WireGuard (server) Setup guide

Post new topic   This topic is locked: you cannot edit posts or make replies.    DD-WRT Forum Forum Index -> Advanced Networking
Goto page Previous  1, 2, 3, 4, 5  Next
Author Message
tembares
DD-WRT Novice


Joined: 10 Jul 2012
Posts: 26
Location: Sint Maarten, D.W.I

PostPosted: Sat Apr 04, 2020 15:43    Post subject: Reply with quote
In my search towards a solution, I found the traceroute test.

These are my results.
Code:
root@router:~# traceroute -i oet1 www.google.nl
traceroute: bad address 'www.google.nl'
root@router:~# traceroute -i oet1 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 38 byte packets
 1  10.0.0.1 (10.0.0.1)  162.606 ms  164.505 ms  161.484 ms
 2  190.2.141.2 (190.2.141.2)  163.003 ms  162.613 ms  162.337 ms
 3  *  *  *
 4  *  *  *
 5  *  *  *
 6  *  *  *
 7  *  *  *
 8  *  *  *
 9  *  *  *
10  *  *  *
11  *  *^C
root@router:~#


For sure, there's no DNS available, else google.nl was resolved.
That's why I changed google.nl to their DNS, 8.8.8.8

I am not a specialist and don't know the CLI commands, but what can you analyse from these results?

_________________
Netgear R6700v3 (from MAR2020) - Firmware: DD-WRT v3.0-r42819 std (03/30/20)
Sponsor
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 5932
Location: Netherlands

PostPosted: Sat Apr 04, 2020 15:48    Post subject: Reply with quote
That looks OK, and no there is no WAN connection as everything is routed via the tunnel.
That is what 0.0.0.0/1,128.0.0.0/1 do that will route everything through the tunnel Smile

Of course your VPN provider can block things but everything looks OK.

There is traffic across the tunnel from although very little received.
From the first post I can see that the firewall rules are there, NAT is enabled and now your routing is also OK.

The only thing which can be wrong is your Key pair check private and public key.

I think you generate a key pair on the tunsafe website and then put those keys in using "nvram set ...." like is describe in the guide?
If so double check with wg and wg showconf oet1

Keys must end with a =

Otherwise make a new key pair.

Also double check endpoint and port settings.
It can be helpful to run the windows client and ifit works check the keys, endpoint and port

As far as I can see everything should work if you are sure the keys are working just reboot and cross your fingers.

That is all I can do, WireGuard is not a chatty protocol so does not tell you what is wrong

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 5932
Location: Netherlands

PostPosted: Sat Apr 04, 2020 15:53    Post subject: Reply with quote
tembares wrote:
In my search towards a solution, I found the traceroute test.

These are my results.
Code:
root@router:~# traceroute -i oet1 www.google.nl
traceroute: bad address 'www.google.nl'
root@router:~# traceroute -i oet1 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 38 byte packets
 1  10.0.0.1 (10.0.0.1)  162.606 ms  164.505 ms  161.484 ms
 2  190.2.141.2 (190.2.141.2)  163.003 ms  162.613 ms  162.337 ms
 3  *  *  *
 4  *  *  *
 5  *  *  *
 6  *  *  *
 7  *  *  *
 8  *  *  *
 9  *  *  *
10  *  *  *
11  *  *^C
root@router:~#


For sure, there's no DNS available, else google.nl was resolved.
That's why I changed google.nl to their DNS, 8.8.8.8

I am not a specialist and don't know the CLI commands, but what can you analyse from these results?


Well you reached their server Smile
Then it seems to stop
You can set 1.1.1.1 as DNS server on setup page but that should not matter
I would try with a windows client it could be just on their side

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
johnnyNobody999
DD-WRT User


Joined: 10 Jan 2014
Posts: 345

PostPosted: Wed Apr 08, 2020 0:40    Post subject: Reply with quote
I'm wondering why the Transmit queue length for wireguard is set so low (1) by default. Shouldn't it be much higher? I'm going to experiment since I can't find anything that has a way to determine what it should be. From what I've learned, the higher the setting the better the performance but it may have a negative impact on devices that have latency issues.
johnnyNobody999
DD-WRT User


Joined: 10 Jan 2014
Posts: 345

PostPosted: Wed Apr 08, 2020 1:55    Post subject: Reply with quote
One more question: what is the purpose of Peer Tunnel DNS in the server? It doesn't appear to be pushed out to the clients and it doesn't seem to have any effect on DNS.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 5932
Location: Netherlands

PostPosted: Wed Apr 08, 2020 5:57    Post subject: Reply with quote
johnnyNobody999 wrote:
One more question: what is the purpose of Peer Tunnel DNS in the server? It doesn't appear to be pushed out to the clients and it doesn't seem to have any effect on DNS.


