Wireguard setup for remote home network access & Premium VPN SSID

Leave "Route allowed IPs" unchecked on WG1. Then try these commands:

ip rule add from 192.168.2.0/24 lookup 201
ip route add default dev wg1 table 201
2 Likes

@krazeh thanks a lot, I really appreciate your help! :slight_smile:

Sadly though, this didn't do anything noticeable.

After I executed your suggested commands, and a reboot, nothing changed:
ip rule show:

root@OpenWrt:~# ip rule show
0:	from all lookup local
32766:	from all lookup main
32767:	from all lookup default
root@OpenWrt:~# /etc/init.d/network restart; sleep 10; \
> uci show network; ip rule show
'radio2' is disabled
network.loopback=interface
network.loopback.ifname='lo'
network.loopback.proto='static'
network.loopback.ipaddr='127.0.0.1'
network.loopback.netmask='255.0.0.0'
network.globals=globals
network.globals.ula_prefix='fd59:1d89:daaf::/48'
network.lan=interface
network.lan.type='bridge'
network.lan.ifname='eth0.1'
network.lan.proto='static'
network.lan.ipaddr='192.168.1.1'
network.lan.netmask='255.255.255.0'
network.lan.ip6assign='60'
network.lan.dns='1.1.1.1' '1.0.0.1'
network.wan=interface
network.wan.ifname='eth1.2'
network.wan.proto='pppoe'
network.wan.password='XXX'
network.wan.ipv6='auto'
network.wan.username='XXX'
network.wan.dns='1.1.1.1' '1.0.0.1'
network.wan.peerdns='0'
network.wan6=interface
network.wan6.ifname='eth1.2'
network.wan6.proto='dhcpv6'
network.wan6.dns='1.1.1.1' '1.0.0.1'
network.wan6.reqprefix='auto'
network.wan6.reqaddress='try'
network.wan6.peerdns='0'
network.@switch[0]=switch
network.@switch[0].name='switch0'
network.@switch[0].reset='1'
network.@switch[0].enable_vlan='1'
network.@switch_vlan[0]=switch_vlan
network.@switch_vlan[0].device='switch0'
network.@switch_vlan[0].vlan='1'
network.@switch_vlan[0].ports='0 1 2 3 5t'
network.@switch_vlan[0].vid='1'
network.@switch_vlan[1]=switch_vlan
network.@switch_vlan[1].device='switch0'
network.@switch_vlan[1].vlan='2'
network.@switch_vlan[1].ports='4 6t'
network.@switch_vlan[1].vid='2'
network.wg0=interface
network.wg0.proto='wireguard'
network.wg0.private_key='XXX'
network.wg0.listen_port='1234'
network.wg0.addresses='10.20.20.1/24'
network.@wireguard_wg0[0]=wireguard_wg0
network.@wireguard_wg0[0].public_key='XXX'
network.@wireguard_wg0[0].description='Macbook'
network.@wireguard_wg0[0].persistent_keepalive='25'
network.@wireguard_wg0[0].allowed_ips='10.20.20.2/32'
network.@wireguard_wg0[0].route_allowed_ips='1'
network.@wireguard_wg0[1]=wireguard_wg0
network.@wireguard_wg0[1].public_key='XXX'
network.@wireguard_wg0[1].description='iPhone'
network.@wireguard_wg0[1].persistent_keepalive='25'
network.@wireguard_wg0[1].allowed_ips='10.20.20.3/32'
network.@wireguard_wg0[1].route_allowed_ips='1'
network.wg1=interface
network.wg1.proto='wireguard'
network.wg1.addresses='XXX/32'
network.wg1.private_key='XXX'
network.wg1.delegate='0'
network.@wireguard_wg1[0]=wireguard_wg1
network.@wireguard_wg1[0].public_key='XXX'
network.@wireguard_wg1[0].description='XXX'
network.@wireguard_wg1[0].persistent_keepalive='25'
network.@wireguard_wg1[0].endpoint_port='1194'
network.@wireguard_wg1[0].allowed_ips='0.0.0.0/0'
network.@wireguard_wg1[0].preshared_key='XXX'
network.@wireguard_wg1[0].endpoint_host='XXX'
network.wg1_vpn=interface
network.wg1_vpn.delegate='0'
network.wg1_vpn.proto='static'
network.wg1_vpn.ipaddr='192.168.2.1'
network.wg1_vpn.netmask='255.255.255.0'
network.wg1_vpn.dns='1.1.1.1' '1.0.0.1'
0:	from all lookup local
32766:	from all lookup main
32767:	from all lookup default
root@OpenWrt:~# ubus call system board
{
	"kernel": "4.14.195",
	"hostname": "OpenWrt",
	"system": "ARMv7 Processor rev 1 (v7l)",
	"model": "Linksys WRT3200ACM",
	"board_name": "linksys,rango",
	"release": {
		"distribution": "OpenWrt",
		"version": "19.07.4",
		"revision": "r11208-ce6496d796",
		"target": "mvebu/cortexa9",
		"description": "OpenWrt 19.07.4 r11208-ce6496d796"
	}
}
root@OpenWrt:~# opkg list-installed ip-\*
ip-full - 5.0.0-2.1
ip-tiny - 5.0.0-2.1
root@OpenWrt:~# readlink -f $(type -p ip)
/usr/libexec/ip-full

