theinfinityjoe
Occasional Visitor
Ive seen some posts about wireguard around the forums but just wondered if it's usable on RT-AC86U. i'm currently running asus merlin on firmware
386.4
386.4
Is wireguard available on RT-AC86U ?
- Thread starter theinfinityjoe
- Start date
Jeffrey Young
Very Senior Member
EDIT: I just checked the changelog - the wireguard kernel module and workspace tool was added to the 386.4 firmware, so you are good.
I forget when the wireguard kernel module was added to the AC86U, but I am pretty sure it was after v386.4, so you will need to update your firmware a bit. But, yes, the newer firmware has the wireguard kernel module and the workspace tool (wg).
Depending on your knowledge of wireguard and what you want to do with it, you can set up yourself or use AMTM and install the wireguard-manager addon that will allow to to setup pretty well any setup configuration you want. I went with the DYI route as I did not want a lot of bloat taking up room on the jffs partition. My server and client needs were pretty simple.
Just a note, wireguard and NAT acceleration do not get along, so you must disbale that. You can use iptables and mark the wireguard traffic to be exempt from NAT acceleration (that is what I use). It is unpredictable through as some report that the iptable trick does not work on some newer HND routers. It worked for me both on the AC86U and the AX88U.
I forget when the wireguard kernel module was added to the AC86U, but I am pretty sure it was after v386.4, so you will need to update your firmware a bit. But, yes, the newer firmware has the wireguard kernel module and the workspace tool (wg).
Depending on your knowledge of wireguard and what you want to do with it, you can set up yourself or use AMTM and install the wireguard-manager addon that will allow to to setup pretty well any setup configuration you want. I went with the DYI route as I did not want a lot of bloat taking up room on the jffs partition. My server and client needs were pretty simple.
Just a note, wireguard and NAT acceleration do not get along, so you must disbale that. You can use iptables and mark the wireguard traffic to be exempt from NAT acceleration (that is what I use). It is unpredictable through as some report that the iptable trick does not work on some newer HND routers. It worked for me both on the AC86U and the AX88U.
You will need to use something like the Wireguard Manager add-on. See the Add-On subforum and use the filter option to find more discussion on using Wireguard on the AC series routers. Note: You may need to update your firmware however since 386.4 is almost a year old. Latest version is 386.7_2.
Wireguard - Session Manager (4th) thread
Another 6 months are up (thanks to SNB forum member @greenspanner for the heads-up); details of WireGuard® Manager can be found @the following: https://github.com/MartineauUK/wireguard and @ZebMcKayhan's invaluable Hint's and Tips Guide...
www.snbforums.com
The AC series routers will not be getting the 388.x firmware which includes Wireguard. The 388.x firmware is for the AX series of routers only. RMerlin has several posts about the AC routers not getting the 388.x firmware.
[Dev] Asuswrt-Merlin 388.1 development
That's unfortunate You already have everything included in 388 in Asuswrt-Merlin 386 plus extras.
www.snbforums.com
Beta - Asuswrt-Merlin 388.1 Beta is available for select models
Asuswrt-Merlin 388.1 Beta is now available for all Wifi 6 (AX) models. This release marks the merge with the new 388 code base from Asus. I don't want to list every 388-specific changes made by Asus, so I recommend checking Asus' own changelogs for more details. I will highlight the most...
www.snbforums.com
Last edited:
How did you setup the iptable 'trick' - are there notes on this? Thanks Archiel
Jeffrey Young
Very Senior Member
It is the mark directives in my server script below.
Code:
#!/bin/sh
KERNEL=$(uname -r)
WGaddress=10.100.10.1/24
WGport=51006
modprobe xt_set
insmod /lib/modules/${KERNEL}/kernel/net/wireguard/wireguard.ko
ip link del dev wg1 2>/dev/null
ip link add dev wg1 type wireguard
wg setconf wg1 /jffs/addons/wireguard/wg1.conf
ip address add dev wg1 $WGaddress
ip link set up dev wg1
#ifconfig wg1 mtu 1380 # origional set by setup script
ifconfig wg1 mtu 1380
ifconfig wg1 txqueuelen 1000
iptables -t mangle -D PREROUTING -i wg1 -j MARK --set-xmark 0x01/0x7 2>/dev/null
iptables -t mangle -D FORWARD -o wg1 -j MARK --set-xmark 0x01/0x7 2>/dev/null
iptables -t mangle -D FORWARD -i wg1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null
iptables -t mangle -D FORWARD -o wg1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null
iptables -D INPUT -p udp --dport $WGport -j ACCEPT 2>/dev/null
iptables -D INPUT -i wg1 -j ACCEPT 2>/dev/null
iptables -D FORWARD -i wg1 -j ACCEPT 2>/dev/null
iptables -D FORWARD -o wg1 -j ACCEPT 2>/dev/null
iptables -D OUTPUT -o wg1 -j ACCEPT 2>/dev/null
iptables -t nat -D PREROUTING -p udp --dport $WGport -j ACCEPT 2>/dev/null
iptables -t mangle -I FORWARD -o wg1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t mangle -I FORWARD -i wg1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t mangle -I FORWARD -o wg1 -j MARK --set-xmark 0x01/0x7
iptables -t mangle -I PREROUTING -i wg1 -j MARK --set-xmark 0x01/0x7
iptables -I INPUT -p udp --dport $WGport -j ACCEPT
iptables -I INPUT -i wg1 -j ACCEPT
iptables -I FORWARD -i wg1 -j ACCEPT
iptables -I FORWARD -o wg1 -j ACCEPT
iptables -I OUTPUT -o wg1 -j ACCEPT
iptables -t nat -I PREROUTING -p udp --dport $WGport -j ACCEPTtheinfinityjoe
Occasional Visitor
Thank you all for the info, i may upgrade to the AX series to avail of the 388.x firmware
Thanks for this, but it is way above my level of understanding. I am using Wireguard Manager for both 'server' and 'client' (AzireVPN) so ideally I would like to have NAT acceleration engaged, but excluding traffic on wg1 and wg2 - I think I may have a lot a reading up to do in 2023
Jeffrey Young
Very Senior Member
Thanks for this, but it is way above my level of understanding. I am using Wireguard Manager for both 'server' and 'client' (AzireVPN) so ideally I would like to have NAT acceleration engaged, but excluding traffic on wg1 and wg2 - I think I may have a lot a reading up to do in 2023
The client side is not much different. Just need to add the routing information. Here is my client script below (I have two Oracle Free Tier servers that I extend my local network too). The added routes in my script just send local lan data to my Oracle network. I start this script from the
wan-event script on a "connected" event where as the serv er can get started from services-start.You also need to add a check in
nat-start as the iptable rules get zapped each time the fire wall service gets restarted by Asus.
Code:
#!/bin/sh
set -x
KERNEL=$(uname -r)
LocalIP="10.100.20.1"
modprobe xt_set
insmod /lib/modules/${KERNEL}/kernel/net/wireguard/wireguard.ko
ip link del dev wg0 2>/dev/null
ip link add dev wg0 type wireguard
wg setconf wg0 /jffs/addons/wireguard/wg0.conf
ip address add dev wg0 $LocalIP
ip link set up dev wg0
ifconfig wg0 mtu 1380
ifconfig wg0 txqueuelen 1000
ip route add 10.100.20.0/24 dev wg0
ip route add 10.0.0.0/24 dev wg0
iptables -t mangle -D PREROUTING -i wg0 -j MARK --set-xmark 0x01/0x7 2>/dev/null
iptables -t mangle -D FORWARD -o wg0 -j MARK --set-xmark 0x01/0x7 2>/dev/null
iptables -t mangle -D FORWARD -i wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null
iptables -t mangle -D FORWARD -o wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null
iptables -D INPUT -i wg0 -j ACCEPT 2>/dev/null
iptables -D FORWARD -i wg0 -j ACCEPT 2>/dev/null
iptables -D FORWARD -o wg0 -j ACCEPT 2>/dev/null
iptables -D OUTPUT -o wg0 -j ACCEPT 2>/dev/null
iptables -I FORWARD -i wg0 -j ACCEPT
iptables -I FORWARD -o wg0 -j ACCEPT
iptables -I OUTPUT -o wg0 -j ACCEPT
iptables -I INPUT -i wg0 -j ACCEPT
iptables -t mangle -I FORWARD -o wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t mangle -I FORWARD -i wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t mangle -I FORWARD -o wg0 -j MARK --set-xmark 0x01/0x7
iptables -t mangle -I PREROUTING -i wg0 -j MARK --set-xmark 0x01/0x7And the corresponding
wg0.conf file is
Code:
#
# Use this configuration with WireGuard client
#
[Interface]
PrivateKey = {Private Key}
[Peer]
PublicKey = {Peer (server) Public Key}
PresharedKey = {preshare key, if used}
AllowedIPs = 10.100.20.2/32, 10.0.0.0/24
Endpoint = {End Point IP}:{Port}
PersistentKeepalive = 25
doczenith1
Very Senior Member
Not 100 percent accurate. The AC86U is one of the few models where WireGuard is compatible with NAT acceleration. I am currently running my AC86U this way. No need for doing anything with iptables.
Last edited:
theinfinityjoe
Occasional Visitor
Coming back to this i just bought an AX router and flashed the 388.1 merlin firmware. openvpn works as normal but when I setup wireguard, it says connected but my ip doesn't change at all , any idea what i've done wrong ?
You need to select which client to redirect, through VPN Director. This is similar to stock firmware which requires you to configure clients through VPN Fusion.
theinfinityjoe
Occasional Visitor
Thanks that fixed things,really appreciate it! Was just wondering if there are plans to implement Automatic start at boot time and the killswitch for wireguard? also seemed to be getting dns leaks until i enabled dns director, is there any way of setting DNS Configuration to strict for wireguard? again really appreciate the help and thanks so much !
That`s what the Enable switch already does.
Makes little sense with WireGuard because WireGuard is not based on a traditional client/server setup, it's more like a tunnel/route setup. If the route doesn't work, then traffic will be dropped by default.
"Strict" does not prevent leaks, you need "Exclusive" mode for that, and that's already what the WG implementation does.
theinfinityjoe
Occasional Visitor
Thanks for the explanation i'm new to this and appreciate the help!
Hello. I am using an AC86u with OpenVPN without issue, on the latest Merlin 386.9.
I would like to try wireguard without having to use a USB stick for entware, amtm, etc. An earlier post stated it could be done manually. Are there any instructions somewhere for how to do this? Or alternatively, can it be setup with amtm and then used without a USB attached?
Thank you in advance.
I would like to try wireguard without having to use a USB stick for entware, amtm, etc. An earlier post stated it could be done manually. Are there any instructions somewhere for how to do this? Or alternatively, can it be setup with amtm and then used without a USB attached?
Thank you in advance.
Tech9
Part of the Furniture
USB drive with Entware is required:
GitHub - MartineauUK/wireguard: Manage/Install WireGuard on applicable ASUS routers
Manage/Install WireGuard on applicable ASUS routers - MartineauUK/wireguard
github.com
Thanks, I will look at that.
Do you know what the statement below refers to (taken from post #2 above) where its stated you can set it up yourself, DIY way without amtm?
"Depending on your knowledge of wireguard and what you want to do with it, you can set up yourself or use AMTM and install the wireguard-manager addon that will allow to to setup pretty well any setup configuration you want. I went with the DYI route as I did not want a lot of bloat taking up room on the jffs partition. My server and client needs were pretty simple"
Do you know what the statement below refers to (taken from post #2 above) where its stated you can set it up yourself, DIY way without amtm?
"Depending on your knowledge of wireguard and what you want to do with it, you can set up yourself or use AMTM and install the wireguard-manager addon that will allow to to setup pretty well any setup configuration you want. I went with the DYI route as I did not want a lot of bloat taking up room on the jffs partition. My server and client needs were pretty simple"
Similar threads
- Locked
Similar threads
Similar threads
-
-
-
-
-
WireGuard starts failing, anyone else with 3004.388.8_2?
- Started by meruserasus
- Replies: 19
-
-
-
-
-