Wireguard + web hosting hell

nPHYN1T3 · May 4, 2026, 7:52pm

I have been slamming my head on various Wireguard problems now for weeks. I have most sorted out but one is too messy and surely there is a better way.

I host websites, I also have wireguard setup for family and remote work tasks. wireguard clients are not passing web traffic, they are set to AllowedIPs=10.0.0.0/8 (not the LAN class addresses). If a client tries to load one of the webpages it immediately says no connection. From the client I can ping the domain (correct public IP returned/associated), dig returns the correct info, tracepath returns correct. ip route shows the request going through the correct interface, i.e. NOT the wireguard interface...page won't load. Disable the VPN, sites load fine. I can not for the life of me find anything that works or even why this logically fails.

The only "fix" I've found is on the clients where you can edit the hosts file (so mobile clients are screwed) to associate the domains with wireguard class addresses so those requests are sent over wireguard then an openwrt forward rule forwards to the correct LAN address. This means if they disable the VPN the domains are now broken. This just feels wrong, broken...what am I missing here?

frollic · May 4, 2026, 7:59pm

Use DNS to resolve FQDNs with local address instead of public ?

nPHYN1T3 · May 4, 2026, 8:00pm

Say what now? If I get what you are saying this would mean I'd need wiregaurd clients to use local (server side) DNS which is a whole other problem.

psherman · May 4, 2026, 8:01pm

let's take a look at your OpenWrt config...

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):

Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/firewall

frollic · May 4, 2026, 8:03pm

Its one way of solving it.

And you only need to resolve those FQDNs locally.

nPHYN1T3 · May 4, 2026, 8:04pm

{
	"kernel": "6.12.74",
	"hostname": "OpenWrt",
	"system": "MediaTek MT7621 ver:1 eco:4",
	"model": "TP-Link Archer AX23 v1",
	"board_name": "tplink,archer-ax23-v1",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "25.12.2",
		"firmware_url": "https://downloads.openwrt.org/",
		"revision": "r32802-f505120278",
		"target": "ramips/mt7621",
		"description": "OpenWrt 25.12.2 r32802-f505120278",
		"builddate": "1774469393"
	}
}

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd73:82ca:ebd3::/48'
	option packet_steering '1'
	option dhcp_default_duid '0004b74b583a0508424ca728f6eae600e748'
	option multipath '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'
	option ipv6 '0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.0.8'
	option netmask '255.255.255.0'
	option delegate '0'
	list dns '192.168.0.82'
	option multipath 'off'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'
	option peerdns '0'
	option delegate '0'
	option multipath 'off'

config device
	option name 'wan'
	option macaddr ''

config interface 'wg_vpn'
	option proto 'wireguard'
	option private_key ''
	option listen_port '51820'
	list addresses '10.0.0.1/24'
	option mtu '1280'

config wireguard_wg_vpn
	option public_key ''
	option preshared_key ''
	option description 'tlx'
	list allowed_ips '10.0.0.2/32'
	option route_allowed_ips '1'
	option persistent_keepalive '25'

config wireguard_wg_vpn
	option public_key ''
	option preshared_key ''
	option description 'shannicell'
	list allowed_ips '10.0.0.3/32'
	option route_allowed_ips '1'
	option persistent_keepalive '25'

config wireguard_wg_vpn
	option public_key ''
	option preshared_key ''
	option description 'dellap2'
	list allowed_ips '10.0.0.4/32'
	option route_allowed_ips '1'
	option persistent_keepalive '25'

config wireguard_wg_vpn
	option public_key ''
	option preshared_key ''
	option description 'oreonacer'
	list allowed_ips '10.0.0.5/32'
	option route_allowed_ips '1'
	option persistent_keepalive '25'

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option flow_offloading '1'
	option flow_offloading_hw '1'
	option synflood_protect '1'
	option drop_invalid '1'

config zone 'lan'
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list device 'tun+'
	list network 'lan'
	list network 'wg_vpn'

config zone 'wan'
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'http'
	option src 'wan'
	option dest_ip '192.168.0.80'
	option dest_port '80'
	option src_dport '80'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'https'
	option src 'wan'
	option src_dport '443'
	option dest_ip '192.168.0.80'
	option dest_port '443'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'smtp'
	option src 'wan'
	option src_dport '25'
	option dest_ip '192.168.0.80'
	option dest_port '25'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'XMPP'
	option family 'ipv4'
	option src 'wan'
	option src_dport '5222'
	option dest_ip '192.168.0.82'
	option dest_port '5222'

config rule 'wg_rule_vpn'
	option name 'Allow-WireGuard-vpn-wan'
	option src 'wan'
	option dest_port '51820'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'WGVPN'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'wg_vpn'
	option mtu_fix '1'
	option masq '1'

config forwarding
	option src 'WGVPN'
	option dest 'lan'

config forwarding
	option src 'lan'
	option dest 'WGVPN'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'WGSMB'
	option family 'ipv4'
	option src 'WGVPN'
	option src_dport '445'
	option dest_ip '192.168.0.80'
	option dest_port '445'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'WGW3SSL'
	option family 'ipv4'
	option src 'WGVPN'
	option src_dport '443'
	option dest_ip '192.168.0.80'
	option dest_port '443'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'WGW3'
	option src 'WGVPN'
	option src_dport '80'
	option dest_ip '192.168.0.80'
	option dest_port '80'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'WGNFS'
	option family 'ipv4'
	option src 'WGVPN'
	option src_dport '2049'
	option dest_ip '192.168.0.80'
	option dest_port '2049'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'WG2DNS'
	option src 'WGVPN'
	option src_dport '53'
	option dest_ip '192.168.0.82'
	option dest_port '53'
	option family 'ipv4'
	option enabled '0'

Nofoxgiven · May 4, 2026, 8:09pm

If its Interal URL DNS resolving then use the following:
Go to NETWORK > DNS > GENERAL SETTINGS: Here there is an options Called "Addresses" you can add an address using the following template non-VPN "/mywedsite.lan/192.168.1.10", W/ VPN "/mywebsite.lan/10.0.0.10" i usually create both.
THEN go to NETWORK > DNS > DNS RECORDS > Hostnames and add the host name there.

However, access externally would need some attribution to the either the wiregaurd or the internal DHCP.

nPHYN1T3 · May 4, 2026, 8:11pm

I'm not sure I follow this, it seems like steps IF wireguard clients were tunneling web traffic but they aren't (or they shouldn't be). Clients should be sending web requests via their local DNS etc i.e. they should resolve everything fine with my public IP and public TLD records. I mean for any other website this is exactly what happens.

psherman · May 4, 2026, 8:15pm

How is this device connected to the upstream network? Is it via a lan port or the wan? And what is upstream (is it another router, or a direct connection to the internet)?

You have at least one issue in the firewall -- a newtork can only be in a single zone... here you have the wg_vpn in two zones.

Remove wg_vpn from the lan zone:

Turn off masquerading in the WGVPN zone:

These are all unnecessary -- delete them:

nPHYN1T3:

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'WGSMB'
	option family 'ipv4'
	option src 'WGVPN'
	option src_dport '445'
	option dest_ip '192.168.0.80'
	option dest_port '445'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'WGW3SSL'
	option family 'ipv4'
	option src 'WGVPN'
	option src_dport '443'
	option dest_ip '192.168.0.80'
	option dest_port '443'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'WGW3'
	option src 'WGVPN'
	option src_dport '80'
	option dest_ip '192.168.0.80'
	option dest_port '80'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'WGNFS'
	option family 'ipv4'
	option src 'WGVPN'
	option src_dport '2049'
	option dest_ip '192.168.0.80'
	option dest_port '2049'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'WG2DNS'
	option src 'WGVPN'
	option src_dport '53'
	option dest_ip '192.168.0.82'
	option dest_port '53'
	option family 'ipv4'
	option enabled '0'

Reboot and test again.

nPHYN1T3 · May 4, 2026, 8:22pm

The OpenWRT Router is connected WAN side to the ISP modem.

So then why does the UI allow this? seriously though, I know some of this will be "MESS." As I've said I've been banging my head on this for weeks and some of this will be trial and error cruft from throwing $h1t at the wall to see what sticks. I've deleted the WGVPN which also deleted the wg_vpn in the lan => wan zone...yay.

That said...

This is the only way I found I can connect back to clients via ssh, if I disable this I'm no longer able to help my daughter with her machine. (Unless the next few things fix this...I need some time to read/apply/test.)

Again without them nothing worked. Trust me I saw them as BS too, I thought Wireguard should be translating this, I mean wtf is the point if it doesn't but it didn't work.

I'll clean things up per your suggestions, I know you know what you're talking about and you've helped me many times so give me a bit to make changes and see what's broken now. Yup locked out.

psherman · May 4, 2026, 8:26pm

Where is your daughter's computer? (is it connected to the OpenWrt router on 192.168.0.0/24, or is it connected to the upstream)?

What OS is your daughter's computer running?

It's not "wireguard translating this" -- it's the firewall. You already have a forward already defined... you don't need any other rules, and even if you did, they would be traffic rules, not port forwards/redirects.

nPHYN1T3 · May 4, 2026, 8:32pm

She is in another city so WAY upstream.

She's running Arch.

Well it's all borked now. Removing the wg_vpn from the one zone nuked the whole deal.

psherman · May 4, 2026, 8:35pm

let's see the config as it stands now.

nPHYN1T3 · May 4, 2026, 8:35pm

Which one the firewall?

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option flow_offloading '1'
	option flow_offloading_hw '1'
	option synflood_protect '1'
	option drop_invalid '1'

config zone 'lan'
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list device 'tun+'
	list network 'lan'
	list network 'wg_vpn'

config zone 'wan'
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'http'
	option src 'wan'
	option dest_ip '192.168.0.80'
	option dest_port '80'
	option src_dport '80'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'https'
	option src 'wan'
	option src_dport '443'
	option dest_ip '192.168.0.80'
	option dest_port '443'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'smtp'
	option src 'wan'
	option src_dport '25'
	option dest_ip '192.168.0.80'
	option dest_port '25'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'XMPP'
	option family 'ipv4'
	option src 'wan'
	option src_dport '5222'
	option dest_ip '192.168.0.82'
	option dest_port '5222'

config rule 'wg_rule_vpn'
	option name 'Allow-WireGuard-vpn-wan'
	option src 'wan'
	option dest_port '51820'
	option proto 'udp'
	option target 'ACCEPT'

Nofoxgiven · May 4, 2026, 8:37pm

Ah my mistake, i use wiregaurd to access my own internal set of tools so it does tunnel through my VPN network. i have adguard enryption (Acme) enabled so the external clients can still quires the internal sites im hosting; despite not accessing my Ubound recursive DNS.

psherman · May 4, 2026, 8:39pm

It looks like you took a slightly different path than I had recommended, but what I see in the firewall should be fine.

You are unable to reach your daughter's computer now?

nPHYN1T3 · May 4, 2026, 8:40pm

Yes I'm locked out. I can't ask her to check if NFS/Samba is still accessible because she's at work or school. As for a different route, I only deleted the second zone you said wg_vpn wasn't allowed to be in. It then removed it from the original zone too.

psherman · May 4, 2026, 8:42pm

How did you normally access her computer? What tools/methods do you use?

Is Wireguard running on her computer, on her router, or on some other device on her network?

nPHYN1T3 · May 4, 2026, 8:42pm

ssh

her computer

Comically I just had a thought, why not try to ssh from openwrt...worked...but this isn't a solution.

psherman · May 4, 2026, 8:43pm

let's see if you still have a handshake with her computer...

wg show

Please indicate which peer is the system in question.