Don't do that before testing, the rules aren't permanent (yet). Just execute them and test immediately.

You can also simplify your firewall rules as well. Add the wg0 network to the lan zone, rather than creating a new zone for it. You can then remove

config zone
	option name 'wg'
	option input 'ACCEPT'
	option forward 'ACCEPT'
	option output 'ACCEPT'
	option masq '1'
	option network 'wg0'

config forwarding
	option src 'wg'
	option dest 'wan'

config forwarding
	option src 'wg'
	option dest 'lan'

config forwarding
	option src 'lan'
	option dest 'wg'

config forwarding
	option src 'wan'
	option dest 'wg'

You can also add wg1 to the wan zone, rather than having it as a separate zone. Then delete

config zone
	option name 'wg1'
	option mtu_fix '1'
	option input 'REJECT'
	option forward 'REJECT'
	option masq '1'
	option output 'ACCEPT'
	option network 'wg1'

and change

config forwarding
	option dest 'wg1'
	option src 'wg1_vpn'

to

config forwarding
	option dest 'wan'
	option src 'wg1_vpn'

After making the changes do /etc/init.d/firewall restart.

1 Like

@krazeh I understand, haha. Thanks a lot for clarifying this and the improvements, I will add those right now!

I have tested like you said, and yes, now it works! Thanks a ton for this. You have made my evening!

One more question, after running the ip commands, you said they are not permanent, yet.
How do I make, (Or when do they become), permanent?

I use two scripts for a similar purpose on my router. One hotplug script to detect when the vpn comes up and one to add the rules.

Create a file in /etc/hotplug.d/iface and add the below lines. My file is called 90-ifup-vpn but you may want to use 90-ifup-wg1 to keep it clear.

#!/bin/sh

[ "$ACTION" = ifup -a "$INTERFACE" = "wg1" ] && {
        sh -x /etc/network/wg1_up.sh
}
exit 0

Then create the wg1_up.sh file in /etc/network and add the following:

ip rule add from 192.168.2.0/24 lookup 201
ip route add default dev wg1 table 201

Then add the filenames (and paths) to /etc/sysupgrade.conf so they're kept when upgrading.

uci set network.wg1.ip4table="100"
uci set network.wg1.ip6table="100"
uci set network.@wireguard_wg1[0].route_allowed_ips="1"
uci -q delete network.wgrule
uci set network.wgrule="rule"
uci set network.wgrule.in="wg1_vpn"
uci set network.wgrule.lookup="100"
uci -q delete network.wgrule6
uci set network.wgrule6="rule6"
uci set network.wgrule6.in="wg1_vpn"
uci set network.wgrule6.lookup="100"
uci commit network
/etc/init.d/network restart
2 Likes

Having briefly tested those uci commands I think they'll only work if you've set wireguard to route allowed IPs.

2 Likes

Because you can not track UDP connection, and use port numbers.

You don't need to depend on connection tracking if you alter the default route in a separate routing table which is assigned with IP rules to a specific source interface or subnet.

@krazeh & @vgaetera, amazing info! Thanks a lot for this guys, I appreciate your help a lot and have actually learned quite a bit already :slight_smile:

Right now I'm testing @krazeh's firewall rules, and @vgaetera's UCI rules.

Everything seems to work smoothly. Except when I am connecting WG1/WG1_VPN. The connection can be established, I am online but it's becoming extremely sluggish very quick.

When running for example a speed test on https://speedtest.net, the test stops executing half way through, or I receive a warning in my browser that maybe some firewall blocks some SOCKS port etc.

I'm unsure what to do from here, I cannot find any obvious logs that port XY or so is blocked, or maybe it's not even the firewall but something else?

Funny enough, the download speed is almost at my ISP's max (270Mbits), but when connected it freezes intermittently, it feels as if something is blocked somewhere, or extremely throttled. Ping to my destination VPN is 150ms, if I connect to it using the Windscribe app, none of these issues come up.

Here is my current config:

/etc/config/firewall:

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option network 'lan wg0'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option network 'wan wan6 wg1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Remote-SSH-22'
	option src 'wan'
	option target 'ACCEPT'
	option proto 'tcp'
	option dest_port '22222'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.user'

config rule
	option src '*'
	option target 'ACCEPT'
	option proto 'udp'
	option dest_port '1234'
	option name 'Allow-Wireguard-Inbound'

config zone
	option input 'REJECT'
	option forward 'REJECT'
	option name 'wg1_vpn'
	option output 'ACCEPT'
	option network 'wg1_vpn'

config forwarding
	option dest 'wan'
	option src 'wg1_vpn'

config rule
	option src_port '68'
	option src 'wg1_vpn'
	option name 'Allow-Wg1VPN-DHCPv4-Input'
	option family 'ipv4'
	option target 'ACCEPT'
	option dest_port '67'
	list proto 'udp'

/etc/config/network:

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd59:1d89:daaf::/48'

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	list dns '1.1.1.1'
	list dns '1.0.0.1'

config interface 'wan'
	option ifname 'eth1.2'
	option proto 'pppoe'
	option password 'XXX'
	option ipv6 'auto'
	option username 'XXX'
	list dns '1.1.1.1'
	list dns '1.0.0.1'
	option peerdns '0'

config interface 'wan6'
	option ifname 'eth1.2'
	option proto 'dhcpv6'
	list dns '1.1.1.1'
	list dns '1.0.0.1'
	option reqprefix 'auto'
	option reqaddress 'try'
	option peerdns '0'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0 1 2 3 5t'
	option vid '1'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '4 6t'
	option vid '2'

config interface 'wg0'
	option proto 'wireguard'
	option private_key 'XXX'
	option listen_port '1234'
	list addresses '10.20.20.1/24'

config wireguard_wg0
	option public_key 'XXX'
	option description 'Macbook'
	option persistent_keepalive '25'
	list allowed_ips '10.20.20.2/32'
	option route_allowed_ips '1'

config wireguard_wg0
	option public_key 'XXX'
	option description 'iPhone'
	option persistent_keepalive '25'
	list allowed_ips '10.20.20.3/32'
	option route_allowed_ips '1'

config interface 'wg1'
	option proto 'wireguard'
	list addresses 'XXX/32'
	option private_key 'XXX'
	option delegate '0'
	option ip4table '100'
	option ip6table '100'

config wireguard_wg1
	option public_key 'XXX'
	option description 'XXX'
	option persistent_keepalive '25'
	option endpoint_port '1194'
	list allowed_ips '0.0.0.0/0'
	option preshared_key 'XXX'
	option endpoint_host 'XXX'
	option route_allowed_ips '1'

config interface 'wg1_vpn'
	option proto 'static'
	option ipaddr '192.168.2.1'
	option netmask '255.255.255.0'
	list dns '1.1.1.1'
	list dns '1.0.0.1'
	option delegate '0'

config rule 'wgrule'
	option in 'wg1_vpn'
	option lookup '100'
1 Like

This could be an ISP or hardware-related issue.
You can try setting up RNG to improve performance:

@vgaetera thanks, I am looking into that now also.
Meanwhile, I was reading a little and it seems to have to do with MTU size, I'm playing around with that and MSS Clamping as I read that this makes sense with a PPPoE connection (Which I have).

I've set a max MTU of 1412 on the WG1_VPN interface, and it immediately improved a lot.
Trying to find out if there is anything else I can do to it.

1 Like

What I ended up doing is, enabling MSS Clamping in all zones (As we moved wg0 and wg1 together with LAN/WAN).

Then I set MTU explicitly to 1420 (after some tests with lower values - 8bits). The encrypted SSID with Windscribe VPN runs very smooth now and I see no problems at all!

Thanks again @krazeh & @vgaetera, you guys were amazing!

2 Likes

There is one more thing not working, I think it might have something to do with ipv6.

The encrypted VPN ssid works fine and I can connect with my Apple Tv as well as my macbook, without issues.

Whenever I connect my iPhone though, I have no internet, websites just load without ever stopping.
When I look at the connected wireless devices, I see that my iPhone currently is the only device that has an ipv4 & an ipv6 assigned in the encrypted VPN ssid.

Is there anything I can do to make this work as well? Or does it have to do with something entirely different maybe?

I have added a rule for IPV6 DHCP, but nothing changed:

config rule
	option src_port '68'
	option src 'wg1_vpn'
	option name 'Allow-Wg1VPN-DHCPv4-Input'
	option family 'ipv4'
	option target 'ACCEPT'
	option dest_port '67'
	list proto 'udp'

config rule
	option src 'wg1_vpn'
	option name 'Allow-Wg1VPN-DHCPv6-Input'
	option target 'ACCEPT'
	list proto 'udp'
	option family 'ipv6'
	option src_port '547'
	option dest_port '546'

Network:

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd59:1d89:daaf::/48'

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	list dns '1.1.1.1'
	list dns '1.0.0.1'

config interface 'wan'
	option ifname 'eth1.2'
	option proto 'pppoe'
	option password 'XXX'
	option ipv6 'auto'
	option username 'XXX'
	list dns '1.1.1.1'
	list dns '1.0.0.1'
	option peerdns '0'

config interface 'wan6'
	option ifname 'eth1.2'
	option proto 'dhcpv6'
	list dns '1.1.1.1'
	list dns '1.0.0.1'
	option reqprefix 'auto'
	option reqaddress 'try'
	option peerdns '0'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0 1 2 3 5t'
	option vid '1'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '4 6t'
	option vid '2'

config interface 'wg0'
	option proto 'wireguard'
	option private_key 'XXX'
	option listen_port '1234'
	list addresses '10.20.20.1/24'
	option delegate '0'
	option mtu '1420'

config wireguard_wg0
	option public_key 'XXX'
	option description 'Macbook'
	option persistent_keepalive '25'
	list allowed_ips '10.20.20.2/32'
	option route_allowed_ips '1'

config wireguard_wg0
	option public_key 'XXX'
	option description 'iPhone'
	option persistent_keepalive '25'
	list allowed_ips '10.20.20.3/32'
	option route_allowed_ips '1'

config interface 'wg1'
	option proto 'wireguard'
	list addresses 'XXXX/32'
	option private_key 'XXXXX='
	option ip4table '100'
	option ip6table '100'
	option mtu '1420'

config wireguard_wg1
	option public_key 'XXX'
	option description 'XXX'
	option persistent_keepalive '25'
	option endpoint_port '1194'
	option preshared_key 'XXXX'
	option endpoint_host 'XXXX'
	option route_allowed_ips '1'
	list allowed_ips '0.0.0.0/0'
	list allowed_ips '::/0'

config interface 'wg1_vpn'
	option proto 'static'
	option ipaddr '192.168.2.1'
	option netmask '255.255.255.0'
	list dns '1.1.1.1'
	list dns '1.0.0.1'
	option mtu '1420'

config rule 'wgrule'
	option in 'wg1_vpn'
	option lookup '100'

You can find dual-stack WG setup in the wiki:
https://openwrt.org/docs/guide-user/services/vpn/wireguard/start#internal_links

Thanks @vgaetera! :slight_smile:

Now I'm thinking it must be something else... I just tried logging into the encrypted ssid with my Macbook, and at the same time I was streaming from my Apple TV in the same ssid. Both worked.

Then I logged in with my iPad, which also only received an ipv4 address, but the iPad has no internet. Browser just says "Safari could not open the page because the server stopped responding".

So now I have 2 devices that can login, macbook and apple tv, both ipv4.
And 2 devices that can connect to ssid, but have no internet. 1 with ipv4 only, 1 with ipv4 & 1 with (local) ipv6 assigned.

On the screenshot it's the Apple TV (Living-Room.lan) and the iPad.

What else could prevent these two devices (iPad & iPhone) from establishing an internet connection? (Both devices can, I can easily log into the unencrypted WIFI and both work normal.)

I haven't really adjusted anything, but here is my complete config:

/etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '1'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'wg1_vpn'
	option start '100'
	option leasetime '12h'
	option limit '150'
	option interface 'wg1_vpn'
/etc/config/firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option network 'lan wg0'
	option mtu_fix '1'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option network 'wan wan6 wg1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Remote-SSH-22'
	option src 'wan'
	option target 'ACCEPT'
	option proto 'tcp'
	option dest_port '22222'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.user'

config rule
	option src '*'
	option target 'ACCEPT'
	option proto 'udp'
	option dest_port '1234'
	option name 'Allow-Wireguard-Inbound'

config zone
	option input 'REJECT'
	option forward 'REJECT'
	option name 'wg1_vpn'
	option output 'ACCEPT'
	option network 'wg1_vpn'
	option mtu_fix '1'

config forwarding
	option dest 'wan'
	option src 'wg1_vpn'

config rule
	option src_port '68'
	option src 'wg1_vpn'
	option name 'Allow-Wg1VPN-DHCPv4-Input'
	option family 'ipv4'
	option target 'ACCEPT'
	option dest_port '67'
	list proto 'udp'
/etc/config/network

