18
News and discussion for the Wireguard VPN Subreddit: https://www.reddit.com/r/wireguard Powered by : @r_channels & @reddit2telegram
Checking linux service status brings tunnel back up
If I reboot my remote Debian 12 machine it won't reconnect unless I check the service status or restart the wireguard tunnel service. The server is running on pfsense.
​
I've setup the tunnel to start as "wg0@user.service" with systemd, and it does start up the wireguard tunnel, it just won't connect properly. It allows me to ping from the remote PC to the WG gateway (pfsense) but nothing else. After "systemctl status wg0@user.service" it shows the service as active and moments later it works again, not restarting the service just checking it.
​
I had issues with my setup using pfsense as WG server before. I only could ping/ssh into the remote linux client on my phone and truenas, unless I specified the ssh KexAlgorithms. After adjusting the MTU size to 1420 on the server side and to 138X on the client it worked much better.
​
However if I reboot the remote PC running Debian 12 it won't auto reconnect.
​
Any hints to why that might happen?
My pfsense does use DynDNS to update my VPN address but changes happen rarely and mostly at night, which doesn't seem to be an issue so far. I've used Quad9 as DNS server in the client config.
https://redd.it/1aglqxu
@r_wireguard
Exclude/Include android applications while connected to Wireguard server.
Issue
I was having issues accessing LAN. Some applications sometimes working or not working at all while I was connected to ProtonVPN server using official Wireguard app.
The apps I had issues with are KDE connect, Mixplorer, Moonlight, Syncthing.I tried `AllowedIPs=mylanip/24` but some apps still didn't work. I allowed ips in both my desktop and android and the result was same. But if I disconnected from phone I could use those apps without issues. I searched Wireguard settings and there was no option related to inclusion/exclusion.
Even searching online for some reason I didn't found any search result related to it but there was suggestions about `AllowedIPs` and that didn't work for all the apps. Especially moonlight and kde wasn't working at all.
​
Solution
Recently once again I was looking through the app and I found where it was.
I found the setting is in the config file.
All you have to do is for GUI Wireguard app :
1. Open the Wireguard app
2. Then select the config you want to change and click on the Edit (Pen) icon.
3. At the bottom of the Interface section and before Peer section you will get the Include/Exclude (All Application) option.
4. After configuring don't forget to save.
Then I exported all the configs in a zip file and it looks like you can add the apps in the config. Just add this `ExcludedApplications = package1name, package2name`. I found this was added in [Interface\] after DNS.
​
P.S. I posted this just in case if someone else like me is looking for solution.
https://redd.it/1agdxh9
@r_wireguard
Windows 11 General failure issue
Hi,
I have issue on windows 11 client the app connected sucssecfully but when try to ping any thing its tell me that general failure , so i only can ping the p2p address and reach the mikrotik , and please note when i did the same setup on iphone or android phone, everything work fine and no issue found,
So any help !
Thanx in advance
https://redd.it/1agdzmg
@r_wireguard
Point to point connection between hosts with overlapping subnets
Hi wireguarders,
I have access to 2 geographically separated LANs, lets call them
s1 and s2.
One of these LANs (s1) already has a working wireguard peer.
I would like to be able to connect via VPN to a host in the other LAN (s2).
I'm only interested in that host alone.
The issue is that the LANs use the same subnet scheme, the usual 192.168.0.x
While I understand this is frowned upon in Wireguard vpn context, and for good reasons, I'm wondering if my particular restriction to a single host wouldn't still work?
I'm thinking I could set the host I try to reach in s2 as a wg peer with AllowedIPs listing only the wg tunnel IP address for the other wg peer endpoint in LAN s1.
The reason I hesitate to renumber one of the LANs is that I would have to do this remotely, as it would be some time and distance before I could drive there in person.
https://redd.it/1ag99in
@r_wireguard
Which fields should be kept secret from a Wireguard configuration file?
I use Ansible templates for bootstrapping my machines and one template would be dedicated to a Wireguard connection to a VPN provider.
From the Wireguard configuration file, which are the fields that shouldn't be shared with with anyone, in case I decide to push the repository to the public?
https://redd.it/1ag79zl
@r_wireguard
How to solve the "Roadwarrior at Home" problem?
Hi,
I have a simple roadwarrior setup:
laptop (mobile) ---> [VPS (internet, with static IP)] <--- router-at-home (dynamic IP) <-- boxA/B/C-at-home
10.0.0.3 10.0.0.1 10.0.0.2 10.0.0.n
Starlink
Morning there,does someone know if Starlink is stopping to work when wireguard is on?cause I'm having an hard time with it.
Having a remote server openbsd with wireguard server on it and local archlinux client wireguard or Ubuntu client I'm unable to get it to work.
I've viewed a lot of tuts about the settings but no way to solve it
Thank you for any tips
https://redd.it/1afaf3n
@r_wireguard
VPS as a bounce server forwarding to OpenWrt router
Hello,
I know the title is similar to other posts here, but I still didn't manage to make my case work after a few weeks.
I've recently moved to a new place where public IP is not an option. Therefore, I decided to rent a VPS to act as a bounce server.
At home, I'm using OpenWrt router. I'd like to forward all the traffic to it via VPS from my mobile phone when I travel. I'd like to be able to access local services and also internet as if I were home (using home WAN IP).
Currently, both OpenWrt router and mobile phone can connect to the VPS and I'm able to ping between all three on the 192.168.9.0/24 subnet. The IP forwarding is enabled on the VPS (net.ipv4.ip_forward=1).
I suppose the routing on VPS is not correct as it doesn't specify that all the traffic from peers (I'd like to add a few more when I get it to work) should be forwarded to OpenWrt peer. I've played with iptables and ip route to no avail. Additionally, I'm not sure that OpenWrt will know what to do with the incoming traffic when the VPS routing is configured properly but I'm not that far yet.
I'll be grateful for any tip or hint as I've spent days on this already and I feel I'm not getting anywhere. Thank you.
Configs:
VPS
Interface
PrivateKey =
Address = 192.168.9.20/24
ListenPort = 51820
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o wg0 -j MASQUERADE
# openwrt
[Peer]
PublicKey =
AllowedIPs = 192.168.9.1/32
# mobile phone
Peer
PublicKey =
AllowedIPs = 192.168.9.3/32
OpenWrt
config interface 'vpn_client'
option proto 'wireguard'
option private_key ''
list addresses '192.168.9.1/24'
config wireguardvpnclient 'wgserver'
option endpointhost '***'
option endpointport '51820'
option persistentkeepalive '25'
option description 'vps'
option publickey ''
list allowed_ips '192.168.9.0/24'
Mobile phone
[Interface]
PrivateKey =
Address = 192.168.9.3/24
# vps
Peer
PublicKey =
Endpoint =
AllowedIPs = 0.0.0.0/0
​
https://redd.it/1af0gcg
@r_wireguard
connection works but cant access devices remotely
Hi all, recently started working on my server again and have hit a few speed bumps.
​
Hopefully adequate network summary:
Main Lan: 192.168.1.x/24
Openwrt: 192.168.1.40 (DMZ behind ISP router, also hosts wireguard)
Old Openwrt Network: 10.10.0.x/24
Old Wireguard Network: 10.20.0.x/24
New Openwrt Network: 10.10.0.x/25 (gateway at 10.10.0.1)
New Wireguard Network: 10.10.0.x/25 (host at 10.10.0.129)
​
I had my network set up and working using the "old" options listed above. I was able to access web control panels, ssh, and ping from whatever network I was connecting from. I eventually edited my wireguard configs to not route all traffic through the host peer, which caused me to lose access to my devices via vpn. Since things were already broken I figured this was a good time to try out putting vpn devices on a subnet of 10.10.0.x as I would have to remember less numbers or something. I successfully set the network up using the "new" values listed above and there aren't any issues there. If I am on my man lan network(192.168.1.x) , I can connect to Wireguard at 192.168.1.40. Handshake succeeds and I can access my devices. However, if I connect via a remote network, the handshake succeeds and I am unable to access my devices. I am currently routing all traffic through the host again so my configuration is essentially the same as it was originally, just with different ip ranges.
​
Any help is appreciated, thanks!
https://redd.it/1af24z8
@r_wireguard
Peers can connect to VPN server but not between themselves
Hi there,
I'm new into VPN topic and routing in general, and wanted to learn new thinks while setting up wireguard.
As in subject: Peers can connect to VPN server but not between themselves.
Server:
https://preview.redd.it/mkoh06cl5lfc1.png?width=788&format=png&auto=webp&s=0e0c34602668443b67bed647e318888ad67fc530
Peer1:
​
https://preview.redd.it/ecgsbqfk6lfc1.png?width=341&format=png&auto=webp&s=6419db76de384eff0ddd82925241ec1d6b038f59
Peer2:
​
https://preview.redd.it/ayhmv77p6lfc1.png?width=327&format=png&auto=webp&s=ca85dc65b2747f84676ae388abf27471b3d7b38d
​
Attempt to ping Peer1 to Peer2
https://preview.redd.it/okcorh2a7lfc1.png?width=708&format=png&auto=webp&s=6a6f50694ab56b07211e30490a696dcd18329cd7
​
I'm sure that is some kind of trivial issue.
https://redd.it/1aeplnx
@r_wireguard
Port forwarding to PiVPN with WireGuard doesn’t work
Hi!
I have a problem with setting up port forwarding on my Mikrotik devices to RaspberryPi running PiVPN (I also tried with an ASUS router supporting Wireguard and the result was the same).
The Mikrotik network devices have been provided and the initial setup has been done by my ISP. I think I configured everything in line with the info I found in the Internet, but the VPN doesn't work. Additionally the packages counters in RouterOS for both in the rules I setup and NAT are constantly "0", so I assume something is wrong with the Mikrotik config. As a sidenote - I have a static IP.
Any help will be appreciated. According to PiVPN tutorials the goal is to forward traffic incoming to port 51820 to RaspberryPi's (192.168.88.86) port 51820
Please find below the output of the export command.
user@MikroTik > export hide-sensitive
# jan/30/2024 10:33:19 by RouterOS 6.45.9
# software id = IFC3-I6DH
#
# model = RBD52G-5HacD2HnD
# serial number = D7160CCDD84D
/caps-man channel
add band=2ghz-g/n extension-channel=XX frequency=2437 name=2ghz
add band=5ghz-n/ac extension-channel=XXXX frequency=5180 name=5ghz
/interface bridge
add admin-mac=48:8F:5A:F0:49:F3 auto-mac=no comment=defconf name=bridge
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1 name=pppoe-out1 use-peer-dns=yes user=mystreetaddress
/interface wireless
# managed by CAPsMAN
# channel: 2437/20-eC/gn(27dBm), SSID: MyWifiSSID, local forwarding
set find default-name=wlan1 band=2ghz-b/g/n channel-width=20/40mhz-XX disabled=no distance=indoors frequency=auto installation=indoor mode=ap-bridge ssid=MikroTik-F049F7 \
wireless-protocol=802.11
# managed by CAPsMAN
# channel: 5180/20-Ceee/ac/P(20dBm), SSID: MyWifiSSID, local forwarding
set find default-name=wlan2 band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX disabled=no distance=indoors frequency=auto installation=indoor mode=ap-bridge ssid=MikroTik-F049F8 \
wireless-protocol=802.11
/caps-man datapath
add bridge=bridge client-to-client-forwarding=yes local-forwarding=yes name=datapath1
/caps-man security
add authentication-types=wpa-psk,wpa2-psk encryption=aes-ccm group-encryption=aes-ccm group-key-update=1h name=security1
/caps-man configuration
add channel=2ghz datapath=datapath1 datapath.client-to-client-forwarding=yes datapath.local-forwarding=yes mode=ap name=2ghz security=security1 ssid=MyWifiSSID
add channel=5ghz channel.band=5ghz-a/n/ac country=germany datapath=datapath1 datapath.client-to-client-forwarding=yes datapath.local-forwarding=yes mode=ap name=5ghz security=security1 \
ssid=MyWifiSSID
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set find default=yes supplicant-identity=MikroTik
/ip hotspot profile
set find default=yes html-directory=flash/hotspot
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/caps-man manager
set enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled hw-supported-modes=gn master-configuration=2ghz
add action=create-dynamic-enabled hw-supported-modes=an,ac master-configuration=5ghz
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
/interface wireless cap
#
set bridge=bridge caps-man-addresses=192.168.88.1 enabled=yes interfaces=wlan2,wlan1
/ip address
add address=192.168.88.1/24 comment=defconf interface=ether2 network=192.168.88.0
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid interface=ether1
/ip dhcp-server lease
add address=192.168.88.86
Port forwarding to PiVPN with WireGuard doesn’t work
Hi!
I have a problem with setting up port forwarding on my Mikrotik devices to RaspberryPi running PiVPN (I also tried with an ASUS router supporting Wireguard and the result was the same).
The Mikrotik network devices have been provided and the initial setup has been done by my ISP. I think I configured everything in line with the info I found in the Internet, but the VPN doesn't work. Additionally the packages counters in RouterOS for both the rules I setup and NAT are constantly "0", so I assume something is wrong with the Mikrotik config. As a sidenote - I have a static IP.
Any help will be appreciated. According to PiVPN tutorials the goal is to forward traffic incoming to port 51820 to RaspberryPi's (192.168.88.86) port 51820
Please find below the output of the export command from RouterOS:
user@MikroTik > export hide-sensitive
# jan/30/2024 10:33:19 by RouterOS 6.45.9
# software id = IFC3-I6DH
#
# model = RBD52G-5HacD2HnD
# serial number = D7160CCDD84D
/caps-man channel
add band=2ghz-g/n extension-channel=XX frequency=2437 name=2ghz
add band=5ghz-n/ac extension-channel=XXXX frequency=5180 name=5ghz
/interface bridge
add admin-mac=48:8F:5A:F0:49:F3 auto-mac=no comment=defconf name=bridge
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1 name=pppoe-out1 use-peer-dns=yes user=mystreetaddress
/interface wireless
# managed by CAPsMAN
# channel: 2437/20-eC/gn(27dBm), SSID: MyWifiSSID, local forwarding
set find default-name=wlan1 band=2ghz-b/g/n channel-width=20/40mhz-XX disabled=no distance=indoors frequency=auto installation=indoor mode=ap-bridge ssid=MikroTik-F049F7 \
wireless-protocol=802.11
# managed by CAPsMAN
# channel: 5180/20-Ceee/ac/P(20dBm), SSID: MyWifiSSID, local forwarding
set find default-name=wlan2 band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX disabled=no distance=indoors frequency=auto installation=indoor mode=ap-bridge ssid=MikroTik-F049F8 \
wireless-protocol=802.11
/caps-man datapath
add bridge=bridge client-to-client-forwarding=yes local-forwarding=yes name=datapath1
/caps-man security
add authentication-types=wpa-psk,wpa2-psk encryption=aes-ccm group-encryption=aes-ccm group-key-update=1h name=security1
/caps-man configuration
add channel=2ghz datapath=datapath1 datapath.client-to-client-forwarding=yes datapath.local-forwarding=yes mode=ap name=2ghz security=security1 ssid=MyWifiSSID
add channel=5ghz channel.band=5ghz-a/n/ac country=germany datapath=datapath1 datapath.client-to-client-forwarding=yes datapath.local-forwarding=yes mode=ap name=5ghz security=security1 \
ssid=MyWifiSSID
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set find default=yes supplicant-identity=MikroTik
/ip hotspot profile
set find default=yes html-directory=flash/hotspot
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/caps-man manager
set enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled hw-supported-modes=gn master-configuration=2ghz
add action=create-dynamic-enabled hw-supported-modes=an,ac master-configuration=5ghz
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
/interface wireless cap
#
set bridge=bridge caps-man-addresses=192.168.88.1 enabled=yes interfaces=wlan2,wlan1
/ip address
add address=192.168.88.1/24 comment=defconf interface=ether2 network=192.168.88.0
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid interface=ether1
/ip dhcp-server lease
add address=192.168.88.86
Opnsense configuration help
Maybe someone would be willing to help me with this, happy to send a 6 pack to the first post that enables me to solve it?
