I'm gonna take a wild stab at this and say that it as a routing issue. Your tablet could probably contact your policy computer but it cant reply back, simply because there are no routes to your wg server in the policy route table.
E:Option ==> peer wg11 rule add wan src=any dst=10.50.1.1/24 comment ToWg21UseMainOk... did you restart wg11?
ip ruleyes) at first wg11/21 and router at last)
ip rule
0: from all lookup local
9810: from all fwmark 0xd2 lookup 210
9910: from all to 10.50.1.1/24 lookup main
9911: from all to 95.213.0.0/18 lookup 121
9911: from all to 95.163.32.0/19 lookup 121
9911: from all to 95.163.248.0/21 lookup 121
9911: from all to 95.163.144.0/24 lookup 121
9911: from all to 95.142.192.0/19 lookup 121
9911: from all to 95.108.128.0/17 lookup 121
9911: from all to 94.100.176.0/20 lookup 121
9911: from all to 93.186.224.0/20 lookup 121
9911: from all to 93.159.228.0/22 lookup 121
9911: from all to 93.158.128.0/18 lookup 121
9911: from all to 91.239.233.254 lookup 121
9911: from all to 91.232.230.0/24 lookup 121
9911: from all to 89.208.0.0/16 lookup 121
9911: from all to 87.250.224.0/19 lookup 121
9911: from all to 87.240.128.0/18 lookup 121
9911: from all to 87.236.19.238 lookup 121
9911: from all to 85.192.32.0/22 lookup 121
9911: from all to 84.201.128.0/18 lookup 121
9911: from all to 82.202.184.0/21 lookup 121
9911: from all to 80.239.201.0/24 lookup 121
9911: from all to 79.142.17.142 lookup 121
9911: from all to 79.137.240.0/21 lookup 121
9911: from all to 79.137.174.0/23 lookup 121
9911: from all to 79.137.128.0/18 lookup 121
9911: from all to 77.88.0.0/18 lookup 121
9911: from all to 77.75.152.0/21 lookup 121
9911: from all to 77.74.176.0/22 lookup 121
9911: from all to 5.61.232.0/21 lookup 121
9911: from all to 5.61.16.0/21 lookup 121
9911: from all to 5.45.192.0/18 lookup 121
9911: from all to 5.255.192.0/18 lookup 121
9911: from all to 5.181.60.0/22 lookup 121
9911: from all to 46.19.138.67 lookup 121
9911: from all to 45.84.128.0/22 lookup 121
9911: from all to 45.136.20.0/22 lookup 121
9911: from all to 4.59.181.140 lookup 121
9911: from all to 4.31.208.86 lookup 121
9911: from all to 37.9.64.0/18 lookup 121
9911: from all to 37.140.128.0/18 lookup 121
9911: from all to 218.213.144.7 lookup 121
9911: from all to 217.69.128.0/20 lookup 121
9911: from all to 217.20.144.0/20 lookup 121
9911: from all to 213.79.65.32/19 lookup 121
9911: from all to 213.219.212.0/22 lookup 121
9911: from all to 213.180.192.0/19 lookup 121
9911: from all to 212.5.110.0/24 lookup 121
9911: from all to 208.87.92.0/22 lookup 121
9911: from all to 199.36.240.0/22 lookup 121
9911: from all to 199.21.96.0/22 lookup 121
9911: from all to 195.218.190.0/23 lookup 121
9911: from all to 195.218.168.0/24 lookup 121
9911: from all to 195.211.20.0/22 lookup 121
9911: from all to 195.211.128.0/22 lookup 121
9911: from all to 194.186.63.0/24 lookup 121
9911: from all to 193.0.170.0/23 lookup 121
9911: from all to 188.93.56.0/21 lookup 121
9911: from all to 185.85.8.0/21 lookup 121
9911: from all to 185.71.76.0/22 lookup 121
9911: from all to 185.62.200.245 lookup 121
9911: from all to 185.62.200.235 lookup 121
9911: from all to 185.62.200.225 lookup 121
9911: from all to 185.6.244.0/22 lookup 121
9911: from all to 185.5.136.0/22 lookup 121
9911: from all to 185.41.185.73 lookup 121
9911: from all to 185.32.248.0/22 lookup 121
9911: from all to 185.32.184.0/23 lookup 121
9911: from all to 185.30.176.0/22 lookup 121
9911: from all to 185.29.130.0/24 lookup 121
9911: from all to 185.226.52.0/22 lookup 121
9911: from all to 185.187.63.0/24 lookup 121
9911: from all to 185.16.246.0/23 lookup 121
9911: from all to 185.16.244.0/22 lookup 121
9911: from all to 185.16.148.0/22 lookup 121
9911: from all to 185.146.1.121 lookup 121
9911: from all to 184.24.25.189 lookup 121
9911: from all to 178.248.232.0/21 lookup 121
9911: from all to 178.237.16.0/20 lookup 121
9911: from all to 178.22.88.0/21 lookup 121
9911: from all to 178.154.128.0/17 lookup 121
9911: from all to 154.47.36.14 lookup 121
9911: from all to 154.47.0.0/16 lookup 121
9911: from all to 149.5.244.0/22 lookup 121
9911: from all to 146.255.192.82 lookup 121
9911: from all to 146.255.192.81 lookup 121
9911: from all to 146.255.192.80 lookup 121
9911: from all to 146.255.192.77 lookup 121
9911: from all to 146.255.192.75 lookup 121
9911: from all to 141.8.128.0/18 lookup 121
9911: from all to 130.193.32.0/19 lookup 121
9911: from all to 128.140.168.0/21 lookup 121
9911: from all to 109.235.160.0/21 lookup 121
9911: from all to 100.43.64.0/19 lookup 121
32766: from all lookup main
32767: from all lookup defaultAha, I think I misunderstood you. You only have destination policy rules...
peer wg11 rule add wan src=10.50.1.1/24 dst=any comment wg21UseWanUnfortunately, it didn't work.
Just to be sure I'm not lost in some spelling error:
Is this a second router??? I thought you were on ac86u.
Can or can't? (Ok/satisfied or not)
Rooted=routed? I enterpret this as: all lan clients are behaving satisfactory.
Ok, so if this is your only problem, I will get cracking on the masquarade rule needed. Please remove all other rule I told you, or it will not work (as they bypass vpn)
iptables -t nat -I POSTROUTING -s 10.50.1.1/24 -o wg11 -j MASQUERADE -m comment --comment "WireGuard 'client'"nano /jffs/addons/wireguard/Scripts/wg11-up.sh#!/bin/sh
iptables -t nat -I POSTROUTING -s 10.50.1.1/24 -o wg11 -j MASQUERADE -m comment --comment "WireGuard 'client'"chmod +x /jffs/addons/wireguard/Scripts/wg11-up.shNo, only one, ac86u
I can reach 192.168.0.1/24 resources (http/https/etc…)
Routed. Yes, all ok for LAN clients.
I will try iptables and reply.
Because currently that is what is preventing wg21 to access wg11. Access rights are all ok in firewall but as a second precaution the rule for masquarading (which is always needed on wg11) are limited to lan subnet. This is a decision of the author of wgm to prevent accidental/unintended/whatever access to wg11. When creating passthru rules, masquarade rule is added as well but since you dont use passthru but still wants wg21 to sometimes use wg11 it will be needed. And it is to satisfy wg11/NORD requirements and has nothing to do with wg21 else than wg21 ip needs to be included for these packages to be masquaraded.
as you started with VPNDirector import, I think you should continue to use VPNDirector. it seems like the future way of doing it. Just be aware that whenever you import to wgm, the import is strictly additive and appends the rules to your current rules (but not identical rules). so if you i.e. delete a rule an import will not delete that rule in wgm. and if you change a rule and import it will keep your old rule and import the new rule so you. Probably you should delete all VPNDirector rules in wgm before doing a new import.
not that I know of. the closest thing I could think of is to use IPSETs:
I have no idea. as all your rules have same priority, maybe there are no limit (@Martineau ?)
