How to set up WireGuard VPN with a QHora 301W

[@rvamerongen]

Thank you, but not everything is entirely clear. What is Service Port Management and Router Service Ports doing with the VPN WG setting? If i want to use f.e a different port? Or I want only connect to lan port 1? Do the port 1 have the same subnet as the subnet used bij the WG VPN?

[@aleksandrs-AB1]

good - but why i canot acces to other sites like google facebook and so on - after i swiched it

[@guo235]

There is a bug here. The secret key used in other wireguard client shoud not be saved in qhora wireguard client. In some situation, the user may want to use one wireguard profile to access multiple servers on the internet, you should let the user add the public key in qhora, and not keep the private key. Others who can access the router may see the private key which they should not know.

[@qnapsys]

Hello F Spear, Thank you for the feedback, and we would like to provide more QHora-301W product information. For WireGuard service deployment, QHora-301W will store WireGuard client profiles once created. To ensure information and data security, QHora-301W will ONLY allow admin to log in and download/review WireGuard client profiles. Other users cannot retrieve WireGuard client information. We'll continually improve product features and keep focusing on network secuirty. Thank you, and please let us know if any further assistance required.

[@guo235]

@@qnapsys This cannot be a convicing reason why the router keeps the private key. Talking about the ssh tunnel, I don't think users will register their public key and private key on the server.

[@WW-yr3mx]

​@@guo235 The WireGuard client here was generated by QHora-301W. In my opinion, QHora-301W actually doesn't keeps the private key from user if the user create the WireGuard profile by themselves. It's also can't be done. Just as you mentioned, the private key is kept from user side, it doesn't register to server.

[@guo235]

@Frank Liao If user lost the private key, they should generate a new key pair and send the public key to the administrator. The administrator will delete the expired public key and register the new public key. The administrator will inform the user the public key of the server, the global ip address of the server, and the vpn address that the user can use to access the server. Your solution seems convenient, but I don't think this is a standard way for a business situation.