I have been using OpenVPN for accessing my internal network (behind OpenWRT router) for many years. Now I bought new router and decided to test WireGurad, that I heard so many good things about.
What I would like to achieve is to be able to flip VPN switch and have my mobile behave as being inside my 192.168.1.x LAN. It should be able to ping other devices on that subnet and surf the internet using my router on 192.168.1.1 as gateway
I used this FAQ to set up Wireguard server on my router and create 4 named peers:
I converted 1_lan_Alpha.conf file to QR, imported it into my Wireguard client on my iphone, changed Wireguard endpoint to IP of my router WAN and connected.
I can see in Status -> WireGuard -> Peers -> 1_lan_Alpha that I have connection (there are bytes flowing in/out) but I cannot ping anything from the phone. Not even 10.5.0.1 which should be WG interface.
This is content of 1_lan_Alpha.conf file used by "client" (=my mobile):
I'm pretty sure this is not the right way to do it but I use this method and it works fairly well:
So my usecase is pretty similar to yours, I too want to access my LAN devices as well as the WAN network through a phone(client).
So I created a new firewall zone called "WireGuard", and then added the wireguard interface to this zone.
config zone
option name 'WireGuard'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'wg_home'
My interface is wg_home.
Then I added 4 firewall rules like this:
config rule
option target 'ACCEPT'
option src 'WireGuard'
list proto 'all'
option dest 'lan'
option name 'WgToLan'
config rule
option target 'ACCEPT'
option src 'lan'
list proto 'all'
option dest 'WireGuard'
option name 'LanToWg'
config rule
option target 'ACCEPT'
option src 'wan'
list proto 'all'
option dest 'WireGuard'
option name 'WanToWg'
config rule
option target 'ACCEPT'
option src 'WireGuard'
list proto 'all'
option dest 'wan'
option name 'WgToWan'
All this goes into /etc/config/firewall
Instead of using the firewall rules you can just allow forwarding from zones to zones, but I prefer to use the rules.
That should be it for the firewall rules, once you restart everything it should work as expected, your LAN clients should be accessible through the wireguard interface and you should also be able to access the WAN network through the wireguard interface (on the client).
let's see the text configs that you've got on your router right now:
Please copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
Client is on LAN behind a OpenWRT router with true external IP on WAN (not CGNAT).
New router (that is being tested and hosts WireGuard server) has it WAN on same switch as client router. But it got some wonky WAN IP adress (CGNAT?) from ISP DHCP.
Once I hard-coded the server router WAN IP with "fake" IP I could ping it from client LAN. Once tunnel was established I was able to communicate from my 192.168.0.x "client" LAN to 192.168.1.x "server" LAN.
Basically, this is hard to test without having two dedicated "true" external IP's and I only had one.
Anyway, I did some iperf3 testing and speed is fantastic compared to my old OpenVPN link. I got 380Mbit/sec iperf3 throughput through WireGuard tunnel. On a friggin phone using WiFi!
irqbalance was balancing and cores never went above 30%....and this is with SQM shaping on the top of it!
