[SOLVED] Problem with HTTP using Wireguard on Android

Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking
Goto page 1, 2  Next
Author Message
tm2023
DD-WRT Novice


Joined: 29 Jan 2023
Posts: 12

PostPosted: Wed Feb 01, 2023 12:34    Post subject: [SOLVED] Problem with HTTP using Wireguard on Android Reply with quote
Hi,

I have setup wireguard on an TP-Link ARCHER-C7 v5 on build 49838 following "DDWRT Wireguard Server Setup guide v47.pdf. The Router is connected to another (outer) LAN which then connects to the internet.

I have two peers, one for an Android phone and one for a Windows PC. From the Windows PC all is working fine. But the Android Phone could only connect to the PC using RDP and to the DD-WRT Router Admin HTTP Interface. Other HTTP or SMB sites are not reachable. PCs in the outer LAN are
also reachable from the Android phone using RDP.

Do you have any hints to fix it?

Regards


Last edited by tm2023 on Thu Feb 02, 2023 12:42; edited 1 time in total
Sponsor
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12835
Location: Netherlands

PostPosted: Wed Feb 01, 2023 12:55    Post subject: Reply with quote
Show a screenshot of the WireGuard Server to begin with, so that we can have a look at the settings.

The Windows PC which is one of the Peers, where is it connecting from?

Is this the same windows PC you are trying to reach from your Android phone?

Edit:
You always have to test from outside your network e.g. with phone or laptop using cellular.
Furthermore make sure there are three different networks for Router, VPN and Client

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
tm2023
DD-WRT Novice


Joined: 29 Jan 2023
Posts: 12

PostPosted: Wed Feb 01, 2023 13:44    Post subject: Reply with quote
One time I use the same Windows PC as peer connected over the internet, the other time I use it in the outer LAN. The outer LAN is 192.168.2.0/24 and the DD-WRT ist connected to it with a static ip address.

IP Addresses / Netmask (CIDR) is 10.4.0.1/24.

The behavior is the same with CVE-2019-14899 Mitigation set or not.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12835
Location: Netherlands

PostPosted: Wed Feb 01, 2023 14:00    Post subject: Reply with quote
On first glance your settings are OK.

Is the DDWRT router on its own subnet in normal gateway mode?

From your Android phone do you have normal internet access when connected to the WG server?

If so that is a good test your connection is working.

I use an app called Fing on my android phone to test, you can test with that if you can ping clients on your home network.

Using SMB from Android can be tricky, the best app for SMB I found was X-plore
Als using HTTP on my Android phone is troublesome it constantly tries to use https

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
tm2023
DD-WRT Novice


Joined: 29 Jan 2023
Posts: 12

PostPosted: Wed Feb 01, 2023 14:32    Post subject: Reply with quote
The DDWRT router is in normal gateway mode with subnet 192.168.1.1/24.

The Phone is connected to the internet via the IP6 LTE network of German Telekom.

When the Phone is connected to the WG server it connects only to the PC using RDP on 192.168.2.X.

Nothing else. Or if the PC is connected to the internet via the IP6 LTE network of German Telekom with a MIFI Router and connected to the WG server the phone can connect to it on 10.4.0.7.

For HTTP from the phone only 192.168.1.1 and the static IP of the DDWRT Router 192.168.2.X are working.

On the 192.168.2.1 Router (Speedport from Telekom) there is also running a WG server. With this
the phone has no problems. But the speedport does not support a spoke topology.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12835
Location: Netherlands

PostPosted: Wed Feb 01, 2023 14:41    Post subject: Reply with quote
I am running exactly the same setup, my WG server is also a secondary router behind my main router.

I have no problem with my Android phone reaching everything on the WG server routers subnet and on the Main network and have internet access via my WG server, but I have IPv4.

If your phone is using IPv6 then I suspect that that could be the problem.

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12835
Location: Netherlands

PostPosted: Wed Feb 01, 2023 14:54    Post subject: Reply with quote
BTW It is advised to Disable CVE mitigation.
_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
tm2023
DD-WRT Novice


Joined: 29 Jan 2023
Posts: 12

PostPosted: Wed Feb 01, 2023 14:57    Post subject: Reply with quote
The "DDWRT Wireguard (server) setup guide" suggest to switch it on if you may be a target.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12835
Location: Netherlands

PostPosted: Wed Feb 01, 2023 15:38    Post subject: Reply with quote
Not really:
Quote:
Starting with build 41812 the patch can be disabled, which is sometimes necessary to get access to LAN clients. I have it disabled.


If you really want it enabled you might need the described workarounds.

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
tm2023
DD-WRT Novice


Joined: 29 Jan 2023
Posts: 12

PostPosted: Wed Feb 01, 2023 15:49    Post subject: Reply with quote
I configured the DDWRT from factory reset.

iptables -t nat -I POSTROUTING -o br0 -s $(nvram get oet1_ipaddr)/$(nvram get oet1_netmask) -j MASQUERADE

was already set, I don't know why.

I have controlled ist with:

iptables -t nat -v -L POSTROUTING -n --line-number

The question is, is DDWRT save from 41812 without the patch. Has the rp_filter been set to strict mode?
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12835
Location: Netherlands

PostPosted: Wed Feb 01, 2023 15:57    Post subject: Reply with quote
I think DDWRT is one of the few firmwares which even have this option, most others do not bother, it is a very minor risk and I have it disabled.

But if you want it enabled and use one of the described workarounds then you are good.

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
tm2023
DD-WRT Novice


Joined: 29 Jan 2023
Posts: 12

PostPosted: Wed Feb 01, 2023 16:30    Post subject: Reply with quote
I have first tried r51530. But there sshd was broken, at least om my router. Is there any information which builds will work without problems?
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12835
Location: Netherlands

PostPosted: Wed Feb 01, 2023 16:47    Post subject: Reply with quote
SSHD is not broken but has been upgraded.

Quote:
If you have trouble connecting with SSH then download the latest Putty and make sure under SSH/Host keys to move ed25519 to the top and untick "Prefer Algorithms for which a host key is known" or forget/remove your known HOST keys (the fingerprints) from your computer.

If you have trouble connecting with WinSCP under Tools/Clean up Clear Cache

See also: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=333540

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
tm2023
DD-WRT Novice


Joined: 29 Jan 2023
Posts: 12

PostPosted: Wed Feb 01, 2023 16:56    Post subject: Reply with quote
Thanks, than I will give it a new try. Is an update possible or is a factory reset (especially regarding WG and Routing) necessary?
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12835
Location: Netherlands

PostPosted: Wed Feb 01, 2023 17:06    Post subject: Reply with quote
It is not an old build you are coming from, so I would simply upgrade.

If you experience problems you can always reset to defaults and put settings in manually, but first try with simple upgrade.

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum