[howard@sci1.com]

Router: Netgear R9000
DD-WRT: v3.04-r49599 std (7/30/2022)

I had Wireguard/Wireshark working on an older router (Netgear R6300) with a slightly earlier version of DD-WRT (don't remember what version). Upgraded the router and used a new DD-WRT version and I can't get it to work anymore.

Wireguard tunnel settings page shows that that Wireguard is handshaking.

-----------
endpoint: 104.129.56.132:1194
latest handshake: 5 seconds ago
transfer: 304 B received, 304 B sent
------------

But all traffic still gets routed directly to my ISP instead of going through the tunnel. To the best of my recollection, on the earlier router a route to oet1 was setup, but I don't see one anymore, instead the VPN endpoint address (104.129.56.4:1194) seems to be routed to vlan2 which is my WAN:

-------------
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 71.236.228.1 0.0.0.0 UG 0 0 0 vlan2
23.94.74.100 71.236.228.1 255.255.255.255 UGH 0 0 0 vlan2
71.236.228.0 * 255.255.252.0 U 0 0 0 vlan2
104.129.56.4 71.236.228.1 255.255.255.255 UGH 0 0 0 vlan2
104.129.56.132 71.236.228.1 255.255.255.255 UGH 0 0 0 vlan2
127.0.0.0 * 255.0.0.0 U 0 0 0 lo
192.1.1.0 * 255.255.255.0 U 0 0 0 br0
198.12.116.196 71.236.228.1 255.255.255.255 UGH 0 0 0 vlan2
------------------

Router log says that Wireguard set up a route but it says that the route was setup for vlan2 instead of oet1:

-----------------

Aug 5 21:50:36 Netgear R9000 user.info root: WireGuard number of non failed tunnels in fail set: 0
Aug 5 21:50:36 Netgear R9000 user.info root: WireGuard: Deleted endpoint route to 104.129.56.132 from sea-290-wg.whiskergalaxy.com
Aug 5 21:50:36 Netgear R9000 user.info root: Flush delete PBR interface oet1, table : 21
Aug 5 21:50:36 Netgear R9000 user.info root: Enable WireGuard interface oet1 on port 51820
Aug 5 21:50:36 Netgear R9000 user.info root: Establishing WireGuard tunnel with peer endpoint sea-290-wg.whiskergalaxy.com:1194
Aug 5 21:50:36 Netgear R9000 user.info root: WireGuard setting route for oet1 to endpoint sea-290-wg.whiskergalaxy.com:1194 via 71.236.228.1 dev vlan2
Aug 5 21:50:36 Netgear R9000 user.info root: WireGuard 100.104.252.39/32 added to oet1
Aug 5 21:50:36 Netgear R9000 user.info root: WireGuard set /tmp/oet.lock
----------------------

wg show oet1:

root@Netgear R9000:/tmp/var/log# wg show oet1
interface: oet1
public key: KF6+rIhIzscOC9fozD7f8Zk6nPwebNCML0hzECcUiFc=
private key: (hidden)
listening port: 51820

peer: 89DUtbYYyXcAktaB2cnCVA/YiZQEddYHuOz2K0vBAn4=
preshared key: (hidden)
endpoint: 104.129.56.68:1194
allowed ips: 0.0.0.0/1
latest handshake: 28 seconds ago
transfer: 3.61 KiB received, 2.27 KiB sent
persistent keepalive: every 25 seconds
root@Netgear R9000:/tmp/var/log#

--------------------------------

I have searched the forum and haven't been able to find the answer. Am attaching an image of my DD-WRT tunnel config page.

TIA for any help.

[egc]

Your Allowed IP's are wrong.

WireGuard documentation is a sticky in this forum.

See the WireGuard Client setup:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624

[howard@sci1.com]

I have read the forum about allowed IPs.

I changed the allowed IPs to 0.0.0.0/1, 128.0.0.0/1

It made no difference.

[egc]

That should take care of the routing.

For IP address/Netmask use Netmask of /24 instead of /32 (although it should work with either)

First reboot the router and wait a couple of minutes till the connection is established.

Lets see the output of:
wg
wg showconf oet1
ip route show
grep -E -i 'oet|wireguard' /var/log/messages

[howard@sci1.com]

Thank you for the response.

I changed the IP to /24 and rebooted the router. That added a route for oet1 to the routing table. So that may be progress, but unfortunately ipleak.net still shows my IP address as that of my ISP, not a VPN. I waited a few minutes in case it took a while for the VPN to setup, but ipleak.net still shows my ISP. The config page for DD-WRT tunnels shows that the VPN is still handshaking.

Thank you for looking at this.

Here are outputs you requested:

=============
root@Netgear R9000:~# wg
interface: oet1
public key: KF6+rIhIzscOC9fozD7f8Zk6nPwebNCML0hzECcUiFc=
private key: (hidden)
listening port: 51820

peer: 89DUtbYYyXcAktaB2cnCVA/YiZQEddYHuOz2K0vBAn4=
preshared key: (hidden)
endpoint: 104.129.56.132:1194
allowed ips: 0.0.0.0/1, 128.0.0.0/1
latest handshake: 19 seconds ago
transfer: 696 B received, 552 B sent
persistent keepalive: every 25 seconds

-------------
root@Netgear R9000:~# wg showconf oet1
[Interface]
ListenPort = 51820
PrivateKey = QMMHKQnoG333kv2mkGY0kykuwxD4KvteB91c+UzcMmc=

[Peer]
PublicKey = 89DUtbYYyXcAktaB2cnCVA/YiZQEddYHuOz2K0vBAn4=
PresharedKey = C22yPk44TEwNxVSw1Wu2YnUXy/BJYehKNxzOFL//vog=
AllowedIPs = 0.0.0.0/1, 128.0.0.0/1
Endpoint = 104.129.56.132:1194
PersistentKeepalive = 25

-----------------

root@Netgear R9000:~# ip route show
default via 71.236.228.1 dev vlan2
71.236.228.0/22 dev vlan2 scope link src 71.236.228.176
100.104.252.0/24 dev oet1 scope link src 100.104.252.39
104.129.56.132 via 71.236.228.1 dev vlan2
127.0.0.0/8 dev lo scope link
192.1.1.0/24 dev br0 scope link src 192.1.1.250

-------------

root@Netgear R9000:~# grep -E -i 'oet|wireguard' /var/log/messages
Dec 31 16:00:24 Netgear R9000 user.info root: WireGuard number of non failed tunnels in fail set: 0
Dec 31 16:00:24 Netgear R9000 user.info root: Enable WireGuard interface oet1 on port 51820
Dec 31 16:00:24 Netgear R9000 user.info root: Establishing WireGuard tunnel with peer endpoint sea-290-wg.whiskergalaxy.com:1194
Dec 31 16:00:29 Netgear R9000 user.info root: WireGuard setting route for oet1 to endpoint sea-290-wg.whiskergalaxy.com:1194 via 0.0.0.0 dev vlan2
Dec 31 16:00:29 Netgear R9000 user.info root: WireGuard 100.104.252.39/24 added to oet1
Dec 31 16:00:29 Netgear R9000 user.info root: WireGuard set /tmp/oet.lock
Dec 31 16:00:31 Netgear R9000 user.info root: WireGuard number of non failed tunnels in fail set: 0
Dec 31 16:00:31 Netgear R9000 user.warn root: WireGuard: Could not delete endpoint route from oet1 peer0 to from sea-290-wg.whiskergalaxy.com
Dec 31 16:00:32 Netgear R9000 user.info root: Flush delete PBR interface oet1, table : 21
Dec 31 16:00:32 Netgear R9000 user.info root: Enable WireGuard interface oet1 on port 51820
Dec 31 16:00:32 Netgear R9000 user.info root: Establishing WireGuard tunnel with peer endpoint sea-290-wg.whiskergalaxy.com:1194
Dec 31 16:00:32 Netgear R9000 user.info root: WireGuard setting route for oet1 to endpoint sea-290-wg.whiskergalaxy.com:1194 via 71.236.228.1 dev vlan2
Dec 31 16:00:32 Netgear R9000 user.info root: WireGuard 100.104.252.39/24 added to oet1
Dec 31 16:00:32 Netgear R9000 user.info root: WireGuard set /tmp/oet.lock
Aug 6 01:43:18 Netgear R9000 user.info root: WireGuard waited 5 seconds to set routes for oet
Aug 6 01:43:18 Netgear R9000 user.info root: WireGuard route 0.0.0.0/1 added via oet1
Aug 6 01:43:18 Netgear R9000 user.info root: WireGuard route 128.0.0.0/1 added via oet1
Aug 6 01:43:18 Netgear R9000 user.info root: WireGuard DNS server 10.255.255.2 routed via oet1
Aug 6 01:43:19 Netgear R9000 user.info root: WireGuard number of non failed tunnels in fail set: 0
Aug 6 01:43:19 Netgear R9000 user.info root: WireGuard: Deleted endpoint route to 104.129.56.68 from sea-290-wg.whiskergalaxy.com
Aug 6 01:43:19 Netgear R9000 user.info root: Flush delete PBR interface oet1, table : 21
Aug 6 01:43:19 Netgear R9000 user.info root: Enable WireGuard interface oet1 on port 51820
Aug 6 01:43:19 Netgear R9000 user.info root: Establishing WireGuard tunnel with peer endpoint sea-290-wg.whiskergalaxy.com:1194
Aug 6 01:43:19 Netgear R9000 user.info root: WireGuard setting route for oet1 to endpoint sea-290-wg.whiskergalaxy.com:1194 via 71.236.228.1 dev vlan2
Aug 6 01:43:19 Netgear R9000 user.info root: WireGuard 100.104.252.39/24 added to oet1
Aug 6 01:43:19 Netgear R9000 user.info root: WireGuard set /tmp/oet.lock
root@Netgear R9000:~#

[egc]

WireGuard is adding the routes as shown by the log:

Aug 6 01:43:18 Netgear R9000 user.info root: WireGuard route 0.0.0.0/1 added via oet1
Aug 6 01:43:18 Netgear R9000 user.info root: WireGuard route 128.0.0.0/1 added via oet1

But they do not show up in you routing table, what Wireguard is doing is just this:

[egc]

There must be something really weird in your setup.
Can you show output of:
nvram show | grep oet

[howard@sci1.com]

If I manually add those routes, then ipleak.net shows that my IP is now the IP of the VPN host as desired! And it appears that I can still access the internet as always.

Routing table looks like this now:

root@Netgear R9000:~# ip route show
0.0.0.0/1 dev oet1 scope link
default via 71.236.228.1 dev vlan2
71.236.228.0/22 dev vlan2 scope link src 71.236.228.176
100.104.252.0/24 dev oet1 scope link src 100.104.252.39
104.129.56.68 via 71.236.228.1 dev vlan2
127.0.0.0/8 dev lo scope link
128.0.0.0/1 dev oet1 scope link
192.1.1.0/24 dev br0 scope link src 192.1.1.250
root@Netgear R9000:~#

I am not using any scripts to set routes nor have I been manually adding any. I've been relying on the DD-WRT Wireguard tunnel to set them as needed. Pretty sure that worked on my older router with a slight older DD-WRT because the VPN worked without manually setting any routes.

Is this possibly a DD-WRT bug in a recent DD-WRT release?

I don't know how to automatically add routes at startup. I could research that. But I don't think I want those routes added all the time because I don't want to run with the VPN active all the time.

Thank you!

[howard@sci1.com]

root@Netgear R9000:~# nvram show | grep oet
oet1_isolation=0
oet1_rtdownscript=
oet1_mit=1
oet1_endpoint0=1
oet1_multicast=0
size: 36540 bytes (94532 left)
oet1_dpbr_ip=104.129.56.4/32
oet1_peerkey0=*deleted*
oet1_aip_rten0=1
oet1_usepsk0=1
oet1_namep0=
oet1_spbr=0
oet1_dns=10.255.255.2
oet_tunnels=1
oet1_port=51820
oet1_dpbr=0
oet1_failgrp=0
oet1_hwaddr=00:00:00:00:00:00
oet1_peerport0=1194
oet1_failstate=0
oet1_mtu=1420
oet1_clend0=
oet1_wdog=0
oet1_clka0=
oet1_dns_redirect=0
oet1_ka0=25
oet1_fwmark=
oet1_cldns0=0.0.0.0
oet1_en=1
oet1_ip0=0.0.0.0
oet1_bloop=0
oet1_rtupscript=
oet1_rem0=104.129.56.68
oet1_txq=1
oet1_peers=1
oet1_psk0=*deleted*
oet1_ipaddrmask=100.104.252.39/24
oet1_spbr_ip=100.104.252.39/32
oet1_clconfig0=0
oet1_showadvanced=1
oet1_killswitch=0
oet1_dns_ipaddr=0.0.0.0
oet2_bloop=0
oet1_rem=192.168.90.1
oet1_natout=1
oet1_netmask=255.255.255.0
oet1_proto=2
oet3_nat=1
oet1_bridged=0
oet1_private=*deleted*
oet1_lanac=0
oet1_ipaddr=100.104.252.39
oet2_nat=1
bat_oet1_bridge=br0
oet1_failip=8.8.8.8
oet1_dnspbr=0
oet1_id=1
oet1_nat=1
oet3_bloop=0
oet1_public=KF6+rIhIzscOC9fozD7f8Zk6nPwebNCML0hzECcUiFc=
oet1_local=0.0.0.0
oet1_aip0=0.0.0.0/1,128.0.0.0/1
oet1_firewallin=1
root@Netgear R9000:~#

[Per Yngve Berg]

[egc]

There are some really strange settings in your configuration e.g.:
oet1_spbr_ip=100.104.252.39/32

That cannot be right, I also see remnants of oet2 and oet3

The best Advice I can give is start from scratch, try with deleting all tunnels
Save and Apply and reboot router

Then setup a new tunnel

But perhaps better reset the whole router seeing the remnants of other tunnels

[egc]

Another thing you can try remove the DNS servers via Tunnel, make sure the field is really empty.

After everything is done send output again of:
grep -E -i 'oet|wireguard' /var/log/messages

[egc]

As I do not have your router in hand it is always difficult to trouble shoot but it could be that the script stalls on your DNS server.

This is the end of your log:

[the-joker]

@egc You should delay wireguard start until after NTP has updated, which in itself re-triggers the firewall and other services to restart.

TBH Ive no idea why anything starts before NTP is done in any case. Any services should only start after router has valid time updated.

[egc]

WireGuard waits until NTP is updated so that is not the problem, the "waited 5 seconds line" is how long it took before ntp is working