Temat: Wireguard na 2 AP – brak forwardingu po polaczeniu, Openwrt 23.05
Wireguard na 2 AP – brak forwardingu po polaczeniu, Openwrt 23.05 – brak routingu wewnętrznie i na zewnątrz
Mam 1 router stockowy, Wireguard na RPI, działa bez problemu, ale ma 100 MB karta, chciałem się przenieść na 2 AP w sieci (dump AP, bez firewala, ustawiony na nim getway na AP router główny).
Uruchomiłem Wireguard na tym AP, przekierowałem port na Wireguarda na ten AP (działa wszystko jak jest przekierowany port wireguarda na RPI) , no i zagwozdka.
Po połączeniu brak jest routingu/forwardu do sieci wewnętrznej (łączy się na dump AP, ale nie ma nic więcej) i odcina klienta od internetu, mimo tego że nie ma ustawienia Wireguard aby ruch przechodził przez tuel w kliencie. Nie wiem co trzeba dodać (kiedyś był ip forward w iptables, tak mam ustawione na RPI), a tu nie wiem.
Moja config network:
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
option ipv6 '0'
config globals 'globals'
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
option promisc '0'
option ipv6 '0'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
list ports 'wan'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.100.199'
option netmask '255.255.255.0'
option ipv6 '0'
option gateway '192.168.100.100'
list dns '192.168.100.100'
list dns '8.8.8.8'
list dns '185.137.248.11'
list dns '208.67.222.123'
list dns '9.9.9.9'
list dns '1.1.1.1'
config device
option name 'phy0-ap0'
option ipv6 '0'
config device
option name 'phy1-ap0'
option ipv6 '0'
config device
option name 'wan'
option ipv6 '0'
config interface 'wg0'
option proto 'wireguard'
option defaultroute '0'
option ipv6 '0'
list addresses '10.0.2.1/24'
option force_link '1'
option listen_port '8087'
option delegate '0'
option private_key 'yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy'
config wireguard_wg0
option persistent_keepalive '25'
list allowed_ips '10.0.2.2/32'
option route_allowed_ips '1'
option description 'xxxxxxxxxxxxx’
option public_key ‘xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
config wireguard_wg0
option persistent_keepalive '25'
list allowed_ips '10.0.2.3/32'
option route_allowed_ips '1'
option description 'xxxxxxxxxxxxx’
option public_key ‘xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
config wireguard_wg0
option persistent_keepalive '25'
list allowed_ips '10.0.2.4/32'
option route_allowed_ips '1'
option description 'xxxxxxxxxxxxx’
option public_key ‘xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
config wireguard_wg0
option persistent_keepalive '25'
list allowed_ips '10.0.2.5/32'
option route_allowed_ips '1'
option description 'xxxxxxxxxxxxx’
option public_key ‘xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
Firewal (disabled) ale w configu jest tak:
NETGEAR_R6220:~# /etc/init.d/firewall status
Inactive
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option flow_offloading '1'
option flow_offloading_hw '1'
DHCP też nie ma
Lokalnie połączenie do internetu działa
PING openwrt.org (139.59.209.225): 56 data bytes
64 bytes from 139.59.209.225: seq=0 ttl=53 time=23.870 ms
64 bytes from 139.59.209.225: seq=1 ttl=53 time=23.315 ms
64 bytes from 139.59.209.225: seq=2 ttl=53 time=23.208 ms
64 bytes from 139.59.209.225: seq=3 ttl=53 time=23.362 ms
64 bytes from 139.59.209.225: seq=4 ttl=53 time=23.054 ms
--- openwrt.org ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 23.054/23.361/23.870 ms
Wiegand client (działa normalnie na RPI)
[Interface]
PrivateKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Address = 10.0.2.2/32
DNS = 185.137.248.11, 8.8.8.8, 1.1.1.1, 9.9.9.9, 149.112.112.112, 208.67.220.222, 208.67.222.220, 217.17.34.10
[Peer]
PublicKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
AllowedIPs = 0.0.0.0/1, 128.0.0.0/1, 192.168.100.0/24
Endpoint = xxxxxxxxxxx.ddns.net:8087
PersistentKeepalive = 25