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd59:1d89:daaf::/48'

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	list dns '1.1.1.1'
	list dns '1.0.0.1'

config interface 'wan'
	option ifname 'eth1.2'
	option proto 'pppoe'
	option password 'xxx'
	option ipv6 'auto'
	option username 'xxxx'
	list dns '1.1.1.1'
	list dns '1.0.0.1'
	option peerdns '0'

config interface 'wan6'
	option ifname 'eth1.2'
	option proto 'dhcpv6'
	list dns '1.1.1.1'
	list dns '1.0.0.1'
	option reqprefix 'auto'
	option reqaddress 'try'
	option peerdns '0'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0 1 2 3 5t'
	option vid '1'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '4 6t'
	option vid '2'

config interface 'wg0'
	option proto 'wireguard'
	option private_key 'xxx+EKsfHQ5ipq5jlyS1gyzSgFBX/r1Y='
	option listen_port '1234'
	list addresses '10.20.20.1/24'
	option mtu '1420'
	option delegate '0'

config wireguard_wg0
	option public_key 'xxxxx/qkugLhdtM5ITr+YjYCVw7NhszjHwk='
	option description 'Macbook'
	option persistent_keepalive '25'
	list allowed_ips '10.20.20.2/32'
	option route_allowed_ips '1'

config wireguard_wg0
	option public_key 'xxxx/qNlkMepqTzlgsY88XYWQ8='
	option description 'iPhone'
	option persistent_keepalive '25'
	list allowed_ips '10.20.20.3/32'
	option route_allowed_ips '1'

config interface 'wg1'
	option proto 'wireguard'
	list addresses 'xxxx.146.92/32'
	option private_key 'xxxxxxx='
	option delegate '0'
	option ip4table '100'
	option ip6table '100'
	option mtu '1420'

config wireguard_wg1
	option public_key 'xxxxxxx/czDeuTNgBOoqTysE6ZAXaQPU7DGgg='
	option description 'Dxxxxx'
	option persistent_keepalive '25'
	option endpoint_port '1194'
	list allowed_ips '0.0.0.0/0'
	option preshared_key 'fL+xxxxx/o6wCwUixWUXLeMSU9sLo='
	option endpoint_host 'xxxx.146.149'
	option route_allowed_ips '1'

config interface 'wg1_vpn'
	option proto 'static'
	option ipaddr '192.168.2.1'
	option netmask '255.255.255.0'
	list dns '1.1.1.1'
	list dns '1.0.0.1'
	option delegate '0'
	option force_link '0'
	option mtu '1420'

config rule 'wgrule'
	option in 'wg1_vpn'
	option lookup '100'

Actually, PBR for IPv6 requires a separate rule.

@vgaetera ah I see, that makes sense.

I ran the UCI commands, but no change so far.

root@OpenWrt:~# ip rule show
0:	from all lookup local
1:	from all iif wlan0-1 lookup 100
10000:	from 100.66.146.92 lookup 100
20000:	from all to 100.66.146.92 lookup 100
32766:	from all lookup main
32767:	from all lookup default
90040:	from all iif lo lookup 100
root@OpenWrt:~#
1 Like

IPv6 rules are also listed separately:

ip -6 rule show

@vgaetera lol, that makes so much sense, I didn't even think of that haha.
Alright, here we go:

root@OpenWrt:~# ip -6 rule show
0:	from all lookup local
1:	from all iif wlan0-1 lookup 100
32766:	from all lookup main
90050:	from all iif lo lookup 100
4200000000:	from 2003:fc:8f0c:a400::1/60 iif br-lan unreachable
4200000001:	from all iif lo failed_policy
4200000044:	from all iif br-lan failed_policy
4200000048:	from all iif wg0 failed_policy
4200000049:	from all iif pppoe-wan failed_policy
4200000049:	from all iif pppoe-wan failed_policy
4200000050:	from all iif wg1 failed_policy
4200000053:	from all iif wlan0-1 failed_policy
root@OpenWrt:~#

I'm unsure what this means tbh.
Also, like I said, the iPad does not have an ipv6 assigned on the vpn ssid. Still it has no internet.
It's weird. The other devices work without issues

1 Like