Wireguard Site to Site (simulated internet)

I have an almost working site to site setup as described in the diagram. All that is missing is ability to ping between devices in the opposite LAN in either direction. If PC A tries to ping PC B then the ping reply from WG B (10.10.10.2) is destination port unreachable. This is the same the other way. PC A is able to ping router B and the Wireguard handshake is fine so I suspect it is more network related than VPN setup.

Things I have tried are, switching off the windows firewall on both PC's. I tried setting VPN and WAN forward rules to accept. Adding WAN IP's and gateway IP's as DNS (guess work). I don't see any error message with logread after pinging from the openwrt router either.

I am not hugely experienced. This is an attempt to setup a lab environment to learn from and so mistakes may have been made. I will list the network and firewall config of each router below starting with Site A

Site A NETWORK

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdbc:0962:e53c::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.100.1'
        option netmask '255.255.255.0'
        option force_link '1'

config interface 'wwan'
        option proto 'dhcp'
        option peerdns '0'
        list dns '192.168.3.1'
        list dns '192.168.3.10'
        list dns '192.168.100.1'

config interface 'site_a'
        option proto 'wireguard'
        option private_key 'KEY'
        option listen_port '51820'
        list addresses '10.10.10.1/32'

config wireguard_site_a
        option description 'site_b'
        option public_key 'KEY'
        list allowed_ips '10.10.10.0/24'
        list allowed_ips '192.168.200.0/24'
        option route_allowed_ips '1'
        option endpoint_host '192.168.4.10'
        option endpoint_port '51820'
        option persistent_keepalive '25'

SITE A FIREWALL

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        option log '1'

config zone
        option name 'wan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'
        option mtu_fix '1'
        option log '1'
        list network 'wwan'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'



config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'vpn'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'site_a'
        option log '1'

config forwarding
        option src 'lan'
        option dest 'vpn'

config forwarding
        option src 'vpn'
        option dest 'wan'

config redirect
        option dest 'vpn'
        option target 'DNAT'
        option name 'wg'
        list proto 'udp'
        option src 'wan'
        option src_dport '51820'
        option dest_ip '10.10.10.1/32'
        option dest_port '51820'

SITE B NETWORK

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd60:f850:1402::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.200.1'
        option netmask '255.255.255.0'
        option force_link '1'

config interface 'wwan'
        option proto 'dhcp'
        option peerdns '0'
        list dns '192.168.4.1'
        list dns '192.168.4.10'
        list dns '192.168.200.1'


config interface 'site_b'
        option proto 'wireguard'
        option private_key 'KEY'
        option listen_port '51820'
        list addresses '10.10.10.2/32'

config wireguard_site_b
        option description 'site_a'
        option public_key 'KEY'
        option route_allowed_ips '1'
        option endpoint_host '192.168.3.10'
        option endpoint_port '51820'
        option persistent_keepalive '0'
        list allowed_ips '10.10.10.0/24'
        list allowed_ips '192.168.100.0/24'
        list allowed_ips '192.168.3.0/24'

SITE B FIREWALL

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        option log '1'

config zone
        option name 'wan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'
        option mtu_fix '1'
        option log '1'
        list network 'wwan'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'


config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'vpn'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'site_b'
        option log '1'

config forwarding
        option src 'lan'
        option dest 'vpn'

config forwarding
        option src 'vpn'
        option dest 'wan'

config redirect
        option dest 'vpn'
        option target 'DNAT'
        option name 'wg'
        list proto 'udp'
        option src 'wan'
        option src_dport '51820'
        option dest_ip '10.10.10.2/32'
        option dest_port '51820'

Any help would be appreciated. Guidance on how to diagnose or how to trace the somehow to prove where it gets to. Thank you

Site A and B also allow vpn to lan

Reboot and try again

Note your local lan clients also have their own firewall which by default will not allow non local traffic so you have to tweak the firewall of local lan clients

1 Like

Hi, I have just made progress. I switched the openwrt firewall off on both routers using the command /etc/init.d/firewall stop and it started to working.

I will try your suggestion too when i start the firewalls again. I have already tried switching off the PC firewall in case but I seem to be on the right track

Yes, I have high hopes that if you allow traffic from vpn to lan it will start working

1 Like

Ok more news, I added the firewalls back and included the new firewall command you suggested and both PC's are able to ping across the network. Thank you very much.

One of my PC's still requires the windows firewall to be switched off so I still have some work to do on that firewall. I suppose allow some rule for the remote network range to be allowed?

I should start a new topic if needed. Thank you very much for your help

1 Like

Great to hear you solved it, yes you can allow only the necessary subnet on the firewall something like:
Windows Advanced firewall
Incoming traffic , make a new rule with scope : wg subnet and subnet of other sided and allow these subnets

Alternatively you can enable NAT on the LAN interface, not my favorite choice as you loose logging and access control but it you do a selective NAT of only the WG subnet it is not a big problem if you trust all your users

1 Like

All up and running. Adding the 10.10.10.0/24 and opposite site subnet to the windows firewall was the final step. Thank you again for the great advice.

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.