After Testing an E3000 with WireGuard, I made it into a Travel Router. I setup wl0 (2.4Ghz) radio as a Client (to connect to Hotel WiFi. The 5Ghz radio is an AP to connect devices with a VAP. I have wl1 for WireGuard Protection and VAP wl1.1 for a NAT Connection to the Hotel only for registering the router to the Hotel. I was using a R7000 as a Travel Router but now the E3000 is a smaller dual-radio router to travel, with WireGuard Protection at 30Mb/s speeds too!
The E3000 is OverClocked to 533Mhz for these tests
Speedtest via VAP (wl1.1) NAT to Client (42Down/57Up)
Speedtest via AP (wl1) WireGuard (30Down/30Up)
Code:
root@DD-WIREGUARD:~# cat /proc/cpuinfo
system type : Broadcom BCM4716 chip rev 1
processor : 0
cpu model : MIPS 74Kc V4.0
BogoMIPS : 239.61
CPUClock : 480
wait instruction : no
microsecond timers : yes
tlb_entries : 64
extra interrupt vector : yes
hardware watchpoint : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa : mips1 mips2 mips32r1 mips32r2
ASEs implemented : mips16 dsp dsp2
Options implemented : tlb 4kex 4k_cache prefetch mcheck ejtag llsc dc_aliases perf_cntr_intr_bit
shadow register sets : 1
kscratch registers : 0
core : 0
VCED exceptions : not available
VCEI exceptions : not available
root@DD-WIREGUARD:~# wg show
interface: oet1
public key: B6cVwrxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
private key: (hidden)
listening port: 59797
peer: V87ZRpxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
endpoint: 107.181.xxx.xxx:59797
allowed ips: 0.0.0.0/0
latest handshake: 53 seconds ago
transfer: 62.28 MiB received, 64.04 MiB sent
persistent keepalive: every 30 seconds
root@DD-WIREGUARD:~#
root@DD-WIREGUARD:~#
root@DD-WIREGUARD:~# ip route show table 111
default dev oet1 scope link
10.254.250.0/24 dev br1 scope link src 10.254.250.1
10.254.251.0/24 dev br0 scope link src 10.254.251.1
127.0.0.0/8 dev lo scope link
192.168.211.0/24 dev eth1 scope link src 192.168.211.240
root@DD-WIREGUARD:~# ip route show
default via 192.168.211.1 dev eth1
10.254.250.0/24 dev br1 scope link src 10.254.250.1
10.254.251.0/24 dev br0 scope link src 10.254.251.1
107.181.xxx.xxx via 192.168.211.1 dev eth1
127.0.0.0/8 dev lo scope link
192.168.211.0/24 dev eth1 scope link src 192.168.211.240
root@DD-WIREGUARD:~#
_________________ Home Network on Telus 1Gb PureFibre - 10GbE Copper Backbone
2x R7800 - Gateway & WiFi & 3xWireGuard - DDWRT r53562 Std k4.9
Off Site 1
R7000 - Gateway & WiFi & WireGuard - DDWRT r54517 Std
E3000 - Station Bridge - DDWRT r49626 Mega K4.4
Off Site 2
R7000 - Gateway & WiFi - DDWRT r54517 Std
E2000 - Wired ISP IPTV PVR Blocker - DDWRT r35531
I kindly ask you for help because I’m stuck trying to use my DD-WRT router as WG client of an ALGO VPN server. Probably most (all) of you have hear about this rising free set of scripts that allows you to build your own VPN server faster than a ray, and (it seems) with a strong set of security features.
My router: Linksys EA6700, DD-WRT v3.0-r40559
As you will realize for sure, I’m not an expert and I only have knowledge enough to follow this kind of guides understanding its fundamentals. Please sorry I bother you with useless information or wrong conclusions.
I reply into this thread, because at the beginning I’m more or less in the same situation than James Greystone when he started this post.
Basically, what I know is my ALGO VPN server is working properly since I can connect my Windows 10 PC and my iPhone, using Wireguard as the client in both cases. What I have to do that is a couple of .conf files that I directly import into WG apps in those devices. These .conf files looks like this:
[Interface]
PrivateKey = MOkxxxxxxxxxxxxxxxxxxxxxxxxxxZ5Q68NpTwKmCnk=
Address = 10.x.x.x/24
DNS = 172.x.x.x
So, I decided to follow the guide from egc (thanks man!) because I supposed that somehow, I would be able to make things work form the router.
I noticed that “PrivateKey” was solved by nvram commands and the “PresharedKey” is something that you can handle into the peer configuration, so I went ahead fast.
I followed every single step in the guide, observing to comment this line in the client script (#WGNAT= # uncomment/comment to enable/disable SNAT over the oet interface) because I’m using the router as the WG client.
I also use the “PresharedKey” in the peer configuration.
It looks like that under these lines:
I was happy when I saw this the tunnel seemed to be UP, since "wg" commands shows the right info.
But when I try to surf the web I still have my local puclic address, and I0m not able to access LAN adresses on the server side (and I actually can using w10 or IOS client). What I just can is "ping" the address of the tunnel IP at the server side.
I suspect that this is related to the routes the client script should configure at the startup, right?. But nothing happend.
Could somebody put some order in my meshed mind and let me know how to properly start and what I should check then?
Question. How many days does WireGuard stay connected unit it looses Handshake?
I ask because after 3 days of uptime one of my WireGuard connection it lost Handshake and no Internet connection. I rebooted the router and again no Handshake, so I configured the router to a different server, rebooted and Handshake started with the new server. I did change Keep Alive from 30sec to 20sec to see if it helps.
I'm on Build 42132 with the latest WireGuard Updates.
This there a way to restart the WireGuard connection without rebooting the router?
TIA! _________________ Home Network on Telus 1Gb PureFibre - 10GbE Copper Backbone
2x R7800 - Gateway & WiFi & 3xWireGuard - DDWRT r53562 Std k4.9
Off Site 1
R7000 - Gateway & WiFi & WireGuard - DDWRT r54517 Std
E3000 - Station Bridge - DDWRT r49626 Mega K4.4
Off Site 2
R7000 - Gateway & WiFi - DDWRT r54517 Std
E2000 - Wired ISP IPTV PVR Blocker - DDWRT r35531
It is late here in the Netherlands so tomorrow I will have fresh look.
It does not look to bad at first glance.
For use as a client you need to SNAT/masquerade over the oet/wg interface so do not put an # before WGNAT.
reboot and see if this helps.
Furthermore the build you are using is not very good do not use the router database
I will come back on it tomorrow
Hey egc, It's early enough here in Germany to take your advice.
Believe it or not, it’s working know!!. As you asked me about to uncomment that line and allow NAT, I also read your notes about running the script not in the startup, but in the firewall. So I did. Removed the script from the startup and “save firewall” it…
Tachaaaann!!. Everything seems to run now. Got internet access from the other side (Spain) with the right IP and access to the remote LAN IP addresses. Thanks man, I really appreciate the support you give us here.
So, what now? I made some speed test and it reached up to 25-30 Mbps., but it “feels” like not smooth. I don’t know how much can I expect from this Linksys.
I also took note of your comment about the version I’m running. Could you recommend me a new one?
Finally, I wanted to add the “killswitch” stuff and I’ve failed running your favourite:
If I reboot the router, sometimes it lost the IP address (it takes 0.0.0.0) of this side of the tunnel (the one I was given by the server). When I restore it to the right one, everything works fine again.
By the way, after some time, the speed on the links has improved a lot. No I'm getting up to 90 Mbps, but it is not always.
Last edited by jvmesa on Sun Feb 09, 2020 10:18; edited 1 time in total
Regarding the speed of your EA6700 that seems low, you have a Broadcom dual core Arm A9 at 800 MHz, I think, so I would expect at least double that speed you are showing.
Maybe it is on the providers end?
Check with your Windows PC if it is better.
Regarding a new build I think the latest 42287 should work but always research the build threads. See points 8 and 9
Below some pointers which might help to get the best out of DDWRT and out of the forum:
1. Research your router, start with the supported devices wiki:
https://wiki.dd-wrt.com/wiki/index.php/Supported_Devices .
2. In the supported devices wiki you can see if your router is supported and what architecture your router has and if you are lucky also an install guide/wiki.
3. Post in the right forum, from the former step you can see if your router is Broadcom, Qualcomm/Atheros, Marvell or other, use that forum to post router specific questions, for networking questions post in the Advanced Networking forum and for other things in the General Questions forum.
4. When posting always state router model, build number and when applicable the Kernel version.
Describe your problem and how you think it can be solved.
Give as much detail as you can also provide your network setup if applicable.
For your Network setup, state what wiki you have used: https://wiki.dd-wrt.com/wiki/index.php/Linking_Routers
5. When posting pictures make sure the maximum width is not more than 600 pixels.
6. Do not hijack a thread, meaning do not post your own problem in someone else's thread. Just start your own thread. This so that it can be searched and found by others.
7. If your post is answered and your problem solved, mark your thread with [SOLVED] (the header of your first post).
8. Do NOT use the router database, builds can be found at:
https://dd-wrt.com/support/other-downloads/?path=betas%2F2020%2F
All builds are beta including those from the router database.
9. Before uploading a new build to your router, research the build by looking in the build threads.
This is an example of a build thread for build 41686 for Broadcom routers:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=322339
Search build threads with the search function and search on build number.
10. Use the build threads from the former step to report success or problems.
11. For older Broadcom routers (Linksys WRT54 and E series) read the peacock thread although some of it is outdated: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=51486
Builds can be found in the Broadcom directory for Linux kernel 2.4, in Broadcom_K26 for Linux K2.6 and in Broadcom_K3X for Linux K3.X.
12. If you are sure you have discovered a bug, after asking and querying the forum, you can report a real bug in the bug tracker: https://svn.dd-wrt.com/
This is also the place where the commits/changes to the source are administrated.
13. Recommended reading:
https://forum.dd-wrt.com/wiki/index.php/Main_Page https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=54845 https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=54959
14. If you are happy with DDWRT and want it to live on then donate:
https://dd-wrt.com/donations/ _________________ Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399 Install guide R7800/XR500:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614 Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Joined: 18 Mar 2014 Posts: 12884 Location: Netherlands
Posted: Sun Feb 09, 2020 10:39 Post subject:
Our posts crossed, not sure about the loss of your IP address, I think you should update to a better build.
As you are coming from a much earlier build consider resetting to defaults and put settings in manually, I know it is a lot of work, alternatively just upgrade and only when problems persist reset.
The best reset method is via the CLI (telnet/putty) and do:
I'm here to learn, so I'll reset everything and re-start from zero, trying to use a new build as you suggested. I’ll back to this work later today and as soon as I have the result I’ll give you the info (positive one, I hope!).
I think this should allow to update your guide in order to specify that is also suitable for using DD-WRT router as ALGO VPN client. These days there is not (I think) clear information about this and the demand of ALGO is increasing by weeks.
By the way, after some time, the speed on the links has improved a lot. No I'm getting up to 90 Mbps, but it is not always.
When I speed test a VPN/Tunnel on a router I always telnet to the router run top and for multi-core SoC I press c to view to view all cpus. If your router is the bottleneck you will see at least one core with 0% idle, if the idle is not zero it the the network or server that has the bottleneck.
Doing a simple calulation based on the R7800 & R7000 (Dual-1Ghz SoC). The R7800 is about 2.5x faster then the R7000. The R7800 maxes out at around 270Mbit/s on WireGuard (OpenVPN max about 90Mbit/s and WireGuard is 3x the speed). Therefore I would put the WireGuard throughput on the R7000 around 270/2.5 = 108Mbit/s. The EA6700 clock is 0.8x of the R7000, so 108x0.8 is about 86Mbit/s for the EA6700 on WireGuard.
I know that my R7000 on OpenVPN was about 35Mbit/s and looking at the WireGurd calculation of 108Mbit/s it is about 3x faster which looks right to me. _________________ Home Network on Telus 1Gb PureFibre - 10GbE Copper Backbone
2x R7800 - Gateway & WiFi & 3xWireGuard - DDWRT r53562 Std k4.9
Off Site 1
R7000 - Gateway & WiFi & WireGuard - DDWRT r54517 Std
E3000 - Station Bridge - DDWRT r49626 Mega K4.4
Off Site 2
R7000 - Gateway & WiFi - DDWRT r54517 Std
E2000 - Wired ISP IPTV PVR Blocker - DDWRT r35531
Joined: 18 Mar 2014 Posts: 12884 Location: Netherlands
Posted: Mon Feb 10, 2020 6:31 Post subject:
Ok first check with your Windows client if your credentials and settings are still working
If your Windows client is working then check if your settings and credentials in DDWRT are the same, use
wg showconf oet1
to see the private key and
wg
to see the other settings and credentials.
IF those are the same and even after a reboot (first deactivate your windows client) you do not have a connection then head over to the Troubleshooting section and send us the output of the commands mentioned and screenshots of the Setup/Tunnels page and Setup/Networking to show the portsetup of oet1
Unfortunately, I’ve checked all your checkpoints last night (and right now) and all of them are OK.
Windows and IOS client work fine with same .conf files.
Even I’ve realized now that ‘wg’ command shows the same PublicKey that I’ve got in the wireguard Windows client when connected, so PrivateKey method seems to be calculated right (I guess).
Code:
root@Txxxxxxxx:~# wg
interface: oet1
public key: 8GxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxC4=
private key: (hidden)
listening port: 51820
Is there any log I could check to see the handshake process? I’m idea-less right now. Considering to downgrade to 42132, where mac913 seems to be OK.
I don’t know.
Here is my tunnel conf right now. In “Peer Tunnel IP” I’ve tried with the IP of the server side. Nothing. In “Peer Tunel DNS” I also have tried leaving it blank. Nothing.
Joined: 18 Mar 2014 Posts: 12884 Location: Netherlands
Posted: Mon Feb 10, 2020 12:54 Post subject:
There is not much to troubleshoot in Wireguard to see where it goes wrong as it is very simple so when specifying the right parameters it should work
I use the latest build with wireguard and it is working (of course not with your provider) so I would first check some other things.
They gave you an ip address (something like 10.x.x.x) do they also specify a netmask?
You are now using /24 and I assume you do not have the script running so routing can be a problem.
Even without the script you should get a connection, the script is merely for routing all your traffic via the WG interface.
You can try 255.255.0.0 as netmask instead of 255.255.255.0 you now have.
That is why it is still useful to enter the peer tunnel IP address, not only as identification but also to see if the ip address is in your subnet range, although it only has a real function when using QR setup.
They gave you an ip address (something like 10.x.x.x) do they also specify a netmask?
You are now using /24 and I assume you do not have the script running so routing can be a problem.
Even without the script you should get a connection, the script is merely for routing all your traffic via the WG interface.
You can try 255.255.0.0 as netmask instead of 255.255.255.0 you now have.
Yes, they do. If you check my first post you'll find that the .conf file I have, and I use to configure Windows client, provide all this information:
Code:
[Interface]
PrivateKey = MOkxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxCnk=
Address = 10.x.x.3/24
DNS = 172.27.12.125
So yes, it's a /24. Should I use /16 instead?. I'll do it. Just remember it was working with /24 with the previous build.
egc wrote:
That is why it is still useful to enter the peer tunnel IP address, not only as identification but also to see if the ip address is in your subnet range, although it only has a real function when using QR setup.
Otherwise show the output of the the requested commands
I agree. And yes, it's in the same subnet range. It's the .1 of that network (where the client is .3)
So, from los to the river. I'll change that and see what happens.
