1 Temat przez foxx999 (edytowany przez foxx999 2025-06-04 13:37:54)

  • Zarejestrowany: 2025-04-22
  • Posty: 22

Temat: Problem w Wireguard i Openwrt

Witam,
mam problem z połączeniem Wireguard (na ustawieniach Surfshark). Skonfigurowane wg jednego z poradników. Konfiguracja zaimportowana z pliku. Co ciekawe, konfiguracja na telefonie działa bez problemu, natomiast router nie odbiera pakietów.

https://i.postimg.cc/tCGXmPXq/surfshark.png

Oto konfiguracja:

root@OpenWrt:/etc/config# ubus call system board
{
        "kernel": "6.6.86",
        "hostname": "OpenWrt",
        "system": "ARMv8 Processor rev 4",
        "model": "Zyxel EX5601-T0 ubootmod",
        "board_name": "zyxel,ex5601-t0-ubootmod",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "24.10-SNAPSHOT",
                "revision": "r28627-0b392b925f",
                "target": "mediatek/filogic",
                "description": "OpenWrt 24.10-SNAPSHOT r28627-0b392b925f",
                "builddate": "1745693631"
        }
}
root@OpenWrt:/etc/config# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdbd:2ffb:a165::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.2.254'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option gateway '192.168.2.254'

config interface 'wan'
        option device 'eth1'
        option proto 'pppoe'
        option username 'XXXXXXXXXXXXXX'
        option password 'XXXXXXXXXXXXXX'
        option ipv6 'auto'

config interface 'wan6'
        option device 'eth1'
        option proto 'dhcpv6'

config interface 'wgserver'
        option proto 'wireguard'
        option private_key 'XXXXXXXXXXXXXX'
        option listen_port '55443'
        list addresses '172.22.22.1/24'
        option mtu '1400'

config wireguard_wgserver
        option description 'gerard-telefon'
        option public_key 'XXXXXXXXXXXXXX'
        option private_key 'XXXXXXXXXXXXXX'
        list allowed_ips 'XXXXXXXXXXXXXX'
        option route_allowed_ips '1'
        option endpoint_port '55443'
        option persistent_keepalive '25'

config wireguard_wgserver
        option public_key 'XXXXXXXXXXXXXX'
        option private_key 'XXXXXXXXXXXXXX'
        option description 'Gerard_laptop'
        list allowed_ips 'XXXXXXXXXXXXXX'
        option route_allowed_ips '1'
        option endpoint_port '55443'
        option persistent_keepalive '25'

config interface 'wg0'
        option proto 'wireguard'
        option private_key 'XXXXXXXXXXXXXX'
        list addresses '10.14.0.2/16'
        list dns '162.252.172.57'
        list dns '149.154.159.92'

config wireguard_wg0
        option description 'Imported peer configuration'
        option public_key 'XXXXXXXXXXXXXX'
        list allowed_ips '0.0.0.0/0'
        list allowed_ips '::/0'
        option endpoint_host 'pl-waw.prod.surfshark.com'
        option endpoint_port '51820'
        option route_allowed_ips '1'
        option persistent_keepalive '25'

root@OpenWrt:/etc/config# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option band '2g'
        option channel '1'
        option htmode 'HE40'
        option country 'PL'
        option txpower '20'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'Family'
        option encryption 'psk2'
        option key 'XXXXXXXXXXXXXX'
        option ieee80211r '1'
        option nasid 'ap2542'
        option mobility_domain '111A'
        option ft_over_ds '0'
        option ft_psk_generate_local '1'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi+1'
        option band '5g'
        option channel '116'
        option htmode 'HE80'
        option country 'PL'
        option txpower '20'
        option cell_density '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'Family'
        option encryption 'psk2'
        option key 'XXXXXXXXXXXXXX'
        option ieee80211r '1'
        option nasid 'ap2545'
        option mobility_domain '111A'
        option ft_over_ds '0'
        option ft_psk_generate_local '1'

root@OpenWrt:/etc/config# cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option mtu_fix '1'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'
        list network 'wg0'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option src 'wan'
        option name 'allow-55443'
        list proto 'udp'
        option dest_port '55443'
        option target 'ACCEPT'

config zone
        option name 'wgserver'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'wgserver'

config forwarding
        option src 'wgserver'
        option dest 'lan'

config forwarding
        option src 'wgserver'
        option dest 'wan'

config forwarding
        option src 'lan'
        option dest 'wgserver'

config nat
        option name 'SNAT-WGserver'
        list proto 'all'
        option src 'lan'
        option src_ip 'cat /etc/config/firewall'
        option target 'MASQUERADE'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'NPM-443'
        option src 'wan'
        option src_dport '443'
        option dest_ip '192.168.2.21'
        option dest_port '443'

root@OpenWrt:/etc/config# wg show
interface: wg0
  public key: cat /etc/config/firewall
  private key: (hidden)
  listening port: 41129

peer: vBa3HK7QXietG64rHRLm085VMS2cAX2paeAaphB/SEU=
  endpoint: 45.134.212.250:51820
  allowed ips: 0.0.0.0/0
  transfer: 0 B received, 48.42 KiB sent
  persistent keepalive: every 25 seconds

interface: wgserver
  public key: cpuORYaepaAhS+hsjOJe76sE0KPxSnkQMhckzqwqEj0=
  private key: (hidden)
  listening port: 55443

peer: NOwOoExzeZCogSHBBqgpS8xmyYvWh7zZJikj6+K/alQ=
  endpoint: 37.31.30.65:54968
  allowed ips: 172.22.22.2/32
  transfer: 43.50 KiB received, 27.04 KiB sent
  persistent keepalive: every 25 seconds

peer: GQg0Owm0U76DVni6KAiDpnmzMGi7SrTej3BUqbTNOT4=
  allowed ips: 172.22.22.3/32
  persistent keepalive: every 25 seconds

2 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,339

Odp: Problem w Wireguard i Openwrt

Brak RX zwykle wskazuje na to że druga strona nie chce gadać, bo. np. klucze się nie zgadzają. Konfiguracyjnie wygląda to dobrze.

A może Surfshark pilnuje żeby połączenie nie było z dwóch ip (z telefonu i z routera)? Tego nie wiem.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

3 Odpowiedź przez MrB

  • MrB
  • Użytkownik
  • Nieaktywny
  • Zarejestrowany: 2019-02-27
  • Posty: 84

Odp: Problem w Wireguard i Openwrt

Nie rozumiem tej konfiguracji. Ten router ma być klientem czy serwerem?

4 Odpowiedź przez foxx999

  • Zarejestrowany: 2025-04-22
  • Posty: 22

Odp: Problem w Wireguard i Openwrt

I klientem i serwerem jednocześnie, problemem była linijka

option gateway '192.168.2.254'

po jej usunięciu wireguard zaczął działać