There have been multiple accounts created with the sole purpose of posting advertisement posts or replies containing unsolicited advertising.

Accounts which solely post advertisements, or persistently post them may be terminated.

[Fixed] Weird Wireguard issues I could use some help with.

I’ve hit a wall with a weird Wireguard issue. I’m trying to connect my phone (over cell) to my home router using wireguard and it will not connect.

  • The keys are all correct.
  • The IPs are all correct.
  • The ports are open on the firewall.
  • My router has a public IP, no CGNAT.

The router is opnsense, I have a tcpdump session going and when I attempt a connection from the phone I see 0 packets on that port. I am able to ping the router and reach the web server sitting behind it from the phone.

I have a VPS that I configured WG on and the phone connects fine to that. I also tested configuring the VPS to connect to my home router and that also works fine.

I’m really at a loss as to where to go next.

Edit 2: I completely blew out the config on both sides and rebuilt it from scratch, using a different UDP port, and it all appears to be working now. Thanks for everyone’s help in tracking this down.

Edit: It was requested I provide my configs.

opnsense:


<span style="color:#323232;">####################################################
</span><span style="color:#323232;"># Interface settings, not used by `wg`             #
</span><span style="color:#323232;"># Only used for reference and detection of changes #
</span><span style="color:#323232;"># in the configuration                             #
</span><span style="color:#323232;">####################################################
</span><span style="color:#323232;"># Address =  172.31.254.1/24
</span><span style="color:#323232;"># DNS =
</span><span style="color:#323232;"># MTU =
</span><span style="color:#323232;"># disableroutes = 0
</span><span style="color:#323232;"># gateway =
</span><span style="color:#323232;">
</span><span style="color:#323232;">[Interface]
</span><span style="color:#323232;">PrivateKey = 
</span><span style="color:#323232;">ListenPort = 51821
</span><span style="color:#323232;">
</span><span style="color:#323232;">[Peer]
</span><span style="color:#323232;"># friendly_name = note20
</span><span style="color:#323232;">PublicKey = 
</span><span style="color:#323232;">AllowedIPs = 172.31.254.100/32
</span>

Android:


<span style="color:#323232;">[Interface]
</span><span style="color:#323232;">Address = 172.31.254.100/32
</span><span style="color:#323232;">PrivateKey = 
</span><span style="color:#323232;">
</span><span style="color:#323232;">[Peer]
</span><span style="color:#323232;">AllowedIPs = 0.0.0.0/32
</span><span style="color:#323232;">Endpoint = :51821
</span><span style="color:#323232;">PublicKey = 
</span>
stown ,
@stown@sedd.it avatar

The allowed IP’s for your peer should be 0.0.0.0/0 NOT /32. (That literally means that only IP 0.0.0.0 is allowed). I’m pretty sure that’s your problem since 0.0.0.0 is not a valid IP that anyone is assigned.

SeeJayEmm OP ,
@SeeJayEmm@lemmy.procrastinati.org avatar

Well, that was a silly mistake. Thanks for noticing it. I rebuilt the client side several times yesterday, so I can’t say for certain I made that typo each time, but it’s possible.

I just blew out the whole thing, both sides, and rebuilt it from scratch using a different UDP port and it’s all working now.

vzq ,

Test if you can get UDP to your server. Some mobile providers block UDP to residential ranges because of DDOS concerns.

You might have to move ports.

SeeJayEmm OP ,
@SeeJayEmm@lemmy.procrastinati.org avatar

I did configure the VPS to be a client to the opn router and that was able to connect just fine. What I really need is a way to arbitrarily test UDP from the phone, and/or a way to actually do a packet dump on it to see if anything is going out.

Mikelius ,

Is wireguard hosted on opnsense, or an internal device that the port is being forwarded to?

If it’s on opnsense, be sure you route outgoing traffic on that port over the correct gateway, possibly even an extra rule to be sure the proper reply-to is set. Opnsense used to do the gateway routing configuration automatically, but once wg got added to the kernel, you’re now required to manually specify the gateway in your rules for it to work properly.

Also, if you see zero packets, then as others mentioned, try a different mtu. Some service providers (mobile, and even hotels) try to block all VPN traffic altogether and they do this by measuring the mtu of the packets. A little tweaking might get it to work, although I’d expect this to have held true for the VPS too, honestly.

SeeJayEmm OP ,
@SeeJayEmm@lemmy.procrastinati.org avatar

Is wireguard hosted on opnsense, or an internal device that the port is being forwarded to? opnsense. I do have the interface and gw configured and was able to successfully connect when I did the test config from my VPS.

Also, if you see zero packets, then as others mentioned, try a different mtu. Some service providers (mobile, and even hotels) try to block all VPN traffic altogether and they do this by measuring the mtu of the packets.

I didn’t think about MTU. I’ll do some research and testing on this today.

A little tweaking might get it to work, although I’d expect this to have held true for the VPS too, honestly.

This is why I’m struggling. Every test I do is successful, by all rights this should be working. Phone to VPS, GOOD. VPS to opnsense, GOOD. Phone to VPS, BAD. Can I see packets from the phone to opnsense, YES, unless it’s wireguard.

I’ll experiment with MTU and see if that bears and fruit. Thanks.

lemming741 ,

Have you been down the MTU rabbit hole? The wg-quick helper scripts are supposed to find the best MTU but I’ve found cases (tethering) where I had to adjust. Too big an MTU and you could silently drop packets.

Are you virtualizing opnsense? I am, and the wg plugins and config felt foreign to me it was easier to virtualize a wg endpoint.

SeeJayEmm OP ,
@SeeJayEmm@lemmy.procrastinati.org avatar

Have you been down the MTU rabbit hole?

No. I’m going to look into that and do some testing today. Perhaps there’s something wonky between my mobile and home ISPs in that regard.

hungover_pilot ,

If your VPS can connect to your home router as a client it sounds like your wireguard server on opnsense is working correctly.

Might be a problem with your phones WG config. Have you tried taking the client .conf file from your VPS and loading it onto your phone to test a working config file?

SeeJayEmm OP ,
@SeeJayEmm@lemmy.procrastinati.org avatar

I didn’t think the wg-quick conf is compatible but I’ll look into that in the am.

lemming741 ,

For the love of all that is holy

At least change the interface IP. I multiboot my laptop and when I copied a wg.conf being lazy, the server basically ignored the newer client. I had to boot back into the OG OS and add a peer via ssh. I’m still learning wg but don’t count on clones interfaces working.

SeeJayEmm OP ,
@SeeJayEmm@lemmy.procrastinati.org avatar

All I meant was, it hadn’t occurred to me that the android app and wg-quick used the same file format. I can certainly give this a try.

ikidd ,
@ikidd@lemmy.world avatar

Show the conf file for your ubuntu endpoint, and maybe a screenshot of the server/peer on the opnsense server. Redact keys and endpoint hostnames.

SeeJayEmm OP ,
@SeeJayEmm@lemmy.procrastinati.org avatar

I’ll have to do that in the morning.

nightrunner ,
@nightrunner@lemmy.world avatar

Did you setup a NAT on the firewall? You have to setup a static NAT on the interface that your Public IP sits on and to the private IP address of your VPS (you are using a private network space from one of the other interfaces on your FW right?).

Make sure that the policy that you create with the NAT includes UDP 51820 (unless you changed the default port) People often mistake using TCP which is a different protocol. If that doesn’t work, then look at the traffic on your FW

nightrunner ,
@nightrunner@lemmy.world avatar

Meant to say if you still get stuck, run Wireshark on your FW and your VPS and run a tcp dump and filter the traffic to see where the data stops.

You can also use traceroute to your public IP on the port 51820 and check your connectivity or even curl: -v //publicip:51820

taaz ,

Yeah I would probably try if the phone can actually access anything on that port.

On router: netcat -vvvl 0.0.0.0 51820
On phone: http://router_ip:51820

The browser will fail opening it but on router you should see the first incoming HTTP GET packet.
Or one could run a local shell on the phone (assuming android) and try netcat too.

(or this http server one liner python3 -m http.server can be used instead of netcat)

SeeJayEmm OP ,
@SeeJayEmm@lemmy.procrastinati.org avatar

I have an network tools app that lets me test arbitrary ports and I do see those packets on a tcpdump, but this app (and you’re suggestions above) are all TCP while Wireguard listens on UDP. I haven’t come up with a way to test UDP from the phone yet.

taaz ,

Netcat can do UDP with -u flag, to get netcat on the phone (android) you could try local shell (Connect Bot app can do it) and try calling the local netcat (nc, though it’s a simple busybox implementation so it might not have all the features). Not sure if it would let you send udp just like that.

nightrunner ,
@nightrunner@lemmy.world avatar

They call it a tcpdump but Wireshark analyzes all network traffic. You can use the udp.port == 51820

Do you have a laptop? Probably more tools and easier to test from there.

SeeJayEmm OP ,
@SeeJayEmm@lemmy.procrastinati.org avatar

There’s some confusion here. I’m running wireguard on my opnsense router and I’m trying to connect my Android phone to it.

I just used the VPS to help troubleshoot to show other clients can connect to opnsense AND the phone can connect to other servers but the phone and opn won’t talk.

I know this screams config issue. I’ve gone over it and rebuilt it multiple times. I can’t find anything wrong. Someone else asked to see configs so I’ll post those tomorrow.

stown ,
@stown@sedd.it avatar

It is a config issue. Allowed IPs for your client should be 0.0.0.0/0 not 0.0.0.0/32

Decronym Bot , (edited )

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters More Letters
HTTP Hypertext Transfer Protocol, the Web
IP Internet Protocol
NAT Network Address Translation
TCP Transmission Control Protocol, most often over IP
UDP User Datagram Protocol, for real-time communications
VPN Virtual Private Network
VPS Virtual Private Server (opposed to shared hosting)

[Thread for this sub, first seen 20th Dec 2023, 02:45] [FAQ] [Full list] [Contact] [Source code]

taaz , (edited )

This probably does not apply for you but don’t try sending wg over port 53, learned the hard way some routers simply won’t pass non-dns packets there.

Otherwise considering you are able to access VPS stuff from phone but not the router connected to the same VPS then I would check

  • if forwarding is enabled on the vps
  • if you can’t see any packets on the router side then it sounds like a routing issue at the vps

E: I am too baked and assumed you are trying to have the VPS as a central hop point.

SeeJayEmm OP ,
@SeeJayEmm@lemmy.procrastinati.org avatar

My backup plan is to route the traffic through the VPS to the home network. I was hoping to avoid that hop.

baascus ,

I’ve encountered a similar issue with WireGuard on my iOS and macOS devices. On iOS, I need to first connect to the VPN, then disable and re-enable both Wi-Fi and cellular data before the traffic begins flowing through the tunnel. On macOS, the process involves connecting the tunnel and toggling Wi-Fi off and on. It seems like I have to reset the network connection on the device after establishing the tunnel to get it working. I’m also using OPNsense with the WireGuard plugin.

Sounds like it may be the same issue so I hope that this helps!

SeeJayEmm OP ,
@SeeJayEmm@lemmy.procrastinati.org avatar

I’ll give it a try, thanks.

revv ,

One issue I’ve had in some networks is that wg will connect, but not receive any traffic from the network. You can try to set up a static route for your wg subnet pointing at your wg server’s local IP.

No idea if that’s your issue though.

SeeJayEmm OP ,
@SeeJayEmm@lemmy.procrastinati.org avatar

It definitely not connecting. I get no handshake stats on either side and my tcpdump shows 0 packets to try and even initiate the tunnel.

tagginator Bot ,

New Lemmy Post: Weird Wireguard issues I could use some help with. (https://lemmy.world/post/9772632)
Tagging:

(Replying in the OP of this thread (NOT THIS BOT!) will appear as a comment in the lemmy discussion.)

I am a FOSS bot. Check my README: https://github.com/db0/lemmy-tagginator/blob/main/README.md

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • [email protected]
  • random
  • lifeLocal
  • goranko
  • All magazines
    •