Wireguard server with double nat and vpn client

trendy · March 30, 2020, 11:11am

It was a typo, I meant eth1.2 , but the script did the job as well anyway.

Disable the vpn client and PBR. Is it working now that everything goes out of wan and not vpn?
Try something else, define the ingress interface for WG as wan and not everything. It shouldn't matter, but I remember another thread that it was conflicting.
Add wg0 interface in lan firewall zone and remove it from wg_server zone. It also shouldn't matter, but we need to rule out all possibilities.

Kaisen · March 30, 2020, 12:40pm

I think we are getting close!

Disabling vpn client and PBR: connecting from the internet now works fine!
Not sure I understood this one correctly. You mean the firewall rule for allowing incoming wg traffic? If so I did that and set the source zone to wan: no change; still not working
So I did that, restarted the network and it works. With VPN client and PBR enabled...

Which means something is not right with the wireguard zone. Since I would really like to work with separated zones, do you have any further ideas? Again, thank you for taking the time!

EDIT: I am sorry, point 3 is not working after all. After restarting the network the default route was going through wan and not the vpn client. After making sure the default route is set to the vpn client, it makes no difference whether wg0 interface is assigned to the lan zone or wg server zone: it does not work in any case. So the problem is rather related to PBR not working? Which would be strange since it works fine for my web server and I can also create working rules for specific domains...

trendy · March 30, 2020, 1:58pm

Can you switch the policy in PBR for wireguard from UDP to TCP and try it. Only there, not in firewall.

Kaisen · March 30, 2020, 2:13pm

I did that, no change
Still incoming traffic on port 5892 but no answer...

trendy · March 30, 2020, 2:27pm

Ok restore back the protocol to udp, change verbosity setting to 2 and post the following:
cat /etc/config/vpn-policy-routing , /etc/init.d/vpn-policy-routing support, as well as the output of /etc/init.d/vpn-policy-routing reload

@stangri is it a typo in the readme that although WG uses UDP, your example uses TCP?

Kaisen · March 30, 2020, 3:22pm

vpn-policy-routing: https://pastebin.com/raCWUDzb
vpn-policy-routing support: https://pastebin.com/sgBwu19B
vpn-policy-routing reload: https://pastebin.com/n9kTKPTV

stangri · March 30, 2020, 8:13pm

Which line number in the readme are we talking about?

trendy · March 30, 2020, 9:33pm

Line 485, you have proto tcp, but wireguard is udp.

stangri · March 30, 2020, 9:41pm

Fantastic catch, thank you! Will be fixed in the next PR. Are you on github?

trendy · March 30, 2020, 9:45pm

Only as a user, don't have any code.
Do you see anything weird here by any chance? I've been looking at it for a couple of days but all seems correct. And when PBR is disabled it works fine.

stangri · March 30, 2020, 10:07pm

Is OpenVPN tunnel utilizing tcp ot udp? I'd recommend trying to switch it to TCP and see if it helps. I can't recall the reason exactly, but for the VPN server/client scenarios README recommends using different protocols for them, could it be the same here?

Do other policies (not OUTPUT chain) work?

Kaisen · March 31, 2020, 9:12am

I have changed the vpn client to tcp. Unfortunately it does not help with the problem.

Other policies work fine btw. I have several prerouting polices which work nicely

trendy · March 31, 2020, 9:44am

It is Wireguard which doesn't support tcp.

Kaisen · March 31, 2020, 9:51am

I think @stangri means the vpn client I use which is indeed OpenVPN and supports TCP. Only the server is wireguard. But as I wrote changing the client to tcp does not help

trendy · April 3, 2020, 9:45am

Can you try to ip route flush cache ?

Kaisen · April 3, 2020, 2:59pm

I ran the command but nothing changed regarding my problem. Would there be anything I should look out for?

Kaisen · April 5, 2020, 1:12pm

Since this is driving me nuts I now even switched from the openvpn client to a wireguard client with the hope of solving the problem.

It remains however the same; I get incoming traffic on port 5892 but cannot send an answer via the wan route

trendy · April 5, 2020, 1:18pm

I am out of ideas for the time being. However do a search in the forum, as I swear that I have come across this issue before.

Kaisen · April 5, 2020, 5:32pm

Thank you in any case for helping. I actually spent several days searching through forums (also this one) without any success before posting here, so I am not too hopeful anymore

trendy · April 5, 2020, 6:37pm

Until some solution is found, maybe you want to do it for the whole router?
ip rule add iif lo to default lookup 201 prio 16030