Good question and the answer is it has no meaning in DDWRT itself (the same holds true for the Peer tunnel IP).
It is for making the client files and QR code for Windows and Android.
Windows need to set this DNS server set otherwise it cannot resolve the endpoint url.
DDWRT has its own DNS servers

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
foz111
DD-WRT User


Joined: 01 Oct 2017
Posts: 314
Location: Earth

PostPosted: Wed Apr 08, 2020 10:41    Post subject: Reply with quote
egc may i ask, is this now working with PIA?
cheers
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 5932
Location: Netherlands

PostPosted: Wed Apr 08, 2020 11:02    Post subject: Reply with quote
They have started a closed beta, unfortunately they do not let me take part, but DDWRT is working with a lot of other providers already, so it probably will work. But if anyone is taking part I really would love to hear some details.

You need some tricks to do so but BS has just merged some of my patches so that in builds after 42861 you do not need a script to get it working any more, so we are making progress.

Next step will be the possibility to simply set your private key from the GUI (already working in my build)

Policy based routing (also running in my build)

Kill switch (you guessed right, also running in my build)

So there is a lot more to come, I hope, but I (we) are dependant on the cooperation of our beloved main developer Smile

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
foz111
DD-WRT User


Joined: 01 Oct 2017
Posts: 314
Location: Earth

PostPosted: Wed Apr 08, 2020 11:48    Post subject: Reply with quote
i only ask about PIA as i see their new windows app (v2.0.1) has wireguard built in and working (none beta)
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 5932
Location: Netherlands

PostPosted: Wed Apr 08, 2020 11:59    Post subject: Reply with quote
Interesting this was the last I had seen:
https://www.privateinternetaccess.com/blog/wireguide-all-about-the-wireguard-vpn-protocol/

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
foz111
DD-WRT User


Joined: 01 Oct 2017
Posts: 314
Location: Earth

PostPosted: Wed Apr 08, 2020 12:52    Post subject: Reply with quote
i just sent them a message so i'll let you know what they say when they get back to me. Very Happy
foz111
DD-WRT User


Joined: 01 Oct 2017
Posts: 314
Location: Earth

PostPosted: Wed Apr 08, 2020 12:57    Post subject: Reply with quote
foz111 wrote:
i just sent them a message so i'll let you know what they say when they get back to me. Very Happy

seems its not included lol
i just downloaded it - sorry egc info was coming from a friend its just preview still he got my hope up
ansym3
DD-WRT Novice


Joined: 28 Mar 2019
Posts: 9

PostPosted: Wed Apr 08, 2020 19:36    Post subject: Reply with quote
So this does not support bridging, but does it support repeater mode (excluding repeater bridge)?
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 5932
Location: Netherlands

PostPosted: Sat Apr 11, 2020 8:32    Post subject: Reply with quote
For all of you who also use DDWRT as a WireGuard client in build 42872 from 11-April-2020, you no longer need a client script.

just do the following:

Enable: NAT via Tunnel
Allowed IP's: 0.0.0.0/1,128.0.0.0/1
Enable: Route Allowed IP's via tunnel

For those setting up to a commercial VPN provider:
From your VPN providers settings file:
Enter the local port, Endpoint address and port, set Persistent Keepalive at 25, enter Peer public key, enter IP address and netmask (for conversion: https://kb.wisc.edu/page.php?id=3493)

Enable: NAT via Tunnel
Allowed IP's: 0.0.0.0/1,128.0.0.0/1
Enable: Route Allowed IP's via tunnel

Set private key via the CLI (telnet/putty):
Code:
nvram set oet1_private=enter_your_private_key
nvram commit


Reboot the router, let me know how/if it works Smile

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
avalx
DD-WRT Novice


Joined: 23 Nov 2017
Posts: 5

PostPosted: Sat Apr 11, 2020 10:29    Post subject: Reply with quote
As per guide I configured my android client to connect only to my local LAN via wireguard, i.e. setting Allowed IPs to include wireguard server and my LAN IP: 10.4.0.1/32, 10.55.66.0/24

Now I would like to also reach one specific host on the Internet via the wireguard interface - something like a new route to this host.

Is this possible to configure with the Allowed IPs and if yes what shoud I put in the config on the client side?
Goto page Previous  1, 2, 3, 4, 5  Next Display posts from previous:    Page 4 of 5
Post new topic   This topic is locked: you cannot edit posts or make replies.    DD-WRT Forum Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum