In my quest for a more elaborate configuration, I am putting in place for the very first time a simple Wireguard setup: client accessing lan + internet from the wg server. The server is running on an openwrt router behind the ISP router (with no provision to configure custom routes). In the current state of things, the client connects to the server but can't ping anything. In spite of trying to apply what I read in these articles:
[WireGuard server on secondary router]
https://forum.openwrt.org/t/wireguard-server-no-acesss-the-local-network-internet/142566
I can't seem to find the culprit. I am using a working parallel openvpn server to access my home router since I am currently at a remote location. I my config I transfered the WG network to the existing VPN firewall zone which should have the same requirement.
Here are the pertinent parts (IMHO) of the configration. Main router: 192.168.111.1 with dhcp
openwrt router: 192.168.111.2.
config interface 'lan'
option device 'br-lan'
option proto 'dhcp'
option delegate '0'
config interface 'lan6'
option proto 'dhcpv6'
option device '@lan'
option reqaddress 'try'
option reqprefix '65'
option ip6assign '65'
config interface 'vpn'
option proto 'none'
option device 'tun0'
config device
option name 'eth0'
option promisc '0'
config interface 'WG2TO'
option proto 'wireguard'
option private_key 'prikeyprikeyprikeyprikeyprikeyprikeyprikey'
option listen_port '51820'
list addresses '10.0.0.1/24'
list dns '192.168.111.1'
config wireguard_WG2TO
option description 'Peer A'
option public_key 'pubkeypubkeypubkeypubkeypubkeypubkeypubkey'
option private_key 'prikeyprikeyprikeyprikeyprikeyprikeyprikey'
option preshared_key 'pskeypskeypskeypskeypskeypskeypskeypskey'
option route_allowed_ips '1'
option endpoint_host 'myhost.net'
option endpoint_port '12345'
list allowed_ips '10.0.0.2/32'
config dhcp 'lan'
option interface 'lan'
option ignore '1'
config dhcp 'lan6'
option interface 'lan6'
option ignore '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option masq '1'
option masq6 '1'
list network 'lan'
list network 'lan6'
config zone
option name 'vpn'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'vpn'
list network 'WG2TO'
config forwarding
option src 'vpn'
option dest 'lan'
config forwarding
option src 'lan'
option dest 'vpn'
and client config:
[Interface]
PrivateKey = prikeyprikeyprikeyprikeyprikeyprikey
Address = 10.0.0.2/32
ListenPort = 12345
DNS = 192.168.111.2
[Peer]
PublicKey = pubkeypubkeypubkeypubkeypubkeypubkeypubkeypubkey=
PresharedKey = pskeypskeypskeypskeypskeypskeypskeypskeypskey=
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = 192.168.111.2:51820
# PersistentKeepAlive not defined