But when I loose connection, I can see that the openwrt router has reboot, and some how, instead appear the ip of the ddns, appears the ip that is given to the router that I am behind like this
sounds like you might have a ddns update conflict. The DDNS client should only update from the device that is acting as the 'server' and it should be updating against its actual wan IP.
Where is the DDNS client running? Have you verified that it is the only client and that it is properly configured?
the first sreenshot, it's the real ip of the ddns (wireguard server) that I don't control. However, when appears the local ip, I try to ping the ddns and give me the real ip, not my local ip of 10.10.10.150...
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/firewall
wg show
The address you referenced earlier 10.10.10.150 does not appear anywhere in your configurations (nor does anything that subnet). Was that one made up, or is that an address that actually displays in the endpoint field?
Also, is the remote endpoint actively establishing a connection to your device (i.e. is your device listening for inbound connections from the remote side), or are you exclusively initiating the connection to the remote peer?
the 10.10.10.150 is the ip given from the router that it’s on the front of my router
The weird thing, it’s why appears on the place of the ip of wgpeter****.duckdns.org ?!?!?!?
I don’t control the wireguard server… but when appears the correct real ip of wgpeter*****.duckdns.org everything works, but I need to do a lot of reboots until appears.
If you're just connecting as a client peer to a remote server (unless I misunderstood the whole thread), what is this rule for? What is listening on 10.93.21.6? Isn't the peer on the same device?
And in that case you don't need option listen_port '31231'.
Also a network diagram with IPs and ranges would help.
Your screenshots are difficult to interpret and are having the opposite effect from what you intend them to.
Well, something is causing WireGuard to re-resolve a host, WireGuard is well known not to do that on its own. Are you running PBR (I'm having a déjà-lu)?
it's a simple unifi security gateway that I have upload openwrt just to plug a printer and connect to a wireguard tunnel, so I can print remotely... nothing more
You say you do not control the server but the VPN traffic is not Masqueraded:
that can only work if the server side knows your subnet and has that as Allowed IPs
A typical client has option input 'REJECT' if you trust the other side then no problem.
A typical client has no listen port and also does not open up a port, so what is the ratio behind this?
Or is it actually a site-to-site setup where the other side also can initiate a connection?
Maybe it is not related to your problem but ti is an atypical setup for a simple client
If the endpoint is wrong did you check that the DDNS actual resolves to the correct address?
You really need to start addressing the questions from all of the above posts, if you expect actionable advice. Otherwise we're going in circles with you rebooting the router and seeing random IP changes.
wg set WG0 peer ZHoTEYkc************************RaVyM= endpoint wgpeter******.duckdns.org:31231
ifdown WG0
ifup WG0
root@USG3p:~# wg show
interface: WG0
public key: SCLSvu8/oYhz7Sh********************X9kfDWrTFk=
private key: (hidden)
listening port: 31231
peer: ZHoTEYkc*****************VbEuctRaVyM=
endpoint: 9*.***.***.191:31231
allowed ips: 10.93.21.0/24, 10.57.78.0/24
transfer: 0 B received, 148 B sent
persistent keepalive: every 25 seconds
but after a few seconds come again the local wan ip
root@USG3p:~# wg show
interface: WG0
public key: SCLS*********************fDWrTFk=
private key: (hidden)
listening port: 31231
peer: ZHoTE************************tRaVyM=
endpoint: 10.10.10.115:31231
allowed ips: 10.93.21.0/24, 10.57.78.0/24
transfer: 2.17 KiB received, 2.21 KiB sent
persistent keepalive: every 25 seconds
Again, that's curious because it can not happen on its own. WireGuard, once it resolves a peer's host, hangs on to that IP for better or worse. Something on your system is prodding WireGuard, and it seems in a wrong way.
Did you set up that system from scratch using an image downloaded from openwrt.org proper, or did you install a preconfigured image from somewhere else?
was a plain image downloaded from image firmware selector of openwrt.org
I just create WG interface add peer and use the credentials of the wireguard server I want to connect to... just a tweak on firewall to allow connectiofrom subnet and nothing more
