Hi,

 

so I'm currently trying to setup wireguard with "Remote access to LAN".

Wireguard NAT is set to NO.

Host access to custom networks is enabled for docker.

A static route exists.

 

I can access all services on unraid and on docker, as well as services on br0 with custom IPs just fine.

But I cannot access any other devices in my network, except for the router.

Does anyone have an idea what the problem might be?

 

Recommend using the Tailscale plugin, it runs over WireGuard, and it's much easier to set up, look for the SpaceInvader1 videos.

 

 

12 minutes ago, JorgeB said:

Recommend using the Tailscale plugin, it runs over WireGuard, and it's much easier to set up, look for the SpaceInvader1 videos.

 

 

I get what you mean but at the same time I'm too determined to get this actually solved. It seems like such a weird issue.

What does the wireguard config on unraid(or whatever the Wireguard host is) looks like? without the keys of course

Edited November 21, 20241 yr by Mainfrezzer

[Interface]

#NassVPN
PrivateKey=x
Address=10.253.0.1
ListenPort=51820
PostUp=logger -t wireguard 'Tunnel WireGuard-wg0 started';/usr/local/emhttp/webGui/scripts/update_services
PostDown=logger -t wireguard 'Tunnel WireGuard-wg0 stopped';/usr/local/emhttp/webGui/scripts/update_services
PostUp=ip -4 route flush table 200
PostUp=ip -4 route add default via 10.253.0.1 dev wg0 table 200
PostUp=ip -4 route add 192.168.0.0/24 via 192.168.0.1 dev br0 table 200
PostDown=ip -4 route flush table 200
PostDown=ip -4 route add unreachable default table 200
PostDown=ip -4 route add 192.168.0.0/24 via 192.168.0.1 dev br0 table 200

[Peer]
#FayeAndroid
PublicKey=x
PresharedKey=x
AllowedIPs=10.253.0.2
 

Sorry took so long to come back to you, had to reverse setup the whole thing because apparently telekom routers dont have routing tables.

i could recreate your issue, your static routing must be wrong. Are you absolutely sure that your router, where the host resides has the Wireguard IP range routed back to the Wireguard Host?

1 minute ago, Mainfrezzer said:

Sorry took so long to come back to you, had to reverse setup the whole thing because apparently telekom routers dont have routing tables.

i could recreate your issue, your static routing must be wrong. Are you absolutely sure that your router, where the host resides has the Wireguard IP range routed back to the Wireguard Host?

Yup I'm sure.

I'm using the tplink ax6000. Could it be that this router somehow blocks the connections in some form?

That is very bizarre indeed.

I tested a bit, and given that you can actually reach the router as you said, that seems to be working as it should. 


There must be something going on with the clients. I can reach everything from the remote network with the exception of another server that has its own routing table for that specific ip range.

2 minutes ago, Mainfrezzer said:

That is very bizarre indeed.

I tested a bit, and given that you can actually reach the router as you said, that seems to be working as it should. 


There must be something going on with the clients. I can reach everything from the remote network with the exception of another server that has its own routing table for that specific ip range.

The clients are all different devices, from printer to pc to laptop. All pingable, just not when connected to wireguard.

I wish I could somehow debug where exactly my packets go to and end at and why they end there.

On 11/21/2024 at 2:54 PM, Mainfrezzer said:

That is very bizarre indeed.

I tested a bit, and given that you can actually reach the router as you said, that seems to be working as it should. 


There must be something going on with the clients. I can reach everything from the remote network with the exception of another server that has its own routing table for that specific ip range.

 

Thought maybe a tcpdump helps:

 

From shim-br0:

root@Nass:~# tcpdump -i any icmp and dst 192.168.0.118
tcpdump: data link type LINUX_SLL2
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes
23:05:28.366855 shim-br0 Out IP 192.168.0.231 > 192.168.0.118: ICMP echo request, id 56359, seq 1, length 64
23:05:28.366864 br0   Out IP 192.168.0.231 > 192.168.0.118: ICMP echo request, id 56359, seq 1, length 64
23:05:28.366878 eth0  Out IP 192.168.0.231 > 192.168.0.118: ICMP echo request, id 56359, seq 1, length 64

 

From wg0:

23:06:48.243116 wg0   Out IP 10.253.0.1 > 192.168.0.118: ICMP echo request, id 44344, seq 1, length 64

 

And when doing a traceroute from 10.253.0.2 to 192.168.0.118, which stops after hitting 10.253.0.1

 

23:16:29.968725 wg0   In  IP 10.253.0.2 > 192.168.0.118: ICMP echo request, id 1181, seq 1, length 64
23:16:29.968764 shim-br0 Out IP 10.253.0.2 > 192.168.0.118: ICMP echo request, id 1181, seq 1, length 64
23:16:29.968770 br0   Out IP 10.253.0.2 > 192.168.0.118: ICMP echo request, id 1181, seq 1, length 64
23:16:29.968783 eth0  Out IP 10.253.0.2 > 192.168.0.118: ICMP echo request, id 1181, seq 1, length 64

You can just ping/traceroute from the wireguard server host/unraid to sanity check that it actually works.

if i dont have a route set,
 

i cant reach the router. Nor can i reach the dns server


The moment i enable the static route



it works.

 (idk why this one image keeps poping up below it works, STAHP xD)

Edited November 22, 20241 yr by Mainfrezzer

Enabled

Disabled

does the wireguard client have a routing table somewhere?

Edited November 22, 20241 yr by Mainfrezzer

routes on unraid host:

 

default via 10.253.0.1 dev wg0 table 200
192.168.0.0/24 via 192.168.0.1 dev br0 table 200
default via 192.168.0.1 dev shim-br0
default via 192.168.0.1 dev br0 proto dhcp src 192.168.0.231 metric 1005
10.253.0.2 dev wg0 scope link
10.253.0.3 dev wg0 scope link
10.253.0.5 dev wg0 scope link
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1
172.31.200.0/24 dev br-77d5195ff5fd proto kernel scope link src 172.31.200.1 linkdown
192.168.0.0/24 dev shim-br0 proto kernel scope link src 192.168.0.231
192.168.0.0/24 dev br0 proto dhcp scope link src 192.168.0.231 metric 1005
local 10.253.0.1 dev wg0 table local proto kernel scope host src 10.253.0.1
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1
local 172.17.0.1 dev docker0 table local proto kernel scope host src 172.17.0.1
broadcast 172.17.255.255 dev docker0 table local proto kernel scope link src 172.17.0.1
local 172.31.200.1 dev br-77d5195ff5fd table local proto kernel scope host src 172.31.200.1
broadcast 172.31.200.255 dev br-77d5195ff5fd table local proto kernel scope link src 172.31.200.1 linkdown
local 192.168.0.231 dev br0 table local proto kernel scope host src 192.168.0.231
local 192.168.0.231 dev shim-br0 table local proto kernel scope host src 192.168.0.231
broadcast 192.168.0.255 dev br0 table local proto kernel scope link src 192.168.0.231
broadcast 192.168.0.255 dev shim-br0 table local proto kernel scope link src 192.168.0.231

I found this interesting:

 

Can't ping from wg0 to client device.

Can ping just fine from shim-br0 to client device.

Wireguard peer routing table (Edit: This is from another device. Imagine 10.0.0.6 was 10.0.0.2):

 

IPv4 Route Table

===========================================================================

Active Routes:

Network Destination Netmask Gateway Interface Metric

0.0.0.0 0.0.0.0 192.168.248.226 192.168.248.159 55

10.253.0.1 255.255.255.255 On-link 10.253.0.6 5

10.253.0.6 255.255.255.255 On-link 10.253.0.6 261

127.0.0.0 255.0.0.0 On-link 127.0.0.1 331

127.0.0.1 255.255.255.255 On-link 127.0.0.1 331

127.255.255.255 255.255.255.255 On-link 127.0.0.1 331

192.168.0.0 255.255.255.0 On-link 10.253.0.6 5

192.168.0.255 255.255.255.255 On-link 10.253.0.6 261

192.168.248.0 255.255.255.0 On-link 192.168.248.159 311

192.168.248.159 255.255.255.255 On-link 192.168.248.159 311

192.168.248.255 255.255.255.255 On-link 192.168.248.159 311

224.0.0.0 240.0.0.0 On-link 127.0.0.1 331

224.0.0.0 240.0.0.0 On-link 192.168.248.159 311

255.255.255.255 255.255.255.255 On-link 127.0.0.1 331

255.255.255.255 255.255.255.255 On-link 192.168.248.159 311

===========================================================================

Edited November 22, 20241 yr by FayeInMay

3 minutes ago, FayeInMay said:

 

192.168.0.0 255.255.255.0 On-link 10.253.0.6 5

 

===========================================================================

Well. Thats not 10.253.0.2

Edited November 22, 20241 yr by Mainfrezzer

But why would wireguard set the route to the wireguard peer IP?

I only have the screenshot of the test windows client i set up. 

10.0.0.0 is *my* network
10.253.1.1 is the Unraidhost in *my* network
10.253.1.2 is the Windows Wireguard Client
192.169.2.0 is the Windows Wireguard Client real lan
192.168.2.149 is the Windows Wireguard real lan IP



Edit: also shim-br0 and br0 doesnt make a difference, i did already test that^^

Edited November 22, 20241 yr by Mainfrezzer

Oooh, we had some miscommunication.

Treat 10.0.0.6 like 10.0.0.2. I just tested this from a different device as 10.0.0.2 is my phone.

The same problem persists with that one.

All routes on router for completion sake:

 

I tested in on android now and it does work there. mhmmm those tech ghosts...



Just out of curiosity, does it work when you enable nat? (to make it work with nat, you have to change the br0 entries in the wg0.conf, or whatever tunnel number it is, to shim-br0)


 

 

 

Edited November 22, 20241 yr by Mainfrezzer

It doesn't. (Traceroute still stops at 10.253.0.1)

Changed to NAT = Yes.

Now config is:

 

Edited November 23, 20241 yr by FayeInMay