WWAN0 through wireguard tunnel

I can only connect through my wireguard server when hooked up to LAN and not when connected only with WWAN0 (LTE)

I have a wireguard conf working when connected to LAN (with another dhcpserver)

config interface 'logger_wg'
        option proto 'wireguard'
        option private_key 'XXX'
        list addresses '10.8.0.3/24'

config wireguard_logger_wg 'wgserver'
        option public_key 'XXX'
        option endpoint_host 'XXX
        option endpoint_port '51820'
        option route_allowed_ips '1'
        option persistent_keepalive '25'
        list allowed_ips '10.8.0.0/24'

I also have WWAN0 working connecting to the internet (can ping internet hosts) but I cannot reach my wireguard other wireguardpeer

wwan0     Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:100.X.X.X  P-t-P:100.X.X.X  Mask:255.255.255.248
          inet6 addr: fe80::b326:25e6:5dd3:8d70/64 Scope:Link
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:4102 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3643 errors:0 dropped:0 overruns:0 carrier:0

logger_wg Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.3  P-t-P:10.8.0.3  Mask:255.255.255.0
          UP POINTOPOINT RUNNING NOARP  MTU:1420  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:234 errors:1 dropped:265 overruns:0 carrier:0

root@iron:~# ping 10.8.0.1
PING 10.8.0.1 (10.8.0.1): 56 data bytes
^C
--- 10.8.0.1 ping statistics ---
16 packets transmitted, 0 packets received, 100% packet loss

root@iron:~# ping -I logger_wg 10.8.0.1
PING 10.8.0.1 (10.8.0.1): 56 data bytes
^C
--- 10.8.0.1 ping statistics ---
4 packets transmitted, 0 packets received, 100% packet loss

I dont want all traffic to go through the wireguard connection.

How can I route the traffic to allow destined traffic to 10.8.0.0/24 network to go through when connected only through the WWAN link?

What type of connection does your “server” have to the internet? Is it also LTE? Or is it cable/dsl/fiber?

The peer I wanna reach is a VULTR VPS, I suppose fiber..

Do you have normal connectivity on the “client” system when the wg tunnel is not running?

The WG connection works fine when I connect a LAN-cable from my home network to the LTE device. Then I can ping 10.8.0.1 and reach services on the VPS.

To me it seems like a routing issue where the WWAN0 cannot reach that 10.8.0.0/24 but I'm uncertain how to set it up too. I could also be completely wrong.

I can still reach the internet as well when the WWAN0 and WG-tunnel is up like pinging 1.1.1.1 works fine.

Let’s look at your config files

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/network
cat /etc/config/firewall
root@openwrt:~# cat /etc/config/network
config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd54:d957:b85e::/48'

config interface 'wan'
        option device 'eth1'
        option proto 'dhcp'

config interface 'wan6'
        option device 'eth1'
        option proto 'dhcpv6'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.1.214'
        option metric '100'
        option gateway '192.168.1.1'
        list dns '9.9.9.9'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '2 3 4 0t'

config interface 'logger_wg'
        option proto 'wireguard'
        option private_key 'XXXX'
        list addresses '10.8.0.3/24'

config wireguard_logger_wg 'wgserver'
        option public_key 'XXX'
        option endpoint_host 'XXX'
        option endpoint_port '51820'
        option route_allowed_ips '1'
        option persistent_keepalive '25'
        list allowed_ips '10.8.0.0/24'

config interface 'wwan0'
        option proto 'qmi'
        option device '/dev/cdc-wdm0'
        option ifname 'wwan0'
        option auth 'none'
        option pdptype 'ipv4v6'

config device
        option name 'logger_wg'


root@openwrt:~# cat /etc/config/firewall
config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option synflood_protect '1'
        option forward 'DROP'

config zone 'lan'
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'

config zone 'wan'
        option name 'wan'
        option output 'ACCEPT'
        option masq '1'
        option mtu_fix '1'
        option network 'wan wan6 logger_wg wwan0'
        option input 'DROP'
        option forward 'DROP'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config include
        option path '/etc/firewall.user'

config rule
        option target 'ACCEPT'
        option name 'wg'
        option family 'ipv4'
        list src_ip '10.8.0.1'
        option dest_port '9100'
        option src 'wan'
´´´


EDIT: Also adding this after googling a bit more

root@openwrt:~# ip route
default via 100.86.X.X dev wwan0 
VPS.IP.X.X via 192.168.1.1 dev br-lan  metric 100
100.86.X.X/29 dev wwan0 scope link  src 100.86.X.X
192.168.1.0/24 dev br-lan scope link  metric 100

Thanks for looking into this!

Try removing the gateway from the LAN interface.

This should not be necessary. Remove this rule.

Remove gateway from the LAN interface definition.

Took some while to test this for me.

When I remove the gateway the wireguard interface won't start anymore so I added the gateway back and the wg interface pops right up again.

Seems you found whats wrong, still unsure how I would fix it

Is there a reason you are connecting LAN-LAN between this and the upstream router? If your ultimate goal is to be able to use the LTE WAN, the best option is to connect the upstream network as a WAN connection, not LAN. Then you can remove the LAN's gateway address and it should work properly.

Thanks for sticking around still!

The idea of using LAN-LAN is only for configuration reasons, I have no other idea of how I would do it without.

The final idea would be:
Use eth-wan if available (be a dhcp client)
Use LTE WAN if ETH-WAN not available
Being able reach a wireguard peer on any connection type

Make your ethernet connection a WAN connection and then connect your computer to the this device's LAN for local for administration.