I'm glad! but I just remember Ive missed something. the rule needs to be deleted when wg11 is shutdown otherwise there will either be duplicates or error messages like "rule already exists" whenever wg11 restarts:
nano /jffs/addons/wireguard/Scripts/wg11-down.sh#!/bin/sh
iptables -t nat -D POSTROUTING -s 10.50.1.1/24 -o wg11 -j MASQUERADE -m comment --comment "WireGuard 'client'"chmod +x /jffs/addons/wireguard/Scripts/wg11-down.sh
Looks like the IPv6 support for 'client' Peers in Policy mode was never implemented?
wg_manager Beta v4.17bDe = Exit Script [?]
E:Option ==> uf dev
- I still get shivers recalling having to use it on IBM VM LPARs vi editor in Read-only modee = Exit Script [?]
E:Option ==> vie = Exit Script [?]
E:Option ==> vixwg_manager Beta v4.17bDe = Exit Script [?]
E:Option ==> uf devNo, all new rules will be directly in WG
Thank you, I’ll try.
yes, thanks. I made it right away when created start wg11 script, yesterday)
Because I'm too lazy to write a FULL WebUI for WireGuard Manager, I thought it would be easier to exploit the VPN Director GUI to allow a one-off bulk import of
wg_manager Selective Routing rules as a convenient alternative to the esoteric command line.wg_manager SQL database so you can certainly have more than 199 destination subnets, if you enter the desired rules via the peer wg1x rule add ...... command.dnsmasq automatically populate the IPSET whenever the domain name is referenced.
Perfect, worked great. Thanks.Not sure such a feature request is even sane?
Still each to their own - old dogs new tricks etc.
it was/is implemented/working in latest stable release. both IPv4 and IPv6 rules and DNS were properly populated and working. but on the last dev version neither IPv4 nor IPv6 DNS DNAT rules were populated (as the variable used to pass the list of DNS was unknown to the function).
great work! I will sink my teeth into it when I get home and do some extensive testing.
Oh dear perhaps my hastily applied assumption as to the correct fix is then somewhat flawed.
Sorry, but still no-go...Oh dear perhaps my hastily applied assumption as to the correct fix is then somewhat flawed.
ASUSWRT-Merlin RT-AC86U 386.7_0 Wed Jun 22 18:49:26 UTC 2022
admin@RT-AC86U-D7D8:/tmp/home/root# grep -iE "^version" /jffs/addons/wireguar
d/wg_c*
/jffs/addons/wireguard/wg_client:VERSION="v4.17.8"
admin@RT-AC86U-D7D8:/tmp/home/root# iptables -nvL WGDNS1 -t nat
Chain WGDNS1 (2 references)
pkts bytes target prot opt in out source destinati
on
admin@RT-AC86U-D7D8:/tmp/home/root# iptables -nvL WGDNS2 -t nat
Chain WGDNS2 (2 references)
pkts bytes target prot opt in out source destinati
on
admin@RT-AC86U-D7D8:/tmp/home/root# ip6tables -nvL WGDNS1 -t nat
Chain WGDNS1 (2 references)
pkts bytes target prot opt in out source destinati
on
admin@RT-AC86U-D7D8:/tmp/home/root# ip6tables -nvL WGDNS2 -t nat
Chain WGDNS2 (2 references)
pkts bytes target prot opt in out source destinati
on
admin@RT-AC86U-D7D8:/tmp/home/root#if [ -n "$PEER_DNS" ] && [ "$TARGET_LOOKUP" != "main" ] && [ "$VPN_IP" != "Any" ];thenif [ -n "$PEERDNS_LIST" ] && [ "$TARGET_LOOKUP" != "main" ] && [ "$VPN_IP" != "Any" ];thenWhoops!
wg_client to v4.17.9
github.com
e = Exit Script [?]
E:Option ==> uf dev
Welcome To SNBForums
SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.
If you'd like to post a question, simply register and have at it!
While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!
