[San_Bastiano_90]

Hey community,
I recently setup my Asus RT-AC56U with dd-wrt (v3.0-r59429 std (01/31/25)). The router is configured as 'repeater bridge' and is connected successfully to my main router. Additional to that, I setup (see attached screenshot) a WireGuard tunnel (provider: Surfshark) by using a config file and their provided tutorial. Accordingly to the WireGuard status, it successfully established a connection to Surfshark (status: endpoint: 185.141.119.68:51820 latest handshake: 4 minutes, 8 seconds ago transfer: 92 B received, 320.72 KiB sent). But as you can see, there is no traffic routed via this tunnel. I also followed the setup guide pdf provided in this forum.
When I enter the command 'ip route show', I can see that the default is not the tunnel. So, I manually changed that to the tunnel (oet1) by entering the command 'ip route add default dev oet1'.

0.0.0.0/1 dev oet1 scope link
default dev oet1 scope link
10.14.0.0/24 dev oet1 scope link src 10.14.0.2
127.0.0.0/8 dev lo scope link
128.0.0.0/1 dev oet1 scope link
149.154.159.92 dev oet1 scope link
162.252.172.57 dev oet1 scope link
192.168.178.0/24 dev br0 scope link src 192.168.178.2

Result: There is still no traffic routed via the tunnel.
By visiting e.g. https://whatismyipaddress.com/, I noticed that it still exposes my real IP.
I would really appreciate your help for figuring out the problem.

[Wizo]

https://support.surfshark.com/hc/en-us/articles/7161303618834-How-to-set-up-WireGuard-on-a-DD-WRT-router

MTU to low :1420
Keep alive :30

[San_Bastiano_90]

Thanks for the respond, but the problem persists.

[Wizo]

Works great here, must be your network settings.

[San_Bastiano_90]

Maybe I give you some background information on my setup. My main router has the IP: 192.168.178.1. The Asus router has the ip: 192.168.178.2 and its gateway/local dns: 192.168.178.1.
Basically, I followed the instructions I found online for setting it up as a repeater (see attachement). Do you think this could cause a problem (the repeater function works perfectly)?

[Wizo]

Sorry I am not knowledgeable in such matters, One of the bigger boys will need to comment on that!
But wireguard Surfshark works fine with DDWRT.

[San_Bastiano_90]

Ok, thanks anyway. I guess your router is directly connected to the internet, right? Hopefully someone has an idea...

[egc]

[San_Bastiano_90]

Thanks for the tip. I will try it and keep you posted.

[San_Bastiano_90]

I followed the instructions stated in "DDWRT WireGuard Advanced Setup v26.pdf".
Instructions on page 2:

DHCP server Disabled (=off and NOT set as Forwarder!) (deactivated any when using repeater bridge)
IP outside DHCP range
Gateway and Local DNS pointing to primary router
DNSMasq enabled
Router in Gateway mode
Computer is connected wirelessly to the repeater
Firewall is off

I also added to the firewall the following commands:

iptables -t raw -D PREROUTING -j NOTRACK >/dev/null 2>&1
iptables -t raw -D PREROUTING -j CT --notrack >/dev/null 2>&1

Instructions on page 6 (Client on WAP):

NAT via Tunnel: Enable
Allowed IP's: 0.0.0.0/1,128.0.0.0/1
Route Allowed IP's enabled
Endpoint address: servers address and port

Result: Afer rebooting, the Asus router is working as repeater and the WireGuard tunnel itself is running (handshake took place). But, my real IP is still exposed => For some reason the tunnel is still not used .

[egc]

that is expected as traffic just bypasses your router as it is a repeater/WAP.

Only if you use a guest wifi (VAP on a WAP) then your traffic will go through the router and thus will use the VPN.

Alternatively point your LAN clients (computer/laptop) to use the repeater as gateway

For VAP on a WAP see the paragraph in my notes: https://github.com/egc112/ddwrt/blob/main/DDWRT%20Virtual%20Access%20Point-9.pdf

You can download it by clicking the download icon

[San_Bastiano_90]

I think I setup already a "guest" WIFI (see attached screenshot). The Fritzbox is the primary router the Asus connects to. Please correct me if I am wrong

[egc]

Not really it is just another SSID on the same bridge/subnet

Use the 5 GHz Radio as the 2.4 GHz is already doing the back-haul

On the 5 GHz Radio setup a guest wifi according to the doc I linked, use the "Bridge Setup" that way you can also add some LAN ports to this guest wifi if needed

[San_Bastiano_90]

Ok. Is it also necessary to setup it's own DHCP Server or should I go with the simple setup as described?

[egc]