I’m trying to connect only a few clients to MULLVAD vpn provider through wireguard and I’ve been at it here and there for weeksL). I had previously tried to do this with a different VPN provider and using an openvpn but couldn’t get that working. I’ve followed a bunch of different guides and trying reading between the lines but getting to the point where I’m fed up. Wireguard seems easier than openvpn so I’m going to stick with that.
Been referring to guides and other reddit posts that have similar goals and just relevant information (to list just a few below)
https://forum.opnsense.org/index.php?PHPSESSID=amoj0s9n3tf7hog761djibe6db&topic=21205.0
https://docs.sweeting.me/s/wireguard
https://schnerring.net/blog/opnsense-baseline-guide-with-vpn-guest-and-vlan-support/
https://0x2142.com/how-to-protect-your-home-network-with-mullvad-vpn-opnsense/
Also tried a fair bit of chatgpt troubleshooting but to no avail.
It seems like the mullvad connection is working this time so I think that’s setup correctly.
I think the problem is related to my poor configuration of firewall rules and/or NAT rules but it could also be related to my ATT pass-through setup to the opnsense firewall, or im just way off the mark and its something else entirely.
Topology is
ISP -> home router -> opnsense firewall -> Lab Ubuntu clients
Pic1
📷
https://preview.redd.it/19yyipl3wffc1.png?width=631&format=png&auto=webp&s=8871f196516267f3d6e64ec933df404d6f7d83ad
ISP IP = 107.202.x.x (router is a BG320-500)
Home network = 192.168.1.0/24 (dhcp provided by BG320)
Home network gateway= 192.168.1.254
My opnsense firewall has 3 interfaces
LAN, WAN, MULLVAD
Lab network = 192.168.2.0/24 (DHCP opnsense)
Lab gateway = 192.168.2.1 (opnsense LAN interface)
Opnsense WAN =107.202.x.x (same as ISP) but it also has a kinda hidden ip of 192.168.1.1 from the ATT router
I can ping the opnsense firewall from the internet and see the icmp packets getting dropped in the live log so the traffic is definitely passing from the internet through the ATT router to it.
I also managed to successfully setup an IPSEC VPN into opnsense and that works (except internet access) with an ip pool of 192.168.3.0/24
I also have a TeamViewer connection into a windows client on the lab network that won’t be using the mullvad vpn connection.
I’m working remotely either through IPsec vpn or TeamViewer so I have to be very careful not to do something that’s going to screw my connection. It will be 2 months before I’m back there again.
The mullvad details are as follows
I can ping the tunnel address 10.64.199.247/32 from one of my soon to be mullvad clients but not the gateway which the guide said to set as 10.64.199.247/32
Pic2
https://preview.redd.it/7kwl8zt5wffc1.png?width=1136&format=png&auto=webp&s=75a985d9bc7c5aba4f60377057326398cc974439
📷
I can’t ping 9.9.9.9 but I can see that traffic leaving in the live log.
Pic3
https://preview.redd.it/0d0bzly6wffc1.png?width=1922&format=png&auto=webp&s=762974902f2b4bd881eac5172887f25109276e15
📷
My mullvad ip is 193.x.x.x
I configured 2 alias for my firewall rules
Pic4
https://preview.redd.it/5b4zmm18wffc1.png?width=1555&format=png&auto=webp&s=302141b08afa5d8986aeef85803c17cf6a41a714
📷
Tracepath with wireguard disabled
Pic5
https://preview.redd.it/c7p0imz8wffc1.png?width=521&format=png&auto=webp&s=4d61e699855eae6036a9405c2c53e1639a5f6716
📷
Tracepath with wireguard enabled
Pic6
https://preview.redd.it/j4t2p71bwffc1.png?width=737&format=png&auto=webp&s=a76b90d76755599fb459f9e5f1bd02eda532c823
📷
Pic
MT3000 Wi-Fi 6 Travel Router MEET Beryl AX
Dear all.
I have proxmox homelab with wiregurde install on it and I creat client for my iPhone and one for GL-MT3000 Wi-Fi 6 Travel Router MEET Beryl AX
I can connect to my home server through my iPhone without any issue when I set up VPN on iPhone, but I with GL-MT3000 Wi-Fi 6 Travel Router MEET Beryl AX I get internet connection after upload VPN conf file, but I can’t connect to my home server.
Is there any missing set up to get connect to my home server?
with regards
https://redd.it/1abimz7
@r_wireguard
QBittorent Network interface..
Trying to bind qbt to my wireguard vpn... im connected to us-ny.. but i cant find that as a drop down selection? how can i bind without knowing the name?
https://redd.it/1abxm0e
@r_wireguard
Setup Wireguard, Pihole and Unbound
Hello everyone,
Around year ago I've created VPS with Wireguad. Then Vaultwarden (container) and NextCloud which you can use only connected to VPN.
Yesterday I've installed PiHole + Unbound with Docker. And everything is working fine except one thing. In this case port 53 of my VPS is publicly available and to hide it I use PiHole's "Recommended setting - Allow only local requests: Allows only queries from devices that are at most one hop away (local devices). Now I cannot resolve DNS names and diagnostic shows "NSMASQ_WARNWarning in dnsmasq - core:ignoring query from non-local network 10.0.0.21 (logged only once)".
IP range of Wireguard is 10.0.0.0/24
IP range of Pihole + Unbound 172.23.0.0/24
Is there solution to get access to PiHole DNS with this configuration? Or I need to reconfigure WG, PH and unbound using same docker network?
​
https://redd.it/1aglrlq
@r_wireguard
No handshakes although data is sent
I have a debian server with wireguard, which worked fine just yesterday. But now no peers can handshake — seems like wg doesn't receive anything. Wg log with modprobe shows no handshakes, even unsuccessful, only 'peer created' etc.
However, the peer shows that some data is sent to the server.
https://preview.redd.it/8zs4iod500gc1.png?width=611&format=png&auto=webp&s=cd587e6b93bf603ceb6664a88a4b5d5e448fb115
Checked the keys a thousand times. Tried disabling firewall, too. What else can I check?
Firewall:
To Action From
-- ------ ----
OpenSSH ALLOW Anywhere
51820/udp ALLOW Anywhere
22/tcp ALLOW Anywhere
53/tcp ALLOW Anywhere
53/udp ALLOW Anywhere
80 ALLOW Anywhere
443 ALLOW Anywhere
OpenSSH (v6) ALLOW Anywhere (v6)
51820/udp (v6) ALLOW Anywhere (v6)
22/tcp (v6) ALLOW Anywhere (v6)
53/tcp (v6) ALLOW Anywhere (v6)
53/udp (v6) ALLOW Anywhere (v6)
80 (v6) ALLOW Anywhere (v6)
443 (v6) ALLOW Anywhere (v6)
Anywhere ALLOW FWD Anywhere on wg0
Anywhere on eth0 ALLOW FWD Anywhere on wg0
Anywhere (v6) ALLOW FWD Anywhere (v6) on wg0
Anywhere (v6) on eth0 ALLOW FWD Anywhere (v6) on wg0
Server config:
Interface
Address = 10.8.0.1/32
Address = fd03:b088:2acc::1/128
SaveConfig = true
PostUp = ufw route allow in on wg0 out on eth0
PostUp = iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE
PostUp = ip6tables -t nat -I POSTROUTING -o eth0 -j MASQUERADE
PreDown = ufw route delete allow in on wg0 out on eth0
PreDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
PreDown = ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
ListenPort = 51820
PrivateKey = ...
Peer
PublicKey = ITjaeDzbhKVffvGqMAdwxJkdA5Q/pfUQmhvyecO0C0k=
AllowedIPs = 10.8.0.4/32, fd03:b088:2acc::4/128
Peer config:
Interface
PrivateKey = ...
Address = 10.8.0.4/32
Address = fd03:b088:2acc::4/128
DNS = 8.8.8.8, 8.8.4.4
Peer
PublicKey = fr91ZdrxDlqv199J6o8ta1N4zqFAp0UW5vsie9Qk6UQ=
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = 178.63.127.115:51820
​
https://redd.it/1agf85j
@r_wireguard
Slow/Non-responsive Internet on Local browser but Fast through RDP's workstation
I have a very weird situation. When connected to my VPN (I use a box called Firewalla)
my internet locally slows to a crawl or doesn't work at all.
However, while still connected to the VPN, I can RDP to a workstation on that network. I can browser from within that RDP and it's super fast. No issues.
Any ideas?
​
This is a side by side while connected to the VPN. The left side is my local browser timing out on the same site while on the right, I am connected to a workstation via RDP and it works prefectly fine.
https://preview.redd.it/ut3mx9575zfc1.png?width=1729&format=png&auto=webp&s=c26f0dd731299c9014795525a16796d39533dc07
https://redd.it/1agascp
@r_wireguard
Setting up wireguard correctly for Netflix in presence of IPv6
Hi, previously I had an ISP with IPv4 only and I was using the modem's built-in Wirguard server without issues, but now my new operator has IPv6 too and it is causing me some problems...
I set up a Wireguard server on Ubuntu using Agristan's wireguard-install that forced me (at least I think) to set up IPv6 too and use it directly as it is cause to pop up the outside home Netflix's warning on my second home firestick. Afaik the problem is caused by IPv6, so I'm trying to remove it. I'm not in the second home so the tests are on my mobile using data, and using a test IPv6 website.
First I tried to comment out the IPv6 address in the "peer" section inside the etc/wireguard/wg0.conf and it didn't work (maybe I needed to reload?) on the second attempt I deleted the "Address" and left the IPv4 only inside the .conf file you use to add the VPN to the clients and it worked the website, no longer detect IPv6, for good measure, I deleted the ",::/0" inside "AllowedIPs".
Did I do all right? Is there a more elegant way to do it? I haven't tested it on the Tv yet, but another difference I saw in the config is the DNS (before they were directed to the modem IP, now to 1.1.1.1 and 1.0.0.1) and the interface IP (from a 192.168.1.xxx formato to 10.66.66.xx), can those cause problems too? Sorry for the wall of text, and thanks in advance!
https://redd.it/1ag9b9i
@r_wireguard
VPS CGNAT and SNAT
Hello folks
I have a home server which is behind a CGNAT. Therefore, I use a VPS with a public IP connected to a VM via WireGuard to avoid this. This works perfectly, and I can route the traffic from the VPS directly to my isolated WireGuard VM and then to my local VMs where my services are running. In the past, I used MASQUERADE to send the traffic to the WireGuard VM, but the problem was that I only saw the VPS WireGuard IP at my local VMs and not the real client IPs. But I need them for fail2ban for example. Now I use SNAT, which works, but I have the problem that I can't route anymore from my WireGuard VM to other VMs.
Here My Configs
VPS
Address = 10.0.0.1/24
PostUp = iptables -A FORWARD -i eth0 -o wg0 -j ACCEPT
PostUp = iptables -A FORWARD -i wg0 -o eth0 -j ACCEPT
PostUp = iptables -t nat -A PREROUTING -i eth0 -p tcp -m multiport --dport 443-j DNAT --to 10.102.2
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 1.2.3.4
PostDown = iptables -D FORWARD -i eth0 -o wg0 -j ACCEPT
PostDown = iptables -D FORWARD -i wg0 -o eth0 -j ACCEPT
PostDown = iptables -t nat -D PREROUTING -i eth0 -p tcp -m multiport --dport 443-j DNAT --to 10.102.2
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j SNAT --to-source 1.2.3.4
AllowedIPs = 10.0.0.2/24
VM
Address = 10.0.0.1/24
PostUp = iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination 192.168.2.6:443; iptables -t nat -A POSTROUTING -p tcp --dport 443 -j MASQUERADE
PostDown = iptables -t nat -D PREROUTING -p tcp --dport 443 -j DNAT --to-destination 192.168.2.6:443; iptables -t nat -D POSTROUTING -p tcp --dport 443 -j MASQUERADE
AllowedIPs = 0.0.0.0/0
AllowedIPs = 0.0.0.0/0 in the WireGuard configuration causes all traffic to be routed via the VPN tunnel, which affects the local network routing and routes unwanted traffic through the VPS. As a result, I can no longer route to my local VMs. I want to configure it so that only traffic for specific services is routed through the tunnel, while other local and internet traffic is handled normally so that I can route from VPS to Wireguard VM to the local VM. SNAT must be used to modify the source IP of the traffic routed through the tunnel so that the end destinations (local VMs) have the ability to respond to the original IP addresses. Does anyone have any idea what I need to adjust? I think it's AllowedIPs = 0.0.0.0/0. The IP 192.168.2.6 is a local VM :)
https://redd.it/1afgyuz
@r_wireguard
Trouble with PiVPN and Wire Guard on Ubuntu Home Server
Hello everyone,
I'm having some trouble setting up WireGuard on my Ubuntu server using PiVPN. Initially, I installed WireGuard via PiVPN without a public IP, configured with Duck DNS. However, when trying to connect using the generated QR code, the connection is established, but no data is transferred.
I then attempted a manual installation of WireGuard, which resulted in some data transfer, but I couldn't access the internet after connecting to the VPN.
For another try, I reinstalled WireGuard via PiVPN, this time using the public IP. However, the mobile app log now shows the error "Handshake did not complete after 5 seconds."
I've been stuck on this and would greatly appreciate any insights or advice you could provide. Thanks in advance!
https://redd.it/1afdtf1
@r_wireguard
can access devices locally but not remotely
Hi all, I have a wireguard host running inside openwrt. My openwrt router is in the DMZ behind my isp issued router and internet works just fine. I had wireguard working and could remotely access all my devices behind openwrt but after changing my lan and vpn subnets I cannot remotely access devices on my lan. I can however connect to said devices if I am on the isp router "lan" and connect to openwrts local ip via wireguard. The wireguard handshake succeeds both remotely and locally.
https://redd.it/1af57c2
@r_wireguard
Is WireGuard usable without reliable clocks?
I'm trying to set up a point-to-point WireGuard tunnel between two offline* systems that lack an RTC. Whenever the systems start up, their clocks always start at the same fixed time, which predictably causes problems with WireGuard's replay-attack-prevention-timestamp-serial thing. Packets flow just fine at first, but if I reboot one of the systems, then the clock gets rolled back and packets cease flowing forever until they're both rebooted at the same time.
Even if I do get RTCs on these systems, I can still easily see a scenario where they don't get synchronized for a couple of years, drift a couple minutes/hours ahead, and then one of them gets its clock updated and is effectively unable to communicate because the peers won't accept the newer, more accurate time in the past.
Is there any way to tell WireGuard to just renegotiate entirely if the peer sends a packet with a timestamp in the past? Or some other way to keep WireGuard functional in the presence of jumpy/untrustworthy clocks? The only advice I've gotten so far is to patch the kernel module, but I really want to avoid that if at all possible.
* technically not offline offline, but the Commandment From Above is that any and all packets leaving the interface and being routed away must be WireGuard wrapped, so for our purposes there really isn't any usable network connectivity. Even once the tunnel is established, it's just a point-to-point link to another system with no internet connectivity.
https://redd.it/1af2wku
@r_wireguard
SSH tunnel into a remote server that has WireGuard running freezes SSH client.
So here's a little bit of context.
I'm setting up a simple local headless server (Debian 12) for running qBittorrent, so I don't need to run it on my Personal machine. I'm also running WireGuard as a *client* on that server to another remote server. Everything works in that regard. I can also SSH into the machine fine with everything running. However, an issue arises when I try to run Firefox on my Personal machine through an SSH tunnel to the Server.
The confusing part is that, I had it working, and then I dared to go to sleep. I woke up and suddenly every time I tried to access the tunnel. The SSH client would completely freeze (putty and windows CMD), I somewhat had that issue initially, but it magically fixed itself. Now it seems to have magically broken itself. The only thing I can assume that would cause issues is the AllowedIPs = `0.0.0.0/0` line.
But I'm not exactly sure what to change when it was previously working. But as far as I know, it worked before I shut the machine down and went to sleep.
I can try to provide more information if needed.
https://redd.it/1af0spi
@r_wireguard
client-id=1:b8:27:eb:88:35:80 mac-address=B8:27:EB:88:35:80 server=defconf
add address=192.168.88.75 client-id=1:c8:7f:54:3f:c4:0 mac-address=C8:7F:54:3F:C4:00 server=defconf
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=forward comment="defconf: accept in ipsec policy" disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" disabled=yes ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related disabled=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked disabled=yes
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid disabled=yes
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new disabled=yes in-interface-list=WAN
add action=accept chain=forward dst-port=51820 in-interface-list=WAN protocol=udp
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat dst-port=51820 protocol=udp to-addresses=192.168.88.86 to-ports=51820
/system clock
set time-zone-name=Europe/Berlin
https://redd.it/1aeqt8d
@r_wireguard
client-id=1:b8:27:eb:88:35:80 mac-address=B8:27:EB:88:35:80 server=defconf
add address=192.168.88.75 client-id=1:c8:7f:54:3f:c4:0 mac-address=C8:7F:54:3F:C4:00 server=defconf
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=forward comment="defconf: accept in ipsec policy" disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" disabled=yes ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related disabled=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked disabled=yes
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid disabled=yes
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new disabled=yes in-interface-list=WAN
add action=accept chain=forward dst-port=51820 in-interface-list=WAN protocol=udp
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat dst-port=51820 protocol=udp to-addresses=192.168.88.86 to-ports=51820
/system clock
set time-zone-name=Europe/Berlin
https://redd.it/1aeqdeo
@r_wireguard
7
https://preview.redd.it/kkq46apbwffc1.png?width=437&format=png&auto=webp&s=2270458248205012e91824439110da525db39dd3
📷
Live log while that’s running
Pic8
https://preview.redd.it/pienfylcwffc1.png?width=1723&format=png&auto=webp&s=2d8e4bbc10641466e15e7d800bbb2ec6fae4ceff
📷
Pic9
https://preview.redd.it/vt253fidwffc1.png?width=2091&format=png&auto=webp&s=a9cd65ba8648689801a042cc866a5c513f642bba
Pic10
https://preview.redd.it/yv7b04yfwffc1.png?width=2080&format=png&auto=webp&s=dc70548c52cd708e8c29b4f9615446fec79849ba
Have I missed something or done something wrong?
Have I left out any pertinent information you need to answer or help?
Thanks all.
https://redd.it/1ae5hnh
@r_wireguard
Wireguard + PiHole + Unbound in docker. I can connect to wireguard and connect to lan IP's but can resolve DNS names set in Pihole
Hello,
​
I have the following config in portainer:
​version: '3'networks:
dns_net:driver: bridgeipam:config:- subnet: `172.23.0.0/16`services:
pihole:container_name: piholehostname: piholeimage: pihole/pihole:latest # remember to change this if you're using rpinetworks:dns_net:ipv4_address: `172.23.0.7`ports:- "53:53/tcp"- "53:53/udp"- "8053:80/tcp"#- "443:443/tcp"environment:TZ: 'Europe/Lisbon'WEBPASSWORD: 'password'PIHOLE_DNS_: '`172.23.0.8#5053`'volumes:- '/home/ubuntu/docker/pihole/etc-pihole/:/etc/pihole/'- '/home/ubuntu/docker/pihole/etc-dnsmasq.d/:/etc/dnsmasq.d/'restart: unless-stopped
unbound:container_name: unboundimage: mvance/unbound-rpi:latestnetworks:dns_net:ipv4_address: `172.23.0.8`volumes:- /home/homelabusr/unbound:/opt/unbound/etc/unboundports:- "5053:53/tcp"- "5053:53/udp"healthcheck:test: ["NONE"]restart: unless-stopped
dozzle:container_name: dozzleimage: amir20/dozzle:latestvolumes:- /var/run/docker.sock:/var/run/docker.sockports:- 9999:8080networks:dns_net:ipv4_address: `172.23.0.9`
wg-easy:environment:- WG_HOST=HOME_IP - WG_DEFAULT_DNS=`172.23.0.7`# Optional:- PASSWORD=passwordimage: weejewel/wg-easy:latestcontainer_name: wg-easyvolumes:- /home/ubuntu/docker/wireguard:/etc/wireguardports:- "51820:51820/udp"- "51821:51821/tcp"restart: unless-stoppedcap_add:- NET_ADMIN- SYS_MODULEsysctls:- net.ipv4.ip_forward=1- net.ipv4.conf.all.src_valid_mark=1 networks:dns_net:ipv4_address: `172.23.0.10`
​
I can see that the vpn is recognized as a client in pihole and pihole is querying unbound and providing the replies to wireguard but still can't resolve the dns names.
​
Any advice ?
https://redd.it/1ae1zmy
@r_wireguard
Need help with idea, wireguard and gluetun
Ok i have a **CyberGhost VPN** account and i successfully created a container conecting to specific country using glueten composer.
My idea is to configure a **wireguard-ui-container** to "create new VPN" users on web gui and consume internet from that **gluetun-cyberghost-container**
[https://github.com/ngoduykhanh/wireguard-ui](https://github.com/ngoduykhanh/wireguard-ui)
[https://github.com/qdm12/gluetun-wiki/blob/main/setup/providers/cyberghost.md](https://github.com/qdm12/gluetun-wiki/blob/main/setup/providers/cyberghost.md)
**Device > wireguard-ui-container > gluetun-cyberghost-container > Internet Access**
Did something link this:
version: "3"
services:
gluetun-cyberghost:
container_name: gluetun-cyberghost-vpn
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
environment:
- VPN_SERVICE_PROVIDER=cyberghost
- OPENVPN_USER=XXX
- OPENVPN_PASSWORD=XXX
- SERVER_COUNTRIES=Argentina
volumes:
- /appdata/gluetun:/gluetun
ports:
- 8888:8888/tcp # HTTP proxy
- 8388:8388/tcp # Shadowsocks
- 8388:8388/udp # Shadowsocks
- 9090:5000 # Tunneling 9090 to Wireguard
wireguard-ui:
image: ngoduykhanh/wireguard-ui:latest
container_name: wireguard-ui
cap_add:
- NET_ADMIN
# required to show active clients. with this set, you don't need to expose the ui port (5000) anymore
network_mode: 'container:gluetun-cyberghost-vpn'
environment:
- SENDGRID_API_KEY
- EMAIL_FROM_ADDRESS
- EMAIL_FROM_NAME
- SESSION_SECRET
- WGUI_USERNAME=XXX
- WGUI_PASSWORD=XXX
- WG_CONF_TEMPLATE
- WGUI_MANAGE_START=false
- WGUI_MANAGE_RESTART=false
logging:
driver: json-file
options:
max-size: 50m
volumes:
- ./db:/app/db
- /etc/wireguard:/etc/wireguard
on the **gluetun-cyberghost-container** bash console i used:
curl ifconfig.me
giving me the correct VPN IP i expected.
Also the wireguard container is working and creating users and via QR code im able to connect.
Problem is that when connected with device on wireguard, i get to internet with my very same IP Adresss, not the one on **gluetun-cyberghost-container**
​
​
https://redd.it/1abnvyj
@r_wireguard
Wireguard does not access my local LAN on some external connections
I have wireguard set up as follows:
Interface
PrivateKey = ...
Address = 10.8.0.4/24
DNS = 1.1.1.1
MTU = 1360
Peer
PublicKey = ...
PresharedKey = ...
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = www.###.com:51888
When I go to work, or a friends home, or multiple places, I can log on to wireguard and it routes all of my computer (win 7) traffic as expected. I can access the internet through my home network. And I can get on any of my home subdomains to access my various local home computers. Excellent, and I love it.
However, there is a library by my house I go to, and when I connect there, it connects. I can access the internet, and if I search my ip while at the library it shows me my home IP. So I'm connecting to the internet through my home. BUT, I can't access anything on my local LAN. I can't connect to any of my computers/file servers at home like I can on the numerous other networks. It's otherwise the exact same connection. Something about the library internet makes it so that I can't do it.
Is there a way I can fix this, and make the library connection also let me have access to my home LAN.
https://redd.it/1abtpcm
@r_wireguard
