Hi!
I have a a (to me) pretty strange issue that I could not resolve myself. I am using two WAN
interfaces eth1 (cable modem) and pppoe-vdsl (VDSL via FritzBox in bridge mode). After updating from 18.06 to 19.07 via sysupgrade I can only successfully establish a connection to my wireguard server from the eth1 interface. Connection coming from the pppeo-vdsl interface establish a connection from the client side, but the server does not seem to get any data back to the client. The same configuration works without issues on 18.06. TCP traffic (to other systems in the LAN) is still
forwarded without issues through the pppoe-vdsl interface. The only real difference between those two interfaces is that the gateway for pppoe-vdsl is on a different subnet, could that explain the problem?
tl;dr:
- Configuration worked on
16.06 - wireguard tunnel from one WAN (
eth1) interface works - wireguard server from second WAN (
pppoe-vdsl) only successfully receives data from the client,
but the client doesn't receive any responses - Connecting from the LAN via both external IP addresses works (makes me assume it's not a port
forwarding but NAT/masquerading issue?) - TCP traffic is forwarded without problems
I compared the output of some of the commands listed below between the router running 18.06 and
19.07 (luckily it has a dual boot feature) and the only change that stood out to me is that the
loopback interface does not have the LAN ip registered anymore (even though I don't know if that
could cause my problem):
@ ip4addr:3 @
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
- inet 192.168.1.1/32 scope global lo
- valid_lft forever preferred_lft forever
Any help is greatly appreciated!
Broken wg show (via pppoe-vdsl)
interface: wireguard
public key: publickey
private key: (hidden)
listening port: 13377
peer: public-peer-key
endpoint: 80.xxx.xxx.xxx:31126
allowed ips: 208.0.0.3/32
transfer: 148 B received, 92 B sent
persistent keepalive: every 25 seconds
Working wg show (via eth1)
interface: wireguard
public key: publickey
private key: (hidden)
listening port: 13377
peer: public-peer-key
endpoint: 80.xxx.xxx.xxx:13024
allowed ips: 208.0.0.3/32
latest handshake: 3 seconds ago
transfer: 6.85 KiB received, 4.65 KiB sent
persistent keepalive: every 25 seconds
route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 185.xxx.xxx.1 0.0.0.0 UG 10 0 0 eth1
0.0.0.0 62.214.63.97 0.0.0.0 UG 20 0 0 pppoe-vdsl
10.0.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0.30
62.214.63.97 0.0.0.0 255.255.255.255 UH 0 0 0 pppoe-vdsl
169.254.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0.3
172.30.172.1 172.30.172.9 255.255.255.255 UGH 0 0 0 tun0
172.30.172.9 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
185.xxx.xxx.0 0.0.0.0 255.255.255.0 U 10 0 0 eth1
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 br-lan
200.0.0.0 172.30.172.9 255.255.255.0 UG 0 0 0 tun0
208.0.0.0 0.0.0.0 255.255.255.0 U 0 0 0 wireguard
208.0.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 wireguard
208.0.0.3 0.0.0.0 255.255.255.255 UH 0 0 0 wireguard
208.0.0.4 0.0.0.0 255.255.255.255 UH 0 0 0 wireguard
ip -4 addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
2: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 532
inet 185.xxx.xxx.xxx/24 brd 185.251.102.255 scope global eth1
valid_lft forever preferred_lft forever
8: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
valid_lft forever preferred_lft forever
10: eth0.3@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
inet 169.254.1.2/24 brd 169.254.1.255 scope global eth0.3
valid_lft forever preferred_lft forever
11: eth0.30@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
inet 10.0.0.1/24 brd 10.0.0.255 scope global eth0.30
valid_lft forever preferred_lft forever
13: pppoe-vdsl: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1492 qdisc fq_codel state UNKNOWN group default qlen 3
inet 83.xx.xx.xxx peer 62.214.63.97/32 scope global pppoe-vdsl
valid_lft forever preferred_lft forever
16: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
inet 172.30.172.10 peer 172.30.172.9/32 scope global tun0
valid_lft forever preferred_lft forever
18: wireguard: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
