Wireguard Question

Folks:

Thanks to help from many, I have a functional wireguard on my home gateway. Steps I took:

  1. Enabled IP address pass through to my Openwrt router behind AT&T internet box.
  2. Added wireguard interface in lan-zone with three peers (Phone, Laptop, and Travel Router)
  3. Added a cloudflare DDNS to get a fqdn for the openwrt router's public address.
  4. Allowed 51820 incoming traffic to wireguard interface on the openwrt gateway.
  5. Configured Wireguard on my phone as well as my laptop and both of them connect to the home intranet from outside and I can print on my home printer or access samba volumes inside my home firewall.
  6. I have configured a travel router (openwrt) to be lan-only interface and when I connect to a hotel ethernet port (no captive portal), it gets an IP address for the interface and using my other lan ports or wireless to access internet.
  7. Then, on my travel router with functioning dumb (firewall disabled), I created an interface called "home" with dhcp enabled. Attached one of the wireless to this interface.
  8. I created wireguard interface with Home as one (only) peer.
  9. Even though firewall is disabled and stopped, I defined firewall rule to allow wireguard zone to forward to lan zone. And, Home zone to wireguard zone.

This setup does not appear to work. The port 51820 is not a problem as my phone and my laptop are able to connect using the same hotel network.

What am I doing wrong.
Pls advise.

I would setup the travel router as a normal gateway router.
Make sure the LAN subnet is different from your home network.

To recap reset to default on the travel router, change the LAN ip subnet different from the home network probably use 192.168.113.0/24 to make sure there are no collisions with the hotel network (although they usually use 10.x)
If you have installed luci proto-wireguard and the wg-installer-client you can import the config file in your travel routers wireguard and bob is your uncle

1 Like

For symmetric routing, the travel router's LAN must be an allowed_ip in the home router's wireguard client configuration of the travel router. And as @egc noted, that lan must be a different IP subnet from everything, including the home LAN and the hotel network you use as WAN.

The alternative is to have the travel router NAT its local LAN into the Wireguard tunnel. The downside of that is the inherently one-way nature of NAT means that a lan device at home cannot originate a connection to a device on the travel LAN. With a NAT setup, the home router sees the travel router and its users as a single road warrior using only the tunnel IP address, so no additional configuration is required at home. Again though the networks cannot overlap. NAT uses the firewall. The firewall cannot be shut down. You really don't want to shut down the firewall then connect to an untrusted hotel network anyway.

1 Like

Thanks. I am going to try this.

  1. I am out of town, and noticed that my phone, although connects to VPN at home, does not hand off this route to the laptop when using its hotspot. Is this normal? Can this be changed?
  2. My openwrt gateway is critical path for internet and so, I want to keep it simple and failure proof. Changes often introduce instabilities due to lack of my own knowledge. So my question is little complex: (a) Is it possible to have the gateway do only DHCP/VLAN/DDNS and hive off wireguard to another device on the lan? (b) And, althought I have not tried, is it also possible to put Adguard home on a device that is not the main gateway?

Much appreciate your comments.

I will try and take risk to attempt and answer this:

  1. In the main gateway(192.168.1.1), forward the wan:any-ip/51820/UDP to lan:192.168.1.2/51820/udp.
  2. On the second device (192.168.1.2) with two zones lan+vpn have a firewall rule, forward the lan:any-ip/51820/udp to vpn:10.1.1.1/51820/udp.
  3. have all zones on their unique VLANs
  4. have a firewall rule on the main gateway that allows vpn zone to go to wan.

Am I on the right track?

Thanks.