	option fw4_compatible '1'
	option type 'script'
	option path '/usr/share/pbr/pbr.firewall.include'

config zone
	option name 'vpn'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wgmvad'

config forwarding
	option src 'vpn'
	option dest 'wan'

config forwarding
	option src 'lan'
	option dest 'vpn'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'DNS over PiHole except VPN'
	option src 'lan'
	list src_mac '7C:D3:0A:10:DC:25'
	option src_ip '!192.168.2.0/24'
	option src_dport '53'
	option dest_ip '192.168.1.100'
	option dest_port '53'
	option enabled '0'

config rule
	option name 'Isolate IOT Devices'
	option dest '*'
	option target 'REJECT'
	list dest_ip '!192.168.0.0/24'
	option src '*'
	list proto 'all'
	list src_ip '192.168.2.130'
	list src_ip '192.168.2.175'
	list src_ip '192.168.2.150'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'wireguard server incoming connections'
	option src 'wan'
	option src_dport '51820'
	option dest_ip '192.168.1.1'
	option dest_port '51820'


You will need to update your policy based routing to ensure that the the remote access tunnel sends its response via the regular wan and not the commercial VPN service.

That said...

The allowed_ips here should be a single /32 IP address in the subnet defined by the interface. For example, 192.168.99.2/32. This same address must be used by the remote peer in its interface address (although usually this will be defined as a /24: 192.168.99.2/24), and the allowed_ips on the remote peer should be 0.0.0.0/0 if you want all traffic to traverse the tunnel.

The redirect rule should be removed and replaced with a basic traffic rule for udp port 51820.

2 Likes

Sadly, no luck.

Here is my PBR rule:

The IP address I am using on my phone (client) config is the one here under "Address" without the /27: