Wireguard setup for remote home network access & Premium VPN SSID

Installing and Using OpenWrt Network and Wireless Configuration
#1

Hey guys :slight_smile:

first time OpenWrt user, lovin' it so far. Thanks so much for creating & maintaining this!

I'm not very friendly with networking etc, so having a hard time getting the setup built that I need.

Here's hoping someone here might give me steps on what I have to do to get it finally done :wink:

Router:

  • WRT3200acm behind a Zyxel VDSL2 super vectoring modem.

Goal:

I want to achieve two things: (both with Wireguard)

  • Have remote access to my home network while traveling (access to devices but also a VPN so I could surf with home home IP address even in another country).

  • In my home network have an additional 5Ghz SSID that should always map to a premium VPN service (For Netflix etc.)

What I have so far:

Not much haha :slight_smile: I have created two wireless ssids (5Ghz and 2.4Ghz),
which simply provide my home access to my ISP provided internet.

I've installed all required wireguard packages thru Luci as well as vpn-policy-routing.

I've come as fqr aa creating a Wireguard interface, but couldn't connect it to my wireless ssid.

Never done anything like this before and feel a little stupid haha.

Could you give me some guidance? I'd appreciate it really!

#2

It is bad idea to use Wireguard with PBR due to UDP protocol in Wireguard. However connection to Wireless should not influence on Wireguard, and vice-versa.

#3

Thanks @ulmwind, I'm completely unsure how to even set the above up. So I've just installed what I found mentioned in several tutorials.

But once I hopefully figure out what to do to achieve a working setup, I can of course not use PBR.

Problem really is, I am very unsure what steps to take to even get as far as connecting anything :slight_smile:

#4

Wireguard - Interfaces & peers

1 Like
#5

why is that?

#6

I've explained in your quote, what is your question?

#7

Start with OpenVPN.

#8

You said using wireguard with policy-based-routing is a bad idea because wireguard use UDP, why is it a bad idea?

#9

Sooo, I've managed to get the described setup to work, to 99%.
I am seeing a weird problem now that I cannot really put my finge on...

Everything works:

  • 2 SSIDs connected via lan interface, for unencrypted ISP internet
  • 1 WG0 Wireguard interface for Wireguard "server", where I can connect devices remotely to my home router and share my home internet from anywhere.
  • 1 SSID for encrypted VPN internet (Windscribe VPN) (WG1 Wireguard interface, WG1_VPN Static interface assigned to SSID)

The problem now is, the Windscribe VPN SSID only works, if I check "Route allowed IPs" in the WG1 interface. But this causes the internet to break when i switch to any of the unecnrypted wifi SSIDs...

If I remove this checkmark, and restart network services the encrypted WIFI stops working, but the unencrypted wifi SSIDs start working again and have internet connection.

What can I do to get it all working simultaneously?

Here is my config:
/etc/config/network

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd59:1d89:daaf::/48'

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	list dns '1.1.1.1'
	list dns '1.0.0.1'

config interface 'wan'
	option ifname 'eth1.2'
	option proto 'pppoe'
	option password 'XXX'
	option ipv6 'auto'
	option username 'XXX'
	list dns '1.1.1.1'
	list dns '1.0.0.1'
	option peerdns '0'

config interface 'wan6'
	option ifname 'eth1.2'
	option proto 'dhcpv6'
	list dns '1.1.1.1'
	list dns '1.0.0.1'
	option reqprefix 'auto'
	option reqaddress 'try'
	option peerdns '0'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0 1 2 3 5t'
	option vid '1'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '4 6t'
	option vid '2'

config interface 'wg0'
	option proto 'wireguard'
	option private_key 'XXX'
	option listen_port '1234'
	list addresses '10.20.20.1/24'

config wireguard_wg0
	option public_key 'XXX'
	option description 'Macbook'
	option persistent_keepalive '25'
	list allowed_ips '10.20.20.2/32'
	option route_allowed_ips '1'

config wireguard_wg0
	option public_key 'XXX'
	option description 'iPhone'
	option persistent_keepalive '25'
	list allowed_ips '10.20.20.3/32'
	option route_allowed_ips '1'

config interface 'wg1'
	option proto 'wireguard'
	list addresses 'XXX/32'
	option private_key 'XXX'
	option delegate '0'

config wireguard_wg1
	option public_key 'XXX'
	option description 'XXX'
	option persistent_keepalive '25'
	option endpoint_port '1194'
	list allowed_ips '0.0.0.0/0'
	option preshared_key 'XXX'
	option endpoint_host 'XXX'
	option route_allowed_ips '1'

config interface 'wg1_vpn'
	option delegate '0'
	option type 'bridge'
	option proto 'static'
	option ipaddr '192.168.2.1'
	option netmask '255.255.255.0'
	list dns '1.1.1.1'
	list dns '1.0.0.1'

/etc/config/firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option network 'wan wan6'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Remote-SSH-22'
	option src 'wan'
	option dest_port '22'
	option target 'ACCEPT'
	option proto 'tcp'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.user'

config rule
	option src '*'
	option target 'ACCEPT'
	option proto 'udp'
	option dest_port '1234'
	option name 'Allow-Wireguard-Inbound'

config zone
	option name 'wg'
	option input 'ACCEPT'
	option forward 'ACCEPT'
	option output 'ACCEPT'
	option masq '1'
	option network 'wg0'

config forwarding
	option src 'wg'
	option dest 'wan'

config forwarding
	option src 'wg'
	option dest 'lan'

config forwarding
	option src 'lan'
	option dest 'wg'

config forwarding
	option src 'wan'
	option dest 'wg'

config zone
	option name 'wg1'
	option mtu_fix '1'
	option input 'REJECT'
	option forward 'REJECT'
	option masq '1'
	option output 'ACCEPT'
	option network 'wg1'

config zone
	option input 'REJECT'
	option forward 'REJECT'
	option name 'wg1_vpn'
	option output 'ACCEPT'
	option network 'wg1_vpn'

config forwarding
	option dest 'wg1'
	option src 'wg1_vpn'

config rule
	option src_port '68'
	option src 'wg1_vpn'
	option name 'Allow-Wg1VPN-DHCPv4-Input'
	option family 'ipv4'
	option target 'ACCEPT'
	option dest_port '67'
	list proto 'udp'

/etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option hwmode '11a'
	option path 'soc/soc:pcie/pci0000:00/0000:00:01.0/0000:01:00.0'
	option country 'DE'
	option legacy_rates '0'
	option htmode 'VHT80'
	option channel '149'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option wpa_disable_eapol_key_retries '1'
	option key 'XXX'
	option ssid 'XXX'
	option encryption 'psk2+ccmp'

config wifi-iface 'wifinet2'
	option ssid 'XXX'
	option encryption 'psk2+ccmp'
	option device 'radio0'
	option mode 'ap'
	option wpa_disable_eapol_key_retries '1'
	option key 'XXX'
	option network 'wg1_vpn'

config wifi-device 'radio1'
	option type 'mac80211'
	option hwmode '11g'
	option path 'soc/soc:pcie/pci0000:00/0000:00:02.0/0000:02:00.0'
	option legacy_rates '0'
	option noscan '1'
	option country 'DE'
	option htmode 'HT40'
	option channel '1'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option wpa_disable_eapol_key_retries '1'
	option key 'XXX'
	option ssid 'XXX'
	option encryption 'psk2+ccmp'

config wifi-device 'radio2'
	option disabled '1'
	option type 'mac80211'
	option hwmode '11a'
	option path 'platform/soc/soc:internal-regs/f10d8000.sdhci/mmc_host/mmc0/mmc0:0001/mmc0:0001:1'
	option htmode 'VHT80'
	option legacy_rates '0'
	option country 'DE'
	option channel '165'

/etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '1'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'wg1_vpn'
	option start '100'
	option leasetime '12h'
	option limit '150'
	option interface 'wg1_vpn'
	option ra 'server'
	option ra_management '1'
	list dhcp_option '6,1.1.1.1,1.0.0.1'
#10

Leave "Route allowed IPs" unchecked on WG1. Then try these commands:

ip rule add from 192.168.2.0/24 lookup 201
ip route add default dev wg1 table 201
2 Likes
#11

@krazeh thanks a lot, I really appreciate your help! :slight_smile:

Sadly though, this didn't do anything noticeable.