inet 208.0.0.1/24 brd 208.0.0.255 scope global wireguard
valid_lft forever preferred_lft forever
ip -4 ro
default via 185.xxx.xxx.1 dev eth1 proto static src 185.xxx.xxx.xxx metric 10
default via 62.214.63.97 dev pppoe-vdsl proto static metric 20
10.0.0.0/24 dev eth0.30 proto kernel scope link src 10.0.0.1
62.214.63.97 dev pppoe-vdsl proto kernel scope link src 83.xx.xx.xxx
169.254.1.0/24 dev eth0.3 proto kernel scope link src 169.254.1.2
172.30.172.1 via 172.30.172.9 dev tun0
172.30.172.9 dev tun0 proto kernel scope link src 172.30.172.10
185.251.102.0/24 dev eth1 proto static scope link metric 10
192.168.1.0/24 dev br-lan proto kernel scope link src 192.168.1.1
200.0.0.0/24 via 172.30.172.9 dev tun0
208.0.0.0/24 dev wireguard proto kernel scope link src 208.0.0.1
208.0.0.2 dev wireguard proto static scope link
208.0.0.3 dev wireguard proto static scope link
208.0.0.4 dev wireguard proto static scope link
ip -4 ru
0: from all lookup local
1001: from all iif eth1 lookup 1
1002: from all iif pppoe-vdsl lookup 2
2001: from all fwmark 0x100/0x3f00 lookup 1
2002: from all fwmark 0x200/0x3f00 lookup 2
2061: from all fwmark 0x3d00/0x3f00 blackhole
2062: from all fwmark 0x3e00/0x3f00 unreachable
32766: from all lookup main
32767: from all lookup default
/etc/config/network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd99:bb69:b4f1::/48'
config interface 'lan'
option type 'bridge'
option ifname 'eth0.1'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option ipaddr '192.168.1.1'
config interface 'wan'
option ifname 'eth1'
option proto 'dhcp'
option peerdns '0'
option dns '8.8.8.8 8.8.4.4'
option metric '10'
config interface 'wan6'
option ifname '@wan'
option proto 'dhcpv6'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option vid '1'
option ports '0 1 2 5t'
config switch_vlan
option device 'switch0'
option vlan '2'
option vid '2'
option ports '4 6'
config interface 'vpn'
option proto 'none'
option _orig_ifname 'tap0'
option _orig_bridge 'false'
option ifname 'tun0'
config switch_vlan
option device 'switch0'
option vlan '4'
option vid '30'
option ports '2t 5t'
config interface 'cloud'
option proto 'static'
option ifname 'eth0.30'
option ipaddr '10.0.0.1'
option netmask '255.255.255.0'
config interface 'vdsl'
option proto 'pppoe'
option username 'xxxxxxxxx'
option password 'xxxxxxxx'
option metric '20'
option ifname 'eth0.3'
option ipv6 '0'
list dns '8.8.8.8'
list dns '8.8.4.4'
option peerdns '0'
config switch_vlan
option device 'switch0'
option vlan '5'
option vid '3'
option ports '2t 3 5t'
config interface 'ios'
option proto 'static'
option ipaddr '10.10.0.1'
option netmask '255.255.255.0'
config interface 'wireguard'
option proto 'wireguard'
option private_key 'xxxxxxxxxxxxxxxxxxxxxx='
list addresses '208.0.0.1/24'
option listen_port '13377'
config wireguard_wireguard
option public_key 'public-peer-key'
option persistent_keepalive '25'
option description 'iPhone'
list allowed_ips '208.0.0.3/32'
option route_allowed_ips '1'
config interface 'FRITZWEB'
option proto 'static'
option ifname 'eth0.3'
option netmask '255.255.255.0'
option ipaddr '169.254.1.2'
/etc/config/firewall
config redirect
option target 'DNAT'
option src 'wan'
option dest 'lan'
option proto 'tcp'
option src_dport '22'
option dest_port '22'
option name 'ssh'
option dest_ip '192.168.1.232'
config redirect
option target 'DNAT'
option src 'vdsl'
option dest 'cloud'
option proto 'tcp'
option src_dport '22'
option dest_ip '10.0.0.12'
option dest_port '22'
option name 'ssh vdsl'
config redirect
option target 'DNAT'
option src 'wan'
option dest 'lan'
option proto 'tcp'
option src_dport '22000'
option dest_ip '192.168.1.212'
option dest_port '22000'
option name 'syncthing'
config redirect
option target 'DNAT'
option proto 'tcp'
option src_dport '80'
option dest_ip '10.0.0.2'
option dest_port '80'
option name 'vdsl proxy http'
option src 'vdsl'
option dest 'lan'
config redirect
option target 'DNAT'
option proto 'tcp'
option src_dport '443'
option dest_ip '10.0.0.2'
option dest_port '443'
option name 'vdsl proxy https'
option src 'vdsl'
option dest 'lan'
config redirect
option target 'DNAT'
option src 'wan'
option proto 'tcp'
option src_dport '80'
option dest_ip '10.0.0.2'
option dest_port '80'
option name 'wan proxy http'
option dest 'lan'
config redirect
option target 'DNAT'
option src 'wan'
option proto 'tcp'
option src_dport '443'
option dest_ip '10.0.0.2'
option dest_port '443'
option name 'wan proxy https'
option dest 'lan'
config redirect
option target 'DNAT'
option dest 'cloud'
option proto 'tcp'
option src_dport '443'
option dest_ip '10.0.0.2'
option dest_port '443'
option src 'vdsl'
option name 'cloud vdsl https'
config redirect
option target 'DNAT'
option src 'vdsl'
option dest 'cloud'
option proto 'tcp'
option src_dport '80'
option dest_ip '10.0.0.2'
option dest_port '80'
option name 'cloud vdsl http'
config redirect
option target 'DNAT'
option src 'wan'
option dest 'cloud'
option proto 'tcp'
option dest_ip '10.0.0.2'
option name 'cloud wan https'
option src_dport '443'
option dest_port '443'
config redirect
option target 'DNAT'
option src 'wan'
option dest 'cloud'
option proto 'tcp'
option src_dport '80'
option dest_ip '10.0.0.2'
option dest_port '80'
option name 'cloud wan http'
config redirect
option target 'DNAT'
option src 'vdsl'
option proto 'udp'
option name 'wireguard vdsl'
option dest_ip '192.168.1.1'
option dest 'lan'
option dest_port '13377'
option src_dport '13377'
config redirect
option target 'DNAT'
option src 'wan'
option proto 'udp'
option dest_ip '192.168.1.1'
option name 'wireguard cable'
option dest 'lan'
option dest_port '13377'
option src_dport '13377'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fe80::/10'
option src_port '547'
option dest_ip 'fe80::/10'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-OpenVPN-Inbound'
option target 'ACCEPT'
option src '*'
option proto 'udp'
option dest_port '1194'
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option network 'lan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'wan6 wan'
config include
option path '/etc/firewall.user'
config zone
option input 'ACCEPT'
option output 'ACCEPT'
option masq '1'
option network 'flavoursys_vpn'
option forward 'ACCEPT'
option name 'vpn'
config include 'miniupnpd'
option type 'script'
option path '/usr/share/miniupnpd/firewall.include'
option family 'any'
option reload '1'
config include 'bcp38'
option type 'script'
option path '/usr/lib/bcp38/run.sh'
option family 'IPv4'
option reload '1'
config zone
option name 'cloud'
option input 'ACCEPT'
option forward 'REJECT'
option output 'ACCEPT'
option network 'cloud loopnat'
config zone
option name 'vdsl'
option forward 'REJECT'
option output 'ACCEPT'
option input 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'vdsl'
config forwarding
option dest 'wan'
option src 'cloud'
config forwarding
option dest 'vdsl'
option src 'cloud'
config zone
option input 'ACCEPT'
option forward 'REJECT'
option output 'ACCEPT'
option name 'ios'
option network 'ios'
config forwarding
option dest 'vdsl'
option src 'ios'
config forwarding
option dest 'wan'
option src 'ios'
config forwarding
option dest 'cloud'
option src 'wireguard'
config forwarding
option dest 'ios'
option src 'wireguard'
config forwarding
option dest 'vdsl'
option src 'wireguard'
config forwarding
option dest 'vpn'
option src 'wireguard'
config forwarding
option dest 'wan'
option src 'wireguard'
config rule
option target 'ACCEPT'
option src 'cloud'
option name 'dokku to gitlab'
option src_ip '10.0.0.11'
option dest 'vpn'
option dest_ip '200.0.0.42'
config rule
option target 'ACCEPT'
option src 'wan'
option dest 'lan'
option name 'access fritzbox'
config zone
option name 'wireguard'
option input 'ACCEPT'
option forward 'ACCEPT'
option output 'ACCEPT'
option masq '1'
option network 'wireguard'
config zone
option name 'fritzweb'
option output 'ACCEPT'
option network 'FRITZWEB'
option masq '1'
option input 'ACCEPT'
option forward 'REJECT'
config forwarding
option dest 'cloud'
option src 'lan'
config forwarding
option dest 'fritzweb'
option src 'lan'
config forwarding
option dest 'ios'
option src 'lan'
config forwarding
option dest 'vdsl'
option src 'lan'
config forwarding
option dest 'vpn'
option src 'lan'
config forwarding
option dest 'wan'
option src 'lan'
config forwarding
option dest 'wireguard'
option src 'lan'
config forwarding
option dest 'lan'
option src 'wireguard'
