VPN for your Home Network with Wireguard on OpenWrt and iphone connecting to linux VPN

[@OneMarcFifty]

Chaps, if you are having issues with building the VPN etc, please join me on discord - see details in this video kzbin.info/www/bejne/jKDYdHWqZrOHoNk and we can troubleshoot it LIFE!!!

[@eroldp4106]

Hallo Marc, habe ein Problem, kannst vielleicht mir Helfen? Habe eien OpenWRT basierende LTE-Router. Wireguard kann habe ich schon als Packet installiert. Habe einen Cloud-Server auf Hetzner, der als WireguardServer (auf Debian) agieren soll mit öffentlicher IPV4-Adresse. Habe Überwachungskamera die ich an LTRE-Router anschliesse via Netzwerkkabel. Habe ganze Wireguard-Konfigurationen gemacht, auf Clodserver, meinem Windows-Laptop und auf LTE-Router. Aber auf Kamer habe ich keinen Zugriff. Auf Router habe ich Zugriff. Anders gesagt, bis Router habe ich Zugriff über den Tunnel. Das Problem liegt glaube ich an NAT, Routing, Firewall. Mein Router ist Teltonika RUT950. Danke im Voraus.

[@manosioa]

This is one of the best and most conclusive videos ever made for this subject. Thanks so so much

[@OneMarcFifty]

Many thanks Manos, that’s very flattering (*blush*) 😉

[@tolisl5013]

Marc you rock! Thank you very much. I have transitioned from a, 10 years old but trusted, SSH tunneled port forwarding configuration to wg in order to access my lan resources. It is much more convenient. You have a top class channel in here I say. Well done!

[@OneMarcFifty]

Many thanks for your friendly feedback!

[@MrClump]

Excellent tutorial and script. One thing worth pointing out is the line "opkg install wireguard" at the top of the script needs to be changed to "opkg install wireguard-tools" to work with the current version of OpenWRT. Otherwise, it all worked flawlessly!

[@OneMarcFifty]

Hi Michael, thanks for pointing this out. I've changed the script.

[@mindfuloftech]

Perfect, thanks Marc! After following (and being confused by) a few different guides yours worked perfectly! It took me a while to figure out you need to restart the interface after setting up the peer, I wrongly assumed save & apply would do this. I also had to clean up old keys and regenerate them from the interface because I had tried a couple of other methods before and made a mess. Your channel is a treasure trove of network shenanigans, thanks again!

[@OneMarcFifty]

Thank you very much ! Yes, I get caught by that on and on as well - you really need to restart the Wireguard interface, otherwise changes are not taken into account.

[@SergeyBarkovskiy]

As usually - very well and detailed described. Breath of the air in learning OpenWRT world. Spoken with so much care and attention also to small details. Awesome - thanks again!

[@OneMarcFifty]

Hi Sergey, many thanks !

[@grubost]

​@@OneMarcFifty I'm also Sergey and I confirm everything my namesake said. Keep it up, Marc!

[@krishnatejjami4669]

Thank you for this. Was trying to setup a vpn to access my freenas server remotely. Really helped!

[@OneMarcFifty]

Excellent, I am happy that it could help you.

[@PowerPlay25kV]

Love your videos Marc! Your teaching style is superb and you have a great and fun way of explaining complex IT aspects. Would you be interested in doing an updated version using Luci to show how to set up a home OpenWRT Wireguard server that mobile phones can connect to?

[@welliolima8392]

Very good!!! Excelente!!! Congratuletions!!!!!!

[@OneMarcFifty]

Thanks a lot!

[@yuryluneff]

Thank you! Did help to me today. Cheers!

[@OneMarcFifty]

Awesome - glad it helped ;-)

[@stefanosapostolopoulos2900]

thank you for your help Sir. i would like to leave a comment about this. I add 2nd peer for my pc. and enable route traffic. i manage to see that the the gateway of last resort disapeared. Luci was unreachable after some point and ofc no internet. so i reset my router. what i did is to create a static ipv4 route 0.0.0.0/0 to my isp router (xiaomi wan to zte lan )and i set at wan interface the metric to zero just to be sure. At br-lan and wg0 interfaces i set the metric to one. now it doesnt lose gateway of last resort and i hope it wont at future.

[@OneMarcFifty]

Many thanks Stefanos. I have been thinking about doing a Wireguard troubleshooting video for quite a while now. There are many videos on Wireguard, but regularly people run into issues with DNS, routing and crypto routing.

[@DoniSewell]

Very easy to follow. I now have a working WG server.

[@patcheen]

Thanks for the excellent video.

[@OneMarcFifty]

Thank you Pat, much appreciated - I am glad you liked it.

[@RodrigoeBeta]

Hi Marc, I was setting the Wireguard connection from a OpenVPN connection, but accidentally dropped all my LAN from WAN, and subsequently my OpenVPN server. I don't have SSH over WAN enabled, so I'm kind of locked out. I have access to the UDP port Wireguard uses and the Wireguard server is running on my router, I also have the public key, but couldn't add myself as a peer before being locked out. Do I have any chance of logging back in to my router? Of course I have root access, but I'm 5000 miles away from home until July, so kinda desperate. THanks!

[@OneMarcFifty]

Ouch! From what you write I assume that both your Wireguard and Openvpn on the router where in the lan zone? If this is the case then I can unfortunately see no way to het back in from a distance. Also - even if your Wireguard was in a different zone and you could potentially recover the keys locally (from scrolling back in the terminal or the cache of your browser or the like) - as your router doesn’t recognize you as a peer - no chance to het back to it… Did you hit “save and apply?” - you might be lucky if you had waited for luci to time out (in which case the changes you made could have been reverted). In this case, connecting again over openvpn could work. If you refreshed your browser or the like then you’re probably locked out. Do you have ipv6? Maybe you have a slim chance to get to some host in your Lan over ipv6 if you had not locked it down completely. But from what you tell me I would assume that you are unfortunately locked out for good. Sorry….. :-(

[@OneMarcFifty]

Try an nmap to your router’s public address to see if by “chance” you left a port from the wan open. Maybe there is something that can be exploited…

[@OneMarcFifty]

But your best chance would be to have someone go to your home And put the router into recovery mode, revert the firewall change and reboot it I am afraid

[@freestyler5495]

When I connect to my router via wireguard, I can access only local adresses (192.168.1.1.etc). Not internet. Do I need to setup something else also because literally followed tutorial?

[@OneMarcFifty]

Hi it is true that the solution as it is shown is not made to access the internet over the VPN but rather to access internal home resources from the internet. Having said that, if you enable zone forwarding and masquerading from the VPN zone to the WAN zone it should be possible. I haven’t tested this though...

[@OneMarcFifty]

Heya, have you tried this ? Did it work ? Please let me know. If not, I'll mock it up in my environment and provide troubleshooting steps.

[@MrGreeneon]

@@OneMarcFifty I did this and it worked for me, thank you!

[@OneMarcFifty]

@@MrGreeneon Awesome, many thanks for letting us know !!!

[@freestyler5495]

OneMarcFifty I get it to work! Thank you!

[@Raukze]

Hi Marc, great video once again! Could you please also make a video on OpenVPN? What I'd specifically be interested in is the OpenWRT router acting as a OpenVPN client. I would then like to have an interface which is dedicated to that VPN connection to then be able to create a wifi which routes all my traffic through that VPN. This would come in handy as I would then be able to use VPN providers like NordVPN and such to have a wifi network which lets me surpass geoblocking for all devices within that network. Because what I cannot figure out is how to not route the LAN interface traffic through the VPN but only the traffic of a specific network. Do you have a video planned on OpenVPN? Thanks in advance!

[@OneMarcFifty]

Hi, I do have a video in the planning for VPN auto-routing. However, it will presumably not use an existing provider but we will rather build our own with IAC/IAAS providers such as vultr or linode on demand - not sure if I'll cover OpenVPN or Wireguard or both ;-)

[@gordonfreeman8796]

You are doing God's work man. Thank you so much for this.

[@OneMarcFifty]

Thank you

[@namesname7315]

May you do video on how to access home network via VPN if home network is behind multiple NATs?

[@OneMarcFifty]

I'll give that some thought as it comes up quite often. Are you talking about mobile network / USB stick scenario or would you be abe to install something on the perimeter router (i.e. the "last" router that has a public IP address) ?

[@namesname7315]

@@OneMarcFifty There are places where internet is complicated 😊 Situation: We have two ISPs, lets call them (X) and (Y). Y may lend “white” IP, NAT by default. X connected thru Y and not able to provide external addresses to customers, NAT is only option there. We do not have access to any of NATs/ISP configs. For this reason, we can’t expose home router's WAN(W) to internet directly. Even DDNS do not work properly due to double NAT. To get access to W, and therefore to home network, from internet-outside-connected client(C), as I understand, we need to have “leverage”(L) server somewhere outside, in the internet. Just like Hamaci or TeamViewer works - both clients (W and C) connecting to L, establish connection, but all traffic goes peer-to-peer. Do you know any solution to be able to use VPN like that? Or maybe you know something better to expose personal VPN server at router to internet thru multiple NATs? Thx!

[@fernandoariznavarreta4676]

I have followed the instructions step by step, and even downloaded the script and installed it, but cannot stablish a connection. I have revised the traffic rules, key pairs, etc, but still not get a connection, no connection in the wireguard openwrt interface, and no traffic in the mobile. I had it running in a NAS with the ISP router redirecting UDP traffic to it. But I cannot get it working in openWR.

[@OneMarcFifty]

Hi Fernando, the video might have slight bugs here and there - if you check out the discord Server, I have posted screenshots of a working config there

[@germiniano3403]

I followed all the video. Wireguard server is working but when trying to connect I get Sending handshake initiation.... Handshake did not complete after 5 seconds, retrying.... I couldn't reach any lan device in my remote vpn server I verified all public keys but still not success

[@germiniano3403]

fixed the problem using persistent keep alive = 25

[@OneMarcFifty]

That was quick 😉

[@pichonPoP]

I don't know what is happening at my end. I try several guides, posts and videos and nothing can do my WireGuard on OpenWrt works from the outside "from WAN".

[@rantesnaranjo9696]

Hello and thanks for the vid. I configured wireguard on my router but I am having issues connecting to it. I get the same message as somebody else in the comments "Handshake did not complete after 5 seconds, retrying". At first I thought my DDNS was the problem but I tried with the IP to discard name resolution problems and I get the same message. Any idea?

[@OneMarcFifty]

First try to remove the optional "preshared key" - sometimes this is defined only on one side and makes handshaking impossible. Second, double check that port forwarding is working OK if there is a router in between (like your ISP's router), then try setting persistent keepalive to 25. Last but not least double check on all other values (Port number, IP address etc.) If you can't get it to work you can of course join the discord session on sunday

[@andres220]

Omg I had that issue after running the script... turns out I had to restart the WG interface

[@OneMarcFifty]

Many thanks for sharing !!!

[@parvi4love]

I did everything you said but does not work. Used iPhone and Android. First of all the interface is showing up as a VPN and not wg0 imgur.com/a/DHIl60l. Secondly which public key should I insert at 7:11 (kzbin.info/www/bejne/eKCVcqaNaaeAhdE), ? Also, I am not sure if port 51820 is being forwarded by my modem to my router. How do I test this out?

[@OneMarcFifty]

The public key that you need to add on your router is the one that shows up on your iphone, i.e. if you go to the wireguard client, then click on the connection you see your own public key and that of your peer. You need to put your own public key into that input line of the remote. I do not know why your interface shows up as "vpn" rather than wg0. Which version of OpenWrt are you using ? Maybe it's a bit older ? Last ressort you might just rename it... Port forwarding can be tested in various ways. First you need to make sure that you connect to the right device, meaning if you are using Dynamic DNS check with the IP address first. Then you could either open a port on a well known service such as ssh and see if you can connect. Did you configure port forwarding at all ? Second solution would be to use a tool such as wireshark or even nmap would do in order to see if the packets get a reply back. Third possibility but this is hardware and firmware dependent would be to check if you have access to any logfiles on the modem. Hope that helps ;-)

[@OneMarcFifty]

If you can‘t get it to work please join me on discord this Sunday and we can fix it together

[@parvi4love]

@@OneMarcFifty Thank you for your reply. I was running an almost updated version of OpenWRT but I also flashed my router to be on the safer side. I also found the reason why my interface was being shown as VPN instead of WG0. I had used the code from openwrt.org/docs/guide-user/services/vpn/wireguard/server instead of using your GitHub code word to word. My router is behind a modem and I have forwarded 51820 on the modem (i.imgur.com/eRRPnbL.png). My IP is static for now and does not change very often therefore I am using my global IP address to use it on my iPhone. Here are my configurations that you may please look at and let me where I may be wrong. i.imgur.com/azYAtth.png i.imgur.com/0bxzCQI.png i.imgur.com/e1gLOxe.png i.imgur.com/TQKb3Lg.png i.imgur.com/93TqZ7k.png

[@parvi4love]

@@OneMarcFifty I will appreciate it if you can help me fix it up, please. Share the link where I can join you.

[@OneMarcFifty]

discord.com/invite/DXnfBUG - see details in this video kzbin.info/www/bejne/jKDYdHWqZrOHoNk

[@unmesh59]

Is there a way with Wireguard to access my LAN from a friend's house who uses the same IP addresses on his LAN as I do on mine?

[@OneMarcFifty]

Creating a VPN connection between the two will be easy (i.e. VPN to the endpoint from where you are) as the VPN network will have a different IP range. Where things will become difficult is when you want to do LAN-to-LAN routing - that might require some Layer2 tunneling (batman or the like) to put both networks on the same switch. How exactly would you want to connect them (might be easier to change the IP range for one of you though ;-) )

[@unmesh59]

@@OneMarcFifty I suppose the more general question is what to do if my subnet is used somewhere on the originating network before it hits the Internet. Maybe the answer is to reduce that probability by using something less common than 192.168.1.0/24 🙂

[@antonnosov2846]

Dear Marc, Thanks for your videos! It help me a lot. Could you please share information how it possibly to set up two WireGuard connections at the same time on OpenWRT. One for connecting to the home network from mobile devices, the second for outputting traffic. Thank you!

[@OneMarcFifty]

Hi Anton, I‘ll have a look into that - a scenario that I want to address is VPN on demand. Like connect to one wifi with vpn and another one without vpn. Your suggestion adds another interesting scenario here.

[@BrendanGrainger]

Fantastic thank you!

[@OneMarcFifty]

You're welcome, glad you liked the vid ;-)

[@garygravett9641]

Hi, do I need to setup a ddns like Duckdns first and how to get it’s IP?

[@OneMarcFifty]

Hi Gary, if you want to VPN into your home then yes, you would either have a fixed IP or use Dynamic DNS

[@garygravett9641]

@@OneMarcFifty thanks

[@fredrikrutgersson]

Hi Thanks for the inspiration. I have an OpenSwan IPSEC tunnel today(OpenWrt) but think Wireguard looks very interesting and I plan to rebuild it during the Christmas weekend. Are there any changes in the new OpenWrt 21?

[@OneMarcFifty]

Hi Fredrik, none that I would be aware of w/r to Wireguard really

[@gurkancekic9057]

Hi OneMarcFifty , at the end when connecting from phone i have got this fault message " Error bringing up tunnel :At least one address must be specified" , i followed your instructions and script . thank you for your videos .

[@OneMarcFifty]

Hi Gürkan, I've noticed that Wireguard can be tricky to troubleshoot. I might at some point do something more in detail on this. Many thanks for your feedback!

[@robloxrainbowtwins3889]

VPN is not working for me. I have one doubt and I guess it is the problem. What's the IP you added with port number in the App. You said DNS. But which DNS is that?

[@OneMarcFifty]

You can use any - either your main router or google or cloud flare

[@DetHjemme]

Hi, i have a home server which run website on it with letsencrypt + nginx. And have wireguard vpn subscription. I can connect to wireguard from the home server very simply. But my website can't be reached any more on port 443 or 80. Should forward port 443 and 80 on my server or contact the provider to let the port open? Any tutorial from you i've missed? PS: the ports are already open in my openwrt and works fine. But not after starting the wireguard. Thanks in Advance

[@OneMarcFifty]

Hi, that would really need a closer look into how you set up routing and forwarding. If you want then you can share your config on the discord server.

[@zeal514]

Interesting. How does this work in relation to VLANS?

[@johnwashifi]

Hello, how to connect form Linux using networkmanager? thanks!

[@OneMarcFifty]

Hi John - sounds like a subject for a video on its own ;-) In order to not keep you waiting until then you may check out Thomas Haller's blog here : blogs.gnome.org/thaller/2019/03/15/wireguard-in-networkmanager/ he describes the necessary steps or some of the service providers do have good howtos as well, like ivpn: www.ivpn.net/setup/wg-linux-netman.html Let me know if this helps.

[@johnwashifi]

@@OneMarcFifty hello, thanks! But I need something simpler for the graphical interface. Could you make one video showing it? thanks again in advance.

[@OneMarcFifty]

I’ll think it over 😉

[@rene.schultze]

Hello Marc, do you know if a Wireguard server could run on a dumb AP in the same network as the AP? I do get a VPN connection - peer connection shows up - but cannot ping the peer or server. Is it possible with Firewall & dnsmasq off as recommended? Thank you very much in advance!

[@OneMarcFifty]

Hi Rene, yes you can do it that way. You would however need to add the routes manually (or using the PostUp/PostDown settings in th Wirguard Config File. Problem is that the Access point is presumably not the default gateway for the other nodes and hence you would need to add those routes by hand. Potentially you would also need to use masquerading. See lines 150-160 in this code github.com/onemarcfifty/wireguard_vps_vpn/blob/master/wireguard.sh for an example on how to set up masquerading.

[@chesshooligan1282]

Nothing terrifies me more than some hacker accessing my security camera and finding out what's going on in my garden.

[@tomduca]

Hi Marc! This is great! Thank you once again. I have it up and running in my tplink C7. My question: would you recommend to configure in the iPhone the option On Demand for every unknown/public wifi? I am thinking my own known secure network will be always better than a public one, right?