After I executed your suggested commands, and a reboot, nothing changed:
ip rule show:

root@OpenWrt:~# ip rule show
0:	from all lookup local
32766:	from all lookup main
32767:	from all lookup default

root@OpenWrt:~# /etc/init.d/network restart; sleep 10; \
> uci show network; ip rule show
'radio2' is disabled
network.loopback=interface
network.loopback.ifname='lo'
network.loopback.proto='static'
network.loopback.ipaddr='127.0.0.1'
network.loopback.netmask='255.0.0.0'
network.globals=globals
network.globals.ula_prefix='fd59:1d89:daaf::/48'
network.lan=interface
network.lan.type='bridge'
network.lan.ifname='eth0.1'
network.lan.proto='static'
network.lan.ipaddr='192.168.1.1'
network.lan.netmask='255.255.255.0'
network.lan.ip6assign='60'
network.lan.dns='1.1.1.1' '1.0.0.1'
network.wan=interface
network.wan.ifname='eth1.2'
network.wan.proto='pppoe'
network.wan.password='XXX'
network.wan.ipv6='auto'
network.wan.username='XXX'
network.wan.dns='1.1.1.1' '1.0.0.1'
network.wan.peerdns='0'
network.wan6=interface
network.wan6.ifname='eth1.2'
network.wan6.proto='dhcpv6'
network.wan6.dns='1.1.1.1' '1.0.0.1'
network.wan6.reqprefix='auto'
network.wan6.reqaddress='try'
network.wan6.peerdns='0'
network.@switch[0]=switch
network.@switch[0].name='switch0'
network.@switch[0].reset='1'
network.@switch[0].enable_vlan='1'
network.@switch_vlan[0]=switch_vlan
network.@switch_vlan[0].device='switch0'
network.@switch_vlan[0].vlan='1'
network.@switch_vlan[0].ports='0 1 2 3 5t'
network.@switch_vlan[0].vid='1'
network.@switch_vlan[1]=switch_vlan
network.@switch_vlan[1].device='switch0'
network.@switch_vlan[1].vlan='2'
network.@switch_vlan[1].ports='4 6t'
network.@switch_vlan[1].vid='2'
network.wg0=interface
network.wg0.proto='wireguard'
network.wg0.private_key='XXX'
network.wg0.listen_port='1234'
network.wg0.addresses='10.20.20.1/24'
network.@wireguard_wg0[0]=wireguard_wg0
network.@wireguard_wg0[0].public_key='XXX'
network.@wireguard_wg0[0].description='Macbook'
network.@wireguard_wg0[0].persistent_keepalive='25'
network.@wireguard_wg0[0].allowed_ips='10.20.20.2/32'
network.@wireguard_wg0[0].route_allowed_ips='1'
network.@wireguard_wg0[1]=wireguard_wg0
network.@wireguard_wg0[1].public_key='XXX'
network.@wireguard_wg0[1].description='iPhone'
network.@wireguard_wg0[1].persistent_keepalive='25'
network.@wireguard_wg0[1].allowed_ips='10.20.20.3/32'
network.@wireguard_wg0[1].route_allowed_ips='1'
network.wg1=interface
network.wg1.proto='wireguard'
network.wg1.addresses='XXX/32'
network.wg1.private_key='XXX'
network.wg1.delegate='0'
network.@wireguard_wg1[0]=wireguard_wg1
network.@wireguard_wg1[0].public_key='XXX'
network.@wireguard_wg1[0].description='XXX'
network.@wireguard_wg1[0].persistent_keepalive='25'
network.@wireguard_wg1[0].endpoint_port='1194'
network.@wireguard_wg1[0].allowed_ips='0.0.0.0/0'
network.@wireguard_wg1[0].preshared_key='XXX'
network.@wireguard_wg1[0].endpoint_host='XXX'
network.wg1_vpn=interface
network.wg1_vpn.delegate='0'
network.wg1_vpn.proto='static'
network.wg1_vpn.ipaddr='192.168.2.1'
network.wg1_vpn.netmask='255.255.255.0'
network.wg1_vpn.dns='1.1.1.1' '1.0.0.1'
0:	from all lookup local
32766:	from all lookup main
32767:	from all lookup default

root@OpenWrt:~# ubus call system board
{
	"kernel": "4.14.195",
	"hostname": "OpenWrt",
	"system": "ARMv7 Processor rev 1 (v7l)",
	"model": "Linksys WRT3200ACM",
	"board_name": "linksys,rango",
	"release": {
		"distribution": "OpenWrt",
		"version": "19.07.4",
		"revision": "r11208-ce6496d796",
		"target": "mvebu/cortexa9",
		"description": "OpenWrt 19.07.4 r11208-ce6496d796"
	}
}
root@OpenWrt:~# opkg list-installed ip-\*
ip-full - 5.0.0-2.1
ip-tiny - 5.0.0-2.1
root@OpenWrt:~# readlink -f $(type -p ip)
/usr/libexec/ip-full
#12

Don't do that before testing, the rules aren't permanent (yet). Just execute them and test immediately.

You can also simplify your firewall rules as well. Add the wg0 network to the lan zone, rather than creating a new zone for it. You can then remove

config zone
	option name 'wg'
	option input 'ACCEPT'
	option forward 'ACCEPT'
	option output 'ACCEPT'
	option masq '1'
	option network 'wg0'

config forwarding
	option src 'wg'
	option dest 'wan'

config forwarding
	option src 'wg'
	option dest 'lan'

config forwarding
	option src 'lan'
	option dest 'wg'

config forwarding
	option src 'wan'
	option dest 'wg'

You can also add wg1 to the wan zone, rather than having it as a separate zone. Then delete

config zone
	option name 'wg1'
	option mtu_fix '1'
	option input 'REJECT'
	option forward 'REJECT'
	option masq '1'
	option output 'ACCEPT'
	option network 'wg1'

and change

config forwarding
	option dest 'wg1'
	option src 'wg1_vpn'

to

config forwarding
	option dest 'wan'
	option src 'wg1_vpn'

After making the changes do /etc/init.d/firewall restart.

1 Like
#13

@krazeh I understand, haha. Thanks a lot for clarifying this and the improvements, I will add those right now!

I have tested like you said, and yes, now it works! Thanks a ton for this. You have made my evening!

One more question, after running the ip commands, you said they are not permanent, yet.
How do I make, (Or when do they become), permanent?

#14

I use two scripts for a similar purpose on my router. One hotplug script to detect when the vpn comes up and one to add the rules.

Create a file in /etc/hotplug.d/iface and add the below lines. My file is called 90-ifup-vpn but you may want to use 90-ifup-wg1 to keep it clear.

#!/bin/sh

[ "$ACTION" = ifup -a "$INTERFACE" = "wg1" ] && {
        sh -x /etc/network/wg1_up.sh
}
exit 0

Then create the wg1_up.sh file in /etc/network and add the following:

ip rule add from 192.168.2.0/24 lookup 201
ip route add default dev wg1 table 201

Then add the filenames (and paths) to /etc/sysupgrade.conf so they're kept when upgrading.

#15 
uci set network.wg1.ip4table="100"
uci set network.wg1.ip6table="100"
uci set network.@wireguard_wg1[0].route_allowed_ips="1"
uci -q delete network.wgrule
uci set network.wgrule="rule"
uci set network.wgrule.in="wg1_vpn"
uci set network.wgrule.lookup="100"
uci -q delete network.wgrule6
uci set network.wgrule6="rule6"
uci set network.wgrule6.in="wg1_vpn"
uci set network.wgrule6.lookup="100"
uci commit network
/etc/init.d/network restart
2 Likes
Problem with data transfers through wireguard tunnel
#16

Having briefly tested those uci commands I think they'll only work if you've set wireguard to route allowed IPs.

2 Likes
#17

Because you can not track UDP connection, and use port numbers.

VPN Policy-Based Routing + Web UI -- Discussion
#18

You don't need to depend on connection tracking if you alter the default route in a separate routing table which is assigned with IP rules to a specific source interface or subnet.

#19

@krazeh & @vgaetera, amazing info! Thanks a lot for this guys, I appreciate your help a lot and have actually learned quite a bit already :slight_smile:

Right now I'm testing @krazeh's firewall rules, and @vgaetera's UCI rules.

Everything seems to work smoothly. Except when I am connecting WG1/WG1_VPN. The connection can be established, I am online but it's becoming extremely sluggish very quick.

When running for example a speed test on https://speedtest.net, the test stops executing half way through, or I receive a warning in my browser that maybe some firewall blocks some SOCKS port etc.

I'm unsure what to do from here, I cannot find any obvious logs that port XY or so is blocked, or maybe it's not even the firewall but something else?

Funny enough, the download speed is almost at my ISP's max (270Mbits), but when connected it freezes intermittently, it feels as if something is blocked somewhere, or extremely throttled. Ping to my destination VPN is 150ms, if I connect to it using the Windscribe app, none of these issues come up.

Here is my current config:

/etc/config/firewall:

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option network 'lan wg0'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option network 'wan wan6 wg1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Remote-SSH-22'
	option src 'wan'
	option target 'ACCEPT'
	option proto 'tcp'
	option dest_port '22222'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.user'

config rule
	option src '*'
	option target 'ACCEPT'
	option proto 'udp'
	option dest_port '1234'
	option name 'Allow-Wireguard-Inbound'

config zone
	option input 'REJECT'
	option forward 'REJECT'
	option name 'wg1_vpn'
	option output 'ACCEPT'
	option network 'wg1_vpn'

config forwarding
	option dest 'wan'
	option src 'wg1_vpn'

config rule
	option src_port '68'
	option src 'wg1_vpn'
	option name 'Allow-Wg1VPN-DHCPv4-Input'
	option family 'ipv4'
	option target 'ACCEPT'
	option dest_port '67'
	list proto 'udp'

/etc/config/network:

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd59:1d89:daaf::/48'

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	list dns '1.1.1.1'
	list dns '1.0.0.1'

config interface 'wan'
	option ifname 'eth1.2'
	option proto 'pppoe'
	option password 'XXX'
	option ipv6 'auto'
	option username 'XXX'
	list dns '1.1.1.1'
	list dns '1.0.0.1'
	option peerdns '0'

config interface 'wan6'
	option ifname 'eth1.2'
	option proto 'dhcpv6'
	list dns '1.1.1.1'
	list dns '1.0.0.1'
	option reqprefix 'auto'
	option reqaddress 'try'
	option peerdns '0'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0 1 2 3 5t'
	option vid '1'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '4 6t'
	option vid '2'

config interface 'wg0'
	option proto 'wireguard'
	option private_key 'XXX'
	option listen_port '1234'
	list addresses '10.20.20.1/24'

config wireguard_wg0
	option public_key 'XXX'
	option description 'Macbook'
	option persistent_keepalive '25'
	list allowed_ips '10.20.20.2/32'
	option route_allowed_ips '1'

config wireguard_wg0
	option public_key 'XXX'
	option description 'iPhone'
	option persistent_keepalive '25'
	list allowed_ips '10.20.20.3/32'
	option route_allowed_ips '1'

config interface 'wg1'
	option proto 'wireguard'
	list addresses 'XXX/32'
	option private_key 'XXX'
	option delegate '0'
	option ip4table '100'
	option ip6table '100'

config wireguard_wg1
	option public_key 'XXX'
	option description 'XXX'
	option persistent_keepalive '25'
	option endpoint_port '1194'
	list allowed_ips '0.0.0.0/0'
	option preshared_key 'XXX'
	option endpoint_host 'XXX'
	option route_allowed_ips '1'

config interface 'wg1_vpn'
	option proto 'static'
	option ipaddr '192.168.2.1'
	option netmask '255.255.255.0'
	list dns '1.1.1.1'
	list dns '1.0.0.1'
	option delegate '0'

config rule 'wgrule'
	option in 'wg1_vpn'
	option lookup '100'
1 Like
#20

This could be an ISP or hardware-related issue.
You can try setting up RNG to improve performance: