Wireguard VPN no longer working

[Fastlane]

Bonjour everyone,

How are you all doing today?
Thanks for taking the time out to read my thread.

Specs:

|Hostname|OpenWrt|

|Model|GL.iNet GL-MT1300
|Architecture|MediaTek MT7621 ver:1 eco:3|
|Target Platform|ramips/mt7621|
|Firmware Version|OpenWrt 22.03.3 r20028-43d71ad93e / LuCI openwrt-22.03 branchgit-22.361.69894-438c598|
|Kernel Version|5.10.161|

Everything was working fine after getting help from psherman on this thread

Then suddenly it just... didnt work. Connected but no internet. Ive got the killswitch set to reject in my firewall settings so I dont get internet connectivity if a vpn isnt connecting.

Config file:

cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option packet_steering '1'
        option ula_prefix 'fd5a:00e0:b9a0::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'
        option peerdns '0'
        list dns '1.1.1.1'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config interface 'NWV23'
        option proto 'dhcp'
        option peerdns '0'
        list dns '1.1.1.1'

config interface 'FREEDOM1'
        option proto 'wireguard'
        option private_key 'redcated
        option listen_port '
        list addresses '
        option peerdns '0'
        list dns '

config wireguard_FREEDOM1
        option public_key redacted
        list allowed_ips '0.0.0.0/0'
        option persistent_keepalive '25'
        option endpoint_host '
        option endpoint_port 
        option description 'Home FL'
        option route_allowed_ips '1'

config interface 'NWV23G'
        option proto 'none'

cat /etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'
        list network 'NWV23'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'VPN1'
        option output 'ACCEPT'
        option forward 'REJECT'
        option input 'REJECT'
        option masq '1'
        list network 'FREEDOM1'

config forwarding
        option src 'lan'
        option dest 'VPN1'

What it might be:
Nothing changed when it stopped working. My VPN is active and paid. I did delete something in the network wireless setting(I think it was the 5G client) but that was after.

Or this router just sucks. I upgraded from gl.inet vanilla firmware to openwrt vanilla because I was having issues. Im really close to just buying a different router. But would love to solve this. Thanks

Any help would be appreciated.
Merci!

[psherman]

Check the time on the router... is it accurate? If the time is out of sync, WG will not be able to establish a connection, but it creates a chicken-or-egg because WG takes over the default route.

What is the output of:

date
wg show

[Fastlane]

@psherman

Hey how are you Peter, appreciate you helping again.
The date is wrong!

Thu Feb  9 07:58:25 UTC 2023

root@OpenWrt:~# wg show
interface: FREEDOM1
  public key: duDQb3nGAR5RJ31SOtKtxiiXXW4o8ylnqf0rU54T6G0=
  private key: (hidden)
  listening port: redact

peer: bZPUlxtmXeHwbpU25g3oWQSu9ffJkmAjwz7QjwnxVAA=
  endpoint: ip redacted
  allowed ips: 0.0.0.0/0
  transfer: 0 B received, 7.04 MiB sent
  persistent keepalive: every 25 seconds

I still need help. But I will try to figure out how to change it.
Its like 19 days off.

[Fastlane]

Wow that was it. I just had to click 'Sync with Browser' and it works now.

Why did that happen and how can I prevent that from happening again?
I dont mind just clicking Sync with Browser in system settings but Id like it to work normally.

Also when I clicked Sync with NTP it didnt do anything.
Thanks again @psherman Pusherman!
Thank you very very much.

[psherman]

Initiate wireguard after NTP success

OpenWRT forums RIP, not sure where to post a feature request/bug for the next LEDE / Wireguard release. Most of our consumer/entry LEDE routers do not have a battery keeping date/time. The current NTP client method in LEDE is prohibitive of correct and reliable wireguard working. Since Wireguard is highly dependent on correct date/time, please make sure: The NTP client is redesigned to load at the very beginning of LEDE bootup, before all else. The NTP client is redesigned to not bug as desc…

[psherman]

@Fastlane

Also when I clicked Sync with NTP it didnt do anything.

This didn't work because you first need to stop the WG interface.... once that is done, that button should work, and then you can restart the WG tunnel.