[@OneMarcFifty]

Hi Tomás, well - it depends ;-) Bandwidth will be slower of course if you first go through the VPN - but in essence it depends who you trust more - your home's ISP or the 4G network ;-)

[@PeterParker-ji8kg]

Hi, I installed that package wireguard qrencode and luci-app-wireguard but the button to view the qrcode of the vpn is not there! Strange right? thank you in advance for your help.

[@OneMarcFifty]

Hi Peter - yes the LuCI interface of Wireguard has changed

[@maartenvalk3446]

Hi Marc, many thanks for your nice videos! I tried to follow your guide and ran the script on my Openwrt 22.03. However it does not seem to work, I do not get the same screens as you show in the video. Has anyone applied this on 22.03?

[@OneMarcFifty]

The package name had changed from wireguard to wireguard-tools. The script should be updated.

[@henning7801]

Hello Marc, I found the video to be quite good at first view, but now it is much too superficial. I am missing essential background information. Finally, I can simply copy the commands from the OpenWrt Wiki without knowing what I'm doing. No video needed ... Please understand this as constructive criticism to further improve your videos. After all, you have a gift for explaining complex things simply. Or just tell me "shut up". For example, what is the effect of the 'uci rename firewall. @ Zone [0] = "lan" ' command? Is it even allowed to use it like this if you had previously deleted all firewall zones and then perhaps set them up again in a different order? So basically the question arises whether I can only do this after a factory reset. What if I have already set up various firewall zones, VLANs and so on? Are they untouched or destroyed afterwards. The part about the firewall is even more opaque. What exactly is being set up there? A forwarding rule, a traffic rule or a zone or both? So I decided to execute the commands by hand via ssh. 2 commands don't seem to be necessary at all. It works for me without them ... uci rename firewall. @ zone [1] = "wan" uci rename firewall. @ forwarding [0] = "lan_wan" And when I look in LuCi afterwards, it looks like it is actually a traffic rule that has been created. In addition, the interface was assigned to the "LAN" zone too. The topic "allowed ips" is also not discussed. The entire network area of ​​the tunnel is allowed with your script. In the wiki only 1 device, namely what is currently being set up, is allowed. 192.168.9.1/24 vs 192.168.9.2/32 Why this?

[@OneMarcFifty]

Hi Henning, first off many thanks for your feedback. Now - I have learnt that there are a couple of challenges with videos about tech. The first challenge is that regardless of the technical level you aim at, you will always fly too high or too low for roughly 80% of the potential audience - that's just a matter of life and statistical spread I assume. So with regards to your questions - yes, it is true that I don't explain the UCI commands etc. Please keep in mind that the main goal of the video is to show how to install wireguard. Another challenge when using script commands to do stuff is that you might find different environments when the script runs. Now I could either add a lot of if...then statements into the script or rather just bluntly say to rename zones into default values. Or - in other words - tell people what the zone is supposed to be. Of course rather than renaming the zone to lan and then set network.lan.x to something I could have used a variable and then set network.$variable to something.. correct. But please keep in mind that my goal is not to sell and document a software here but rather make a video that could be of interest for an as-large-as-possible audience. Now there is another double-cutting sword here. I could of course make the video longer and then just go into details on everything. But this would make the video quite lengthy and looking at the statistics people are more likely to watch a ten minutes video than watch a 30 minutes video... With regards to the allowed IPS, it mainly depends on how you want to set up your interface, i.e. do you want to allow the whole network range or just one device. Mainly the question is how many Wireguard devices will you have connecting to the interface. If it is only one and only one, then set IP/32. If you might add more, then define a larger network. Woaaahh !!!! Long reply! Now _I_ will shut up - hey if you want to discuss or chat be my guest on discord ;-)

[@SteelTumbleweed]

I'm not getting the QR code button even after installing the qrencode package. I'm on 22.03.2.

[@OneMarcFifty]

Had that too - it only works in 22.03 if the private key is present as well

[@SteelTumbleweed]

@@OneMarcFifty Thanks for fast response. The only place I see any sign of QR codes is under Interfaces » WG0 » Edit peer. Not under /cgi-bin/luci/admin/status/wireguard like you showed in your video. Is this the same thing? Is this the new place for it now?

[@OneMarcFifty]

Yes, correct.

[@SteelTumbleweed]

@@OneMarcFifty Thanks, I got this working on my Mac and Android devices but for some reason it doesn't work on iOS. I tried both the QR code and import methods and neither works on either my iPhone or iCloud. Maybe the iOS app is bugged.

[@arioncheng3024]

My Openwrt is behind to my ISP. Virgin media Hub 4 router, I followed you to config ure Wireguard, but it cannot handshake, how can I solve it? Thanks!

[@OneMarcFifty]

Hi Arion, did you forward the port from the outside to the OpenWrt ? Did you add an allow on the Firewall in OpenWrt ?

[@allezvenga7617]

Thanks for your sharing

[@familieortmuller4346]

Hey Marc, thanks very much for your video. It works perfectly. Could you please also show what has to be done, to get internet access for the clients. I tried for more than one day but didn´t get it working :-(

[@OneMarcFifty]

There's a couple of things that typically can go wrong here - first, you always need to restart the wireguard interface on the openwrt router when you make changes. Second, untick the "default gateway" box on the Wireguard interface because otherwise it will mess up the routes on the server. Third, add the Wireguard Interface to the right firewall zone, e.g. LAN or a separate VPN zone that you allow to forward to WAN.

[@AntonioHenrike]

can you do the same video, but, using IPv6?

[@OneMarcFifty]

I'm currently building a web-service bastion host for the family with an IPv6 Wireguard backbone - might pick that up for a video ;-)

[@gartner654]

@7:08 Marc makes a critical error not specifying which of the two "public key" fields from the phone are to be used, and unfortunately he doesn't picture this either. It is *not* the one in the "peer" section on the phone, it is from the top of the screen on mine.

[@OneMarcFifty]

Thanks for pointing this out.

[@JoaquinVacas]

It's been a while I'm looking for some kind of mDNS repeater/replicator/reflector/whatever that works using Wireguard. I have 2 routers using Site-to-Site Wireguard and DNS works fine, etc. But mDNS does not. I was wondering if it's possible to get mDNS working so I can use some of my services on the other red. Mainly network device auto-discovery. Not at all for all use cases, but it would be cool to play music to your Sonos speakers being in another network, just for the "being able to do it". 😂

[@OneMarcFifty]

Have a look at avahi-daemon. It does what you need. You can run it in reflector mode or create your own services files.

[@JoaquinVacas]

@@OneMarcFifty Got it working! Actually it was a bit rough. Main issue was with AllowedIPs not having mDNS IPs, Point to Point enabled in Avahi and (I think it doesn't have any effect) "multicast on" on Wireguard device. Well, had to apply some filtering, Sonos reflection worked, but left it just for printers, remote ADB (for a TV), HomeKit working outside of second home without having an AppleTV, etc. So good!

[@davidw5563]

Funktioniert leider bei mir nicht. Fritzbox 4040, OpenWrt 19.07.8

[@OneMarcFifty]

Hi David, tut mir leid dass es in Deiner Konfiguration nicht klappt. Schau mal auf dem Discord Server nach, dort habe ich vor längerer Zeit mal eine funktionierende Konfiguration geposted.

[@NebelwerferII]

Hi Marc! I'm new to your channel, and I've been devouring all your videos ever since. I've Wireguard set up in a RPI3, but I'm going to try the OpenWRT approach in another router I have. Quick question: In my current Wireguard setup, whenever I'm home and my phone picks up my WiFi, it stops working (I guess I've something routed wrongly), so I'm forced to turn Wireguard off. What would happend with your OpenWRT Wireguard script?

[@OneMarcFifty]

Hi Marcos, I believe you have asked that question on the discord server as well, so please let me relay the answer here. I thought that this would be more or less by design as the VPN would typically be used to get into the LAN from the WAN. However, someone else mentioned that you could set the allowed IPs to something outside your LAN and that would fix it - curious to read from you if this works.

[@tomduca]

Marcos, me arriesgo a que hables español, que así lo puedo explicar más fácil: abajo de todo en las opciones del iPhone tenés Bajo Demanda. Podes configurar ahí que se active la VPN siempre que no estés conectado a tu wifi.

[@CorePeach]

Does this method require public ip? Will this work if my ip is behind a cgnat?

[@WillCarlson]

This is great! How do I easily add multiple clients?

[@OneMarcFifty]

Hi Will, basically you just add additional peers and scan the QR code on them. Just make sure you don't overlap the networks of the AllowedIPs.

[@arioncheng3024]

Can your script be run on DD-WRT? since I have one that run DD-WRT but it cannot convert to OpenWrt, thanks

[@OneMarcFifty]

Hi Arion, I am not sure about that. I haven't used DD-WRT at least for a decade... sorry.... But there is an article on the DD-WRT Wiki here : wiki.dd-wrt.com/wiki/index.php/Wireguard

[@arioncheng3024]

@@OneMarcFifty Thank and let me try to converse DD-wrt to Open-wrt firstly and then try from this video, thanks.

[@OneMarcFifty]

Let me know how it goes!

[@DetHjemme]

Hi, i've done exactly the same with your script and on iphone. But no no connection. My router has 192.168.1.1 adress which wireguard server on it. Even the interface is not connected. Any idea how to fix it? RX: 0 B (0 Pkts.) TX: 0 B (0 Pkts.) IPv4: 192.168.9.1/24 Regards

[@OneMarcFifty]

Hey, you’d need to double check on everything then - do you have port 51820 udp forwarded to your router? Firewall open? All keys ok? Maybe jump on the discord server and share some screenshots?

[@DetHjemme]

@@OneMarcFifty Thanks again, double checked my config. i've decided to use copy and paste via SSH not the openwrt LUCI. it's working now. Regards

[@arioncheng3024]

May I know if I have more than one Mobile phones which like to connect WireGuard at the same time, is it change from the Address from 192.168.9.18/32 to192.168.9.1/24? I have changed it but no work! Could you give me advice? thanks.

[@OneMarcFifty]

Hi Arion, I think I’ll make a separate episode on Wireguard at some point.

[@jcw232000]

I have a wireguard server i created i want openwrt to conect to it

[@sledgeHammerRulez]

Hi Marc, how can I know that I have enough resources for installing WG on my OpenWRT router? It is rather light router (in resources and weight :D). TPlink TL-WR104ND v4 Openwrt 19.07.3 (but it should be upgradeable) Load: 0.65 0.19 0.07 Memory: 27.02 MB/ 58.15 MB

[@OneMarcFifty]

I’d just test it ;-)

[@sledgeHammerRulez]

@@OneMarcFifty Always test in IT :p I will try and if I don't forget, report back here my findings.

[@xenstarnetwork5333]

Thanks a lot for the script. Ｉ was able to setup it easily with your script. But now I am finding it very hard to generate QR code, or create additional users, so I can let access some other people access my NanoPi R2S router.

[@OneMarcFifty]

Hi, what exactly is the problem when adding others or printing QR codes ?

[@tomduca]

Hi once again Mark!! One quick question: will this script work with OpenWrt v21? Or it needs to be tweaked due to the change from swconfig to DSA? I’m case it needs to be “fixed”, are you planning to publish the v21 version? Thank you!!!

[@OneMarcFifty]

Hi Tomás it should work with V21, as I am not using any specifics such as VLAN etc. I haven't tested it though ;-(

[@vorjak]

Hi, ist es möglich das tolle Video auch auf Deutsch zu machen! Ich habe eine aktuelle Version Openwrt 22.03.02 und möchte gerne per Wireguard von zu Hause auf mein weiteres Netzwerk an einem anderen Standort zugreifen. Das Script lief teilweise auf Fehler und ich habe es versucht manuell mit Hilfe diese Video anzulegen. Das klappt allerdings noch nicht. Ich würde gerne mit einem Linux Laptop von zu Hause per wireguard auf mein System - Router zugreifen und dort auf ioBroker System zugreifen. Das wäre genial.

[@OneMarcFifty]

Hi Volker, Du kannst die automatische Übersetzung für Untertitel aktivieren - vielleicht hilft das ;-) Ich muss demnächst mal die ganzen Skripte, die ich in Videos verlinkt hatte prüfen - da sind sicher ein paar Versions-Themen drin.

[@nickturin432]

How to deactivate Wireguard?

[@OneMarcFifty]

Hi Nick, in order to deactivate Wireguard you need to deactivate the wg0 interface, either in luci or in ssh with ifconfig wg0 down. If you want to get rid of it completely, just uninstall the wireguard software

[@nickturin432]

OneMarcFifty I turn off the wg interface in the graphical shell, but then the Internet disappears.

[@OneMarcFifty]

Then probably you have ticked the box “set default gateway”? Untick it. In order to repair, up and down your wan interface - that should restore default routes

[@OneMarcFifty]

Hang on, which device are we talking about ? The openWrt router?

[@JordanCricketMoore]

What is the value of WG_ADDR6 in your script? Can that be changed to anything?

[@OneMarcFifty]

Hi Jordan, this is the IPv6 address of the wireguard interface. If you are not using IPv6 you can remove it but you would also need to remove the line that assigns it via uci: uci add_list network.${WG_IF}.addresses="${WG_ADDR6}" and later uci add_list network.wgclient.allowed_ips="${WG_ADDR6%/*}/${WG_ADDR6#*/}" - alternatively you can of course change it as wanted/needed.

[@andry6609]

Great tutorial and script! Sadly my setup can't establish handshake, not sure why. Some bits of data was transmitted though. I wonder whether I should ask my isp to open up port 51820? Anyway I intend to access my local Shinobi server from outside.

[@OneMarcFifty]

First try to remove the optional "preshared key" - sometimes this is defined only on one side and makes handshaking impossible. Second, double check that port forwarding is working OK if there is a router in between. Then try setting persistent keepalive to 25. Last but not least double check on all other values (Port number, IP address etc.) If you can't get it to work you can of course join the discord session on sunday. Port forwarding needs to be done on your ISPs router only if you are coming from the outside i.e. the internet. Usually ayou can do that on your own.

[@andry6609]

@@OneMarcFifty I have read this in other comment and by setting persistent keep alive I can establish a handshake. Hurray! But the connection is very slow and the live view doesn't load up. After researching possibly I'm in double nat and that slow things down, perhaps??? Sadly I can't do anything with the ISP router. It is totally blocked for cofing.

[@Thanhvo31]

Thank you. Finally I can config my Netgear R7800 openwrt with your script. But how about 2nd or more client setup?

[@OneMarcFifty]

In essence you would just need to add more peers on the wireguard interface.

[@DrGamingDude]

Make sure your VPN client's DNS is using the VPN interface's IP or else you'll have a DNS leak.

[@OneMarcFifty]

Great point, many thanks for the comment - however, this is more relevant in a scenario where you use _outbound_ VPN (i.e. you want to cover traffic by using a public IP VPN) as opposed to the here suggested scenario which is _inbound_ VPN (i.e. connect to your home environment in a secure manner from the internet).

[@ah-nv7mw]

i don't recommend to use this script i screwed my network.lucky i have backup

[@OneMarcFifty]

First off, I am sorry that the script didn't work for you - it's true that a script can never check for all eventualities. But you're raising an important point here - folks, if you run scripts or stuff, please make sure that either you feel comfortable reverting your stuff back if things go belly-up or - like the commenter - you have a backup. If you need help, please check in my discord server at any time.

[@Putin-Lox]

Wireguard простой , но очень не надёжный, даже сам линк восстанавливать не умеет.

[@OneMarcFifty]

Hi, when you say that the connection can not be established - diubke check on all parameters and also keep in mind that Wireguard runs in kernel space, i.e. restart your network after each change. I am using it for a longer time now and never had any issues with reliability really

[@iYousif_]

I will reset my R7800 and try this one. I was trying to connect to commercial VPN but it's not working. You mentioned there shall be a Firewall configuration needs to be done, but they didn't highlighted that in their manual: www.vpnunlimitedapp.com/help/manuals/open-wrt-wireguard-setup Any help will be highly appreciated. I will love to access my home NAS from office and also if I can enable the US commercial IP at home sometimes to stream some US contents.

[@OneMarcFifty]

Hi Yousif. Please keep in mind that the documentation you link to is about connecting your router as a client to a commercial outbound vpn. My video is about connecting a client to your router at home.

[@iYousif_]

@@OneMarcFifty Hi Marc. Yes, I noticed. I am now following to connect my Android phone to my router but despite the VPN shows connected there's no Internet and no LAN access. Can you speficy more on the IP 192.168.0.170 in 5:25 as I can't determine what mine shall be.

[@OneMarcFifty]

192.168.0.170 is the ip of my router. I have ran all the tests in an internal network. So in your case - if you want to connect to your home router you would need to specify the public IP of your home environment there ore - alternatively - as this IP might change periodically you could use a dyndns service and let's say connect to yourhome.dyndns.org or whatever you called your home ip to be.

[@iYousif_]

@@OneMarcFifty Thanks for the feedback. This video took my two days vacation already. In one time I manage to get it working. Then I read that there's some issue called Double-NAT where like in my case the OpenWRT router is behind the ISP 4G modem (with SIM card hence I can not remove it or replace it). I following some documentation in OpenWRT to remove the WAN and add it the LAN VLAN and make the Netgear/OpenWRT as Dump AP. Since then the 4G router provide the DNS and DHCP but for unknown reason I couln't make the Wireguard to connect ever again. Did I messed up very bad or I can still get it working without the WAN port in the OpenWRT? I reentered your script command again one by one except for the WAN and IP6 lines.

[@OneMarcFifty]

Hi Yousif, sorry to hear that you spent your whole vacation with this 😟 - the script is in fact not made for NATted environments - I would need to make some adjustments to the scripts for this. Now - turning the router into a dumb access point is possible but I would not recommend it - it just removes a layer of security. Have you been able to open a port on your 4G modem? In a nutshell I’d say it would be best ro revert to WAN/LAN and I shall add a fix to the scripts.

[@johnwashifi]

Hello, how to set it up? I followed the tutorial without success. any hint where to took at? I got the following error after connection established, what could be the cause?: daemon.err miniupnpd[5290]: try_sendto(sock=8, len=409, dest=[ff02::c]:1900): sendto: Permission denied daemon.err miniupnpd[5290]: try_sendto(sock=7, len=471, dest=239.255.255.250:1900): sendto: No such device