UDP port 22 on router is forwarded to port 51820 on TP-Link.
TP-Link is connected to my modem/router.
TP-Linl Lan IP is 192.168.0.3 and modem/router IP is 192.168.0.1
I tryed to connect from outside and I get this error:
"wireguard invalid handshake response"
All the rest is a moot point if since I missed the very important info in your post about failing with Phone.
Your config is for a Road Warrior. Your out and about and trying to get on your lan from a Data or Wift connected Cell, and in order to do that you have to have a publicly reachable DNS address that maps back thru your ISP modem to your TP-Link.
sure I have a ddns host.
I tryed regenerating all the keys and now I am able to connect but from outside I can reach only the wireguard server at 192.168.0.3 or 192.168.0.1, no internet and no other IP in lan...
Any suggestion?
Suggest using the updated OpenWrt wiki page linked above. It has two scripts the reader (you), have to modify with input in the upper section.
The ## are the definitions of the value.
The # are the values you modify.
Create WireGuard interface and its keys
Download the script
Edit the configuration values at the top (or write a wrapper script to set environment variables and call this script)
Copy the script(s) to your OpenWrt system (such as with scp)
Download the script
Edit the configuration values at the top (or write a wrapper script to set environment variables and call this script)
Copy the script(s) to your OpenWrt system (such as with scp)
Hi Bill, I read the guide linked in the script and I think it's not my context since in the so-called “road warrior” configuration OpenWrt and wireguard are on the router while in my case I have openwrt/wireguard behind the router:
internet <--> modem/router (192.168.0.1) <--> tp-link in bridge mode with openwrt/wireguard (192.168.0.3/192.168.9.1).
As I told before, after regenerating keys now I am able to connect from outside and handshake is ok. The problem is that from android phone or from a windows pc I can reach only the wireguard server at 192.168.0.3 or 192.168.0.1, no internet and no other IP in lan... Maybe the problem is the firewall on the openwrt? tp link with openwrt is connected by ethernet cable to the main router and is configured as a wireless access point following the official guide on openwrt doc.
Thanks in advance,
Marco
Please copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
Since your RE450 running WG is not the main router, you need to do one of two things...
Option 1) If your main router supports static routes, add one that is 192.168.2.0/24 via 192.168.0.3
or
Option 2) If your main router doesn't support static routes, you need to adjust the firewall on the RE450.
split out the VPN into a different firewall zone (remove it from the lan zone)
enable masquerading on the lan zone
allow forwarding from the vpn zone > lan zone
config zone 'lan'
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
option masq '1'
config zone 'vpn'
option name 'vpn'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'vpn'
config forwarding
option src 'vpn'
option dest 'lan'
Thank you psherman, it's all clear. My router doesn't support static routes so I have to go with option 2 and adjust the firewall on the RE450. Can I do it in Luci or I need to use command in ssh?
Ok I tried and but nothing changed.. I am only able to reach 192.168.0.3 / 192.168.9.1 that is the IP of RE450.. No other IP in LAN and no internet...
This is the firewall:
