SSH to Wireguard Client in a Server/Client Setup

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking
Author Message
xraive
DD-WRT User


Joined: 08 Mar 2016
Posts: 134

PostPosted: Mon Oct 25, 2021 1:45    Post subject: SSH to Wireguard Client in a Server/Client Setup Reply with quote
I currently have two Netgear R6300v2 routers running Wireguard installed in two locations.

Main Router (server)
Firmware: DD-WRT v3.0-r47381 std (09/08/21)

Remote Router (client)
Firmware: DD-WRT v3.0-r47581 std (10/20/21)

Using egc's DD-WRT server guide I have the sites connected and it ahs been working great so far. I can access devices at both sites with out issue. All traffic from the client goes through the server. The kill switch is enabled on the client.

I can access the client if I enable Remote Management (GUI) but I would like to be able to ssh into the client should the Wireguard connection break. I'm having difficulty getting it to work. Any help you can provide would be greatly appreciated.

Let me know if you require additional information.

Thank you in advance.
Sponsor
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 8660
Location: Netherlands

PostPosted: Mon Oct 25, 2021 10:39    Post subject: Reply with quote
To make it clear you want to remotely SSH into your router (you enabled remote SSH in the GUI)

If the WireGuard client is active all traffic going out of the router is routed via the WG client.

when you remotely connect to your router for SSH you are connecting via the WAN and as traffic goes out via the WG interface your firewall will block this traffic.

The solution is to use Policy Based routing (PBR).
On the WG client you can set all source IP address in the PBR field except for the routers IP address so that that stays on the WAN interface.

See the WireGuard Client setup guide for more information e.g. the use of CIDR notation.

(The kill switch should not be the problem as that is on the FORWARD chain)

Next WG update will have finer grained PBR possibilities so that you can exclude one port e.g.
exclude port 22 from using the VPN
(if the main developer cooperates Smile )

_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
WireGuard Documents & Guides:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327397
OpenVPN Documents & Guides: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327398
IPSET: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327261
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
xraive
DD-WRT User


Joined: 08 Mar 2016
Posts: 134

PostPosted: Sun Oct 31, 2021 6:21    Post subject: Reply with quote
My apologies for the delay, I'll try that. Looking forward to the changes, to be able to do Port based PBR.

Thanks for all the work you do in these forums.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 8660
Location: Netherlands

PostPosted: Thu Nov 04, 2021 9:46    Post subject: Reply with quote
Now In alpha testing I only route sport 22 via the WAN, everything else is routed via the VPN.
This way I can access my router via SSH Smile

But it will take some time before you can find it in a regular build, maybe end of this year.

_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
WireGuard Documents & Guides:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327397
OpenVPN Documents & Guides: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327398
IPSET: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327261
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
the-joker
DD-WRT Developer/Maintainer


Joined: 31 Jul 2021
Posts: 294
Location: All over the webs

PostPosted: Thu Nov 04, 2021 11:29    Post subject: Reply with quote
egc wrote:
Now In alpha testing I only route sport 22 via the WAN, everything else is routed via the VPN.


Is this strictly port 22 or the port the user has set for SSH access?

Also thanks for your work on Wireguard.

BE well Wink

_________________
Saving your retinas from the burn!🔥
DD-WRT Inspired themes for routers
DD-WRT Inspired themes for the phpBB Forum
DD-WRT Inspired themes for the SVN Trac & FTP site
Join in for a chat @
#style_it_themes_public:matrix.org or
#dd-wrt_non_official:matrix.org
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 8660
Location: Netherlands

PostPosted: Thu Nov 04, 2021 11:54    Post subject: Reply with quote
You can set any port you want, you can set an interface, an IP address, fwmark etc see:
https://man7.org/linux/man-pages/man8/ip-rule.8.html

It is a comma delimited list so you can set more than one.

e.g. add your TV's IP address because it uses Netflix and it is blocked while on VPN.
For that you also have to set the DNS server for the TV different and to use that DNS server to use the WAN (Netflix also checks this).

So set the TV to use e.g. 8.8.4.4. as DNS server (either by static IP address or static lease via DNSMasq and let DNSmasq hand out a different DNS server for that IP address).

Now the next setting comes in handy, in the Destination Routing route 8.8.4.4 also via the WAN and you can see Netflix again on your TV.

I have to test everything and update the documentation Smile

These are the things that can make life easier.

Also thank you for your work in the interface much smoother and nicer Smile

_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
WireGuard Documents & Guides:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327397
OpenVPN Documents & Guides: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327398
IPSET: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327261
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum