@vgaetera thanks, I am looking into that now also.
Meanwhile, I was reading a little and it seems to have to do with MTU size, I'm playing around with that and MSS Clamping as I read that this makes sense with a PPPoE connection (Which I have).
I've set a max MTU of 1412 on the WG1_VPN interface, and it immediately improved a lot.
Trying to find out if there is anything else I can do to it.
What I ended up doing is, enabling MSS Clamping in all zones (As we moved wg0 and wg1 together with LAN/WAN).
Then I set MTU explicitly to 1420 (after some tests with lower values - 8bits). The encrypted SSID with Windscribe VPN runs very smooth now and I see no problems at all!
There is one more thing not working, I think it might have something to do with ipv6.
The encrypted VPN ssid works fine and I can connect with my Apple Tv as well as my macbook, without issues.
Whenever I connect my iPhone though, I have no internet, websites just load without ever stopping.
When I look at the connected wireless devices, I see that my iPhone currently is the only device that has an ipv4 & an ipv6 assigned in the encrypted VPN ssid.
Is there anything I can do to make this work as well? Or does it have to do with something entirely different maybe?
I have added a rule for IPV6 DHCP, but nothing changed:
config rule
option src_port '68'
option src 'wg1_vpn'
option name 'Allow-Wg1VPN-DHCPv4-Input'
option family 'ipv4'
option target 'ACCEPT'
option dest_port '67'
list proto 'udp'
config rule
option src 'wg1_vpn'
option name 'Allow-Wg1VPN-DHCPv6-Input'
option target 'ACCEPT'
list proto 'udp'
option family 'ipv6'
option src_port '547'
option dest_port '546'
Network:
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd59:1d89:daaf::/48'
config interface 'lan'
option type 'bridge'
option ifname 'eth0.1'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
list dns '1.1.1.1'
list dns '1.0.0.1'
config interface 'wan'
option ifname 'eth1.2'
option proto 'pppoe'
option password 'XXX'
option ipv6 'auto'
option username 'XXX'
list dns '1.1.1.1'
list dns '1.0.0.1'
option peerdns '0'
config interface 'wan6'
option ifname 'eth1.2'
option proto 'dhcpv6'
list dns '1.1.1.1'
list dns '1.0.0.1'
option reqprefix 'auto'
option reqaddress 'try'
option peerdns '0'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0 1 2 3 5t'
option vid '1'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '4 6t'
option vid '2'
config interface 'wg0'
option proto 'wireguard'
option private_key 'XXX'
option listen_port '1234'
list addresses '10.20.20.1/24'
option delegate '0'
option mtu '1420'
config wireguard_wg0
option public_key 'XXX'
option description 'Macbook'
option persistent_keepalive '25'
list allowed_ips '10.20.20.2/32'
option route_allowed_ips '1'
config wireguard_wg0
option public_key 'XXX'
option description 'iPhone'
option persistent_keepalive '25'
list allowed_ips '10.20.20.3/32'
option route_allowed_ips '1'
config interface 'wg1'
option proto 'wireguard'
list addresses 'XXXX/32'
option private_key 'XXXXX='
option ip4table '100'
option ip6table '100'
option mtu '1420'
config wireguard_wg1
option public_key 'XXX'
option description 'XXX'
option persistent_keepalive '25'
option endpoint_port '1194'
option preshared_key 'XXXX'
option endpoint_host 'XXXX'
option route_allowed_ips '1'
list allowed_ips '0.0.0.0/0'
list allowed_ips '::/0'
config interface 'wg1_vpn'
option proto 'static'
option ipaddr '192.168.2.1'
option netmask '255.255.255.0'
list dns '1.1.1.1'
list dns '1.0.0.1'
option mtu '1420'
config rule 'wgrule'
option in 'wg1_vpn'
option lookup '100'
You can find dual-stack WG setup in the wiki:
https://openwrt.org/docs/guide-user/services/vpn/wireguard/start#internal_links
Thanks @vgaetera! 
Now I'm thinking it must be something else... I just tried logging into the encrypted ssid with my Macbook, and at the same time I was streaming from my Apple TV in the same ssid. Both worked.
Then I logged in with my iPad, which also only received an ipv4 address, but the iPad has no internet. Browser just says "Safari could not open the page because the server stopped responding".
So now I have 2 devices that can login, macbook and apple tv, both ipv4.
And 2 devices that can connect to ssid, but have no internet. 1 with ipv4 only, 1 with ipv4 & 1 with (local) ipv6 assigned.
On the screenshot it's the Apple TV (Living-Room.lan) and the iPad.
What else could prevent these two devices (iPad & iPhone) from establishing an internet connection? (Both devices can, I can easily log into the unencrypted WIFI and both work normal.)
I haven't really adjusted anything, but here is my complete config:
/etc/config/dhcp
config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv6 'server'
option ra 'server'
option ra_management '1'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
config dhcp 'wg1_vpn'
option start '100'
option leasetime '12h'
option limit '150'
option interface 'wg1_vpn'
/etc/config/firewall
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option network 'lan wg0'
option mtu_fix '1'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option network 'wan wan6 wg1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Remote-SSH-22'
option src 'wan'
option target 'ACCEPT'
option proto 'tcp'
option dest_port '22222'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config rule
option src '*'
option target 'ACCEPT'
option proto 'udp'
option dest_port '1234'
option name 'Allow-Wireguard-Inbound'
config zone
option input 'REJECT'
option forward 'REJECT'
option name 'wg1_vpn'
option output 'ACCEPT'
option network 'wg1_vpn'
option mtu_fix '1'
config forwarding
option dest 'wan'
option src 'wg1_vpn'
config rule
option src_port '68'
option src 'wg1_vpn'
option name 'Allow-Wg1VPN-DHCPv4-Input'
option family 'ipv4'
option target 'ACCEPT'
option dest_port '67'
list proto 'udp'
/etc/config/network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd59:1d89:daaf::/48'
config interface 'lan'
option type 'bridge'
option ifname 'eth0.1'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
list dns '1.1.1.1'
list dns '1.0.0.1'
config interface 'wan'
option ifname 'eth1.2'
option proto 'pppoe'
option password 'xxx'
option ipv6 'auto'
option username 'xxxx'
list dns '1.1.1.1'
list dns '1.0.0.1'
option peerdns '0'
config interface 'wan6'
option ifname 'eth1.2'
option proto 'dhcpv6'
list dns '1.1.1.1'
list dns '1.0.0.1'
option reqprefix 'auto'
option reqaddress 'try'
option peerdns '0'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0 1 2 3 5t'
option vid '1'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '4 6t'
option vid '2'
config interface 'wg0'
option proto 'wireguard'
option private_key 'xxx+EKsfHQ5ipq5jlyS1gyzSgFBX/r1Y='
option listen_port '1234'
list addresses '10.20.20.1/24'
option mtu '1420'
option delegate '0'
config wireguard_wg0
option public_key 'xxxxx/qkugLhdtM5ITr+YjYCVw7NhszjHwk='
option description 'Macbook'
option persistent_keepalive '25'
list allowed_ips '10.20.20.2/32'
option route_allowed_ips '1'
config wireguard_wg0
option public_key 'xxxx/qNlkMepqTzlgsY88XYWQ8='
option description 'iPhone'
option persistent_keepalive '25'
list allowed_ips '10.20.20.3/32'
option route_allowed_ips '1'
config interface 'wg1'
option proto 'wireguard'
list addresses 'xxxx.146.92/32'
option private_key 'xxxxxxx='
option delegate '0'
option ip4table '100'
option ip6table '100'
option mtu '1420'
config wireguard_wg1
option public_key 'xxxxxxx/czDeuTNgBOoqTysE6ZAXaQPU7DGgg='
option description 'Dxxxxx'
option persistent_keepalive '25'
option endpoint_port '1194'
list allowed_ips '0.0.0.0/0'
option preshared_key 'fL+xxxxx/o6wCwUixWUXLeMSU9sLo='
option endpoint_host 'xxxx.146.149'
option route_allowed_ips '1'
config interface 'wg1_vpn'
option proto 'static'
option ipaddr '192.168.2.1'
option netmask '255.255.255.0'
list dns '1.1.1.1'
list dns '1.0.0.1'
option delegate '0'
option force_link '0'
option mtu '1420'
config rule 'wgrule'
option in 'wg1_vpn'
option lookup '100'
@vgaetera ah I see, that makes sense.
I ran the UCI commands, but no change so far.
root@OpenWrt:~# ip rule show
0: from all lookup local
1: from all iif wlan0-1 lookup 100
10000: from 100.66.146.92 lookup 100
20000: from all to 100.66.146.92 lookup 100
32766: from all lookup main
32767: from all lookup default
90040: from all iif lo lookup 100
root@OpenWrt:~#
IPv6 rules are also listed separately:
ip -6 rule show
@vgaetera lol, that makes so much sense, I didn't even think of that haha.
Alright, here we go:
root@OpenWrt:~# ip -6 rule show
0: from all lookup local
1: from all iif wlan0-1 lookup 100
32766: from all lookup main
90050: from all iif lo lookup 100
4200000000: from 2003:fc:8f0c:a400::1/60 iif br-lan unreachable
4200000001: from all iif lo failed_policy
4200000044: from all iif br-lan failed_policy
4200000048: from all iif wg0 failed_policy
4200000049: from all iif pppoe-wan failed_policy
4200000049: from all iif pppoe-wan failed_policy
4200000050: from all iif wg1 failed_policy
4200000053: from all iif wlan0-1 failed_policy
root@OpenWrt:~#
I'm unsure what this means tbh.
Also, like I said, the iPad does not have an ipv6 assigned on the vpn ssid. Still it has no internet.
It's weird. The other devices work without issues
Hmmm, do I need to set option ipv6 'auto' on WG1_VPN maybe? So that it spawns a virtual ipv6 interface?
There is something i'm missing haha. Phone & iPad can connect to standard wifi, just not the vpn wifi.
Those two devices can also connect to the Wireguard tunnel through the Wireguard iOS app.
Lots of moving parts here.
What does this mean exactly?
Because u cant track UDP connections, its not guaranteed that internal devices that are "told to" use wireguard_interface_x doesnt necessarily do?
how do you mean easier?
No need to add extra routes, which may even use a dynamic default gateway in general case.
You can create route rules depending on port number, list of IPs. In UDP you can not use port numbers, you can use only list of IPs.
This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.