Wireguard server issue

[lenovomi]

hi,
i was trying to setup my wireguard server on openwrt router... using article https://openwrt.org/docs/guide-user/services/vpn/wireguard/server but i have no luck....

these are my uci dumps

network.wireguard_vpn=interface
network.wireguard_vpn.proto='wireguard'
network.wireguard_vpn.private_key='xxx'
network.wireguard_vpn.listen_port='51820'
network.wireguard_vpn.addresses='192.168.9.1/24'
network.wireguard_vpn.mtu='1412'
network.wgclient=wireguard_vpn
network.wgclient.public_key='xxxx'
network.wgclient.preshared_key='xxx'
network.wgclient.allowed_ips='192.168.9.2/32'

firewall.wg=rule
firewall.wg.name='Allow-WireGuard-LAN'
firewall.wg.src='wan'
firewall.wg.dest_port='51820'
firewall.wg.proto='udp'
firewall.wg.target='ACCEPT'

this command doesnt work
uci add_list firewall.lan.network="${WG_IF}"
so instead i added wireguard_vpn in covered networks in section Firewal -> zone settings Lan zone

The mentioned url is confusing? its using VPN peers/ but i thought it will be used to setup server and clients....

so much confusion... is there some working howto?

Even my win10 client can connect to openwrt wireguard server it has no default route. .. and i cant ping any local ip address / even cant ping wireguard interface address...

thanks...

[psherman]

Let's get more info...

I'd like to see the complete network and firewall config files (below), as well as the Windows WG config file.

Are you getting a handshake? What is the output of wg show

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/network
cat /etc/config/firewall

[lenovomi]

@psherman hello and thanks, thats strange...

root@OpenWrt-main-router:~# wg show
interface: wireguard_vpn
  public key: ERv+t+LUDAinmkTHPmurJyDGenNxrwXxxxxxRI=
  private key: (hidden)
  listening port: 51820

network

root@OpenWrt-main-router:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fddf:4363:a8a0::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config device
        option name 'lan1'
        option macaddr 'b4:75:0e:64:4b:f8'

config device
        option name 'lan2'
        option macaddr 'b4:75:0e:64:4b:f8'

config device
        option name 'lan3'
        option macaddr 'b4:75:0e:64:4b:f8'

config device
        option name 'lan4'
        option macaddr 'b4:75:0e:64:4b:f8'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '10.0.1.1'

config device
        option name 'wan'
        option macaddr 'b4:75:0e:64:4b:f8'

config interface 'wan'
        option device 'wan'
        option proto 'static'
        option ipaddr '192.168.0.4'
        option netmask '255.255.255.0'
        option gateway '192.168.0.1'
        list dns '8.8.8.8'
        list dns '8.8.4.4'
        option delegate '0'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config route
        option interface 'lan'
        option target '192.168.1.0'
        option netmask '255.255.255.0'
        option gateway '10.0.1.44'

config interface 'wireguard_vpn'
        option proto 'wireguard'
        option private_key 'xxxxTDjGQ='
        option listen_port '51820'
        list addresses '192.168.9.1/24'
        option mtu '1412'

config wireguard_vpn 'wgclient'
        option public_key 'xxxxGNHi4NFLXO/mQpgQoiTplI+2V0='
        option preshared_key 'xxxxxwOqqS1IYvUth+/HNlPPzbRM1jJmGbYCCk='
        list allowed_ips '192.168.9.2/32'

firewall

root@OpenWrt-main-router:~# cat /etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        list network 'wireguard_vpn'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Support-UDP-Traceroute'
        option src 'wan'
        option dest_port '33434:33689'
        option proto 'udp'
        option family 'ipv4'
        option target 'REJECT'
        option enabled 'false'

config include
        option path '/etc/firewall.user'

config redirect
        option target 'DNAT'
        option src 'wan'
        option dest 'lan'
        option proto 'tcp'
        option dest_ip '10.0.1.156'
        option dest_port '80'
        option name 'piwigo'
        option src_dport '1122'


config rule 'wg'
        option name 'Allow-WireGuard-LAN'
        option src 'wan'
        option dest_port '51820'
        option proto 'udp'
        option target 'ACCEPT'

[psherman]

The files generally look fine, but it appears you are not getting any handshakes.

Please post your Windows system's WG config file.

A few things to check...

• I can see that your OpenWrt device is connected behind another router (192.168.0.1). Have you forwarded UDP port 51820 from your outermost router to 192.168.0.4? Does the result from googling "What's my IP" match what you see for the WAN IP on your primary router (the one connected directly to the internet)?
• How are you testing your connection? Is the windows computer on the OpenWrt LAN or the upstream router's LAN, or a different network entirely? Does the windows peer use an IP address or a domain name for the address? If IP -- does it match the WAN IP from above? If domain name -- does that domain name resolve to the proper IP (i.e. the WAN IP)?
• Has the key exchange happened properly. It is easy to mess this up because it is impossible for a human to differentiate between public and private keys.
  • The public key from the router's config must be entered into the "peer > public key" field on the windows system. And vice versa. If in doubt, you can create new key-pairs.
• Other things:
  • it may be a good idea to remove the preshared key until you get the WG handshakes working in general. This removes one variable and thus makes it easier to troubleshoot.
• You may want to test with the windows machine connected directly to the OpenWrt router and with the WG peer address on that system set to 10.0.1.1. Again, this is eliminating variables from outside the router with WG, and then we can work out from there.
• You'll probably want to enable "route allowed IPs" on the OpenWrt wiregaurd configuration for the windows peer. This won't cause issues with the initial handshake, but will affect the ability to make proper connections.

[lenovomi]

hello,

1. yes that router has port forward of udp 51820 to 192.168.0.4 (ie openwrt router where i run wireguard server)
2. the client laptop is entirely different network; config uses domain name which resolves to exactly same ip as WAN
3. keys are set properly as you mentioned

[Interface]
PrivateKey = xxxbfTEb44twyMoTwRTUviSO8DkHdFWwdhPzW8b30=
Address = 192.168.9.2/32
DNS = 8.8.8.8

[Peer]
PublicKey = xxxxnmkTHPmurJyDGenNxrwXPAE76Y2HTqRI=
AllowedIPs = 0.0.0.0/0
Endpoint = XXXX.dynu.com:51820

so as this setup doesnt work ... do i have to go with steps from other things section?

Not sure about "preshared key"; do i have to put into some client config?
Also what do you mean by route allowd ips? do i have to put this into the network wgclient section?

I saw some posts that also 51820 has to be added to openwrt firewall... but doesnt make a sense to me.

Thanks

[psherman]

@lenovomi

Not sure about "preshared key"; do i have to put into some client config?

Your windows peer does not have the preshared key, but the router configuration does have it there. Without a matching preshared key, you will not get a handshake. It either needs to be present in both systems (the exact same key), or absent in both systems.

@lenovomi

Also what do you mean by route allowd ips? do i have to put this into the network wgclient section?

This is an option that will be necessary in your router's WG peer configuration.
option route_allowed_ips '1'

@lenovomi

I saw some posts that also 51820 has to be added to openwrt firewall... but doesnt make a sense to me.

You've already got this port opened in your firewall -- per below

@lenovomi

config rule 'wg'
        option name 'Allow-WireGuard-LAN'
        option src 'wan'
        option dest_port '51820'
        option proto 'udp'
        option target 'ACCEPT'

Try editing your wireguard configuration on your router to match below (note the removal of the preshared key and the addition of the route allowed IPs)... then restart your router and try again.

config interface 'wireguard_vpn'
        option proto 'wireguard'
        option private_key 'xxxxTDjGQ='
        option listen_port '51820'
        list addresses '192.168.9.1/24'
        option mtu '1412'

config wireguard_vpn 'wgclient'
        option public_key 'xxxxGNHi4NFLXO/mQpgQoiTplI+2V0='
        list allowed_ips '192.168.9.2/32'
	option route_allowed_ips '1'

[vgaetera]

Rename the interface section to match the peer section:

uci rename network.wireguard_vpn="vpn"
uci commit network
/etc/init.d/network restart

[psherman]

Good catch!

The firewall will also need to be updated with the renamed interface. In the lan firewall zone, wireguard_vpn will now just be vpn.

[lenovomi]

@lenovomi

vpn

dont get it ... i dont have any vpn anywhere.... so why wireguard_vpn has to be renamed to vpn?

[psherman]

@lenovomi

so why wireguard_vpn has to be renamed to vpn?

It is a syntax thing, and I had missed it entirely (kudos to @vgaetera for finding it).

You don't have to rename wireguard_vpn, but you do need to fix either that or the peer config stanza.

Here's why...
What you have is the following:

config interface 'wireguard_vpn'
        option proto 'wireguard'
...

config wireguard_vpn 'wgclient'
...

In this configuration, you have an interface called wireguard_vpn

Critically (and this is the thing I had not caught), the peer configuration requires a prefix wireguard_ before the name of the interface. So, your peer stanza should actually look like this:

config wireguard_wireguard_vpn 'wgclient'
...

Note the prefix wireguard_ that was added to the interface name.
So... you can either edit the name of the interface to simply vpn (instead of wireguard_vpn) and use the peer stanza as it is, or add the prefix to the peer stanza (as described above) and keep the interface name the same.

Does that make sense?

[lenovomi]

@psherman @vgaetera thanks guys

Now I can initiate connection but I can only ping openwrt lan IP and its WAN ip nothing in local network or further to internet.

Maybe this has to be fixed also?
This is an option that will be necessary in your router's WG peer configuration.
option route_allowed_ips '1'

and here maybe i have to replace wireguard_vpn with vpn only, right?
firewall.@zone[0].network='lan' 'wireguard_vpn'

peer: xxxxxxxb/6JuvQGNHi4NFLXO/mQpgQoiTplI+2V0=
  preshared key: (hidden)
  endpoint: xxx6.128.169:62176
  allowed ips: 192.168.9.2/32
  latest handshake: 55 seconds ago
  transfer: 344.02 KiB received, 128.32 KiB sent

thanks!

[psherman]

@lenovomi

Now I can initiate connection but I can only ping openwrt lan IP and its WAN ip nothing in local network or further to internet.

Great (mostly)!

@lenovomi

This is an option that will be necessary in your router's WG peer configuration.
option route_allowed_ips '1'

Yes... did you add this to your peer stanza on the OpenWrt side?

@lenovomi

and here maybe i have to replace wireguard_vpn with vpn only, right?

What did you change in the end? Did you change the name of the interface (to vpn) or did you fix the peer stanza and prepend wireguard_ to the interface name?

Feel free to post the latest config files (/etc/config/network and /etc/config/firewall).

[lenovomi]

@psherman hello, thank you for a validation.

i did change the name of the interface to vpn

network.vpn=interface
network.vpn.proto='wireguard'

[psherman]

ok... so edit your firewall file so that it looks like this:

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        list network 'vpn'

(the change is the last line: previously wireguard_vpn and now simply vpn)

[lenovomi]

@psherman
yeah thats correct,
i know its odd question but i am physically 400km away from openwrt router... so just dont want to mess things up... just to double check...

root@OpenWrt-main-router:~# uci show firewall | grep wire
firewall.@zone[0].network='lan' 'wireguard_vpn'

can i update it by this cmd properly?
root@OpenWrt-main-router:~# uci set firewall.lan.network="lan vpn"

thanks

[psherman]

@lenovomi

root@OpenWrt-main-router:~# uci set firewall.lan.network="lan vpn"

Maybe. Part of that is correct (the covered networks), but the specifics may or may not be right.

To be sure, let's see the output of
uci show firewall

[lenovomi]

ah okay, by specifics do u mean?

firewall.@defaults[0]=defaults
firewall.@defaults[0].input='ACCEPT'
firewall.@defaults[0].output='ACCEPT'
firewall.@defaults[0].forward='REJECT'
firewall.@defaults[0].synflood_protect='1'
firewall.@zone[0]=zone
firewall.@zone[0].name='lan'
firewall.@zone[0].input='ACCEPT'
firewall.@zone[0].output='ACCEPT'
firewall.@zone[0].forward='ACCEPT'
firewall.@zone[0].network='lan' 'wireguard_vpn'

firewall.@zone[1]=zone
firewall.@zone[1].name='wan'
firewall.@zone[1].network='wan' 'wan6'
firewall.@zone[1].input='REJECT'
firewall.@zone[1].output='ACCEPT'
firewall.@zone[1].forward='REJECT'
firewall.@zone[1].masq='1'
firewall.@zone[1].mtu_fix='1'
firewall.@forwarding[0]=forwarding
firewall.@forwarding[0].src='lan'
firewall.@forwarding[0].dest='wan'
firewall.@rule[0]=rule
firewall.@rule[0].name='Allow-DHCP-Renew'
firewall.@rule[0].src='wan'
firewall.@rule[0].proto='udp'
firewall.@rule[0].dest_port='68'
firewall.@rule[0].target='ACCEPT'
firewall.@rule[0].family='ipv4'
firewall.@rule[1]=rule
firewall.@rule[1].name='Allow-Ping'
firewall.@rule[1].src='wan'
firewall.@rule[1].proto='icmp'
firewall.@rule[1].icmp_type='echo-request'
firewall.@rule[1].family='ipv4'
firewall.@rule[1].target='ACCEPT'
firewall.@rule[2]=rule
firewall.@rule[2].name='Allow-IGMP'
firewall.@rule[2].src='wan'
firewall.@rule[2].proto='igmp'
firewall.@rule[2].family='ipv4'
firewall.@rule[2].target='ACCEPT'

firewall.@rule[3]=rule
firewall.@rule[3].name='Allow-DHCPv6'
firewall.@rule[3].src='wan'
firewall.@rule[3].proto='udp'
firewall.@rule[3].src_ip='fc00::/6'
firewall.@rule[3].dest_ip='fc00::/6'
firewall.@rule[3].dest_port='546'
firewall.@rule[3].family='ipv6'
firewall.@rule[3].target='ACCEPT'
firewall.@rule[4]=rule
firewall.@rule[4].name='Allow-MLD'
firewall.@rule[4].src='wan'
firewall.@rule[4].proto='icmp'
firewall.@rule[4].src_ip='fe80::/10'
firewall.@rule[4].icmp_type='130/0' '131/0' '132/0' '143/0'
firewall.@rule[4].family='ipv6'
firewall.@rule[4].target='ACCEPT'
firewall.@rule[5]=rule
firewall.@rule[5].name='Allow-ICMPv6-Input'
firewall.@rule[5].src='wan'
firewall.@rule[5].proto='icmp'
firewall.@rule[5].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-
type' 'router-solicitation' 'neighbour-solicitation' 'router-advertisement' 'neighbour-advertisement'
firewall.@rule[5].limit='1000/sec'
firewall.@rule[5].family='ipv6'
firewall.@rule[5].target='ACCEPT'
firewall.@rule[6]=rule
firewall.@rule[6].name='Allow-ICMPv6-Forward'
firewall.@rule[6].src='wan'
firewall.@rule[6].dest='*'
firewall.@rule[6].proto='icmp'
firewall.@rule[6].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-
type'
firewall.@rule[6].limit='1000/sec'
firewall.@rule[6].family='ipv6'
firewall.@rule[6].target='ACCEPT'


firewall.@rule[7]=rule
firewall.@rule[7].name='Allow-IPSec-ESP'
firewall.@rule[7].src='wan'
firewall.@rule[7].dest='lan'
firewall.@rule[7].proto='esp'
firewall.@rule[7].target='ACCEPT'
firewall.@rule[8]=rule
firewall.@rule[8].name='Allow-ISAKMP'
firewall.@rule[8].src='wan'
firewall.@rule[8].dest='lan'
firewall.@rule[8].dest_port='500'
firewall.@rule[8].proto='udp'
firewall.@rule[8].target='ACCEPT'
firewall.@rule[9]=rule
firewall.@rule[9].name='Support-UDP-Traceroute'
firewall.@rule[9].src='wan'
firewall.@rule[9].dest_port='33434:33689'
firewall.@rule[9].proto='udp'
firewall.@rule[9].family='ipv4'
firewall.@rule[9].target='REJECT'
firewall.@rule[9].enabled='false'




firewall.wg=rule
firewall.wg.name='Allow-WireGuard-LAN'
firewall.wg.src='wan'
firewall.wg.dest_port='51820'
firewall.wg.proto='udp'
firewall.wg.target='ACCEPT'

thx

[psherman]

uci set firewall.@zone[0].network='lan vpn'; uci commit; /etc/init.d/firewall restart 

[lenovomi]

@psherman very much appreciate to all your time / posts and help. All works great now! thanks!
@vgaetera thx also for chime in.

[lenovomi]

if i can add one observation... once vpn connection is established the speed downgrade is more then 1/2, normally i have speed 50/15, using vpn connection its max 18-20/14... so basically 30mb are gone... i was looking on router Load via luci graphs and while speedtest was running the load increased from almost 0.04 to 0.23

thanks