JGrana
Very Senior Member
Nothing wrong with Entware wireguard-go except it is not available for the AX58U.
I see it available for the AX88U (aarch64) but not for the AX58U (armv7l).
Wireguard Session Manager - Discussion thread (CLOSED/EXPIRED Oct 2021 use http://www.snbforums.com/threads/session-manager-discussion-2nd-thread.75129/)
- Thread starter Martineau
- Start date
I see it available for the AX88U (aarch64) but not for the AX58U (armv7l).
amtm doesn’t differentiate armv7sf-k2.6 (no wireguard-go) and armv7sf-k3.2 (has wireguard-go) when installing Entware. Might be something for @thelonelycoder to look into.
amtm/amtm_modules/entware_setup.mod at d971563ed90e1594113008855209ec9b08b6410c · decoderman/amtm
amtm - the Asuswrt-Merlin Terminal Menu. Contribute to decoderman/amtm development by creating an account on GitHub.
github.com
thelonelycoder
Part of the Furniture
I'll get that fixed right now.
Thanks for the response.
Is there a way to run wg with a similar setup on how I currently use OVPN?
With OPVN I have to set 2 policy rules
192.168.1.0/24 = for all traffic to go thru VPN
192.168.1.1 = for Router to go thru WAN
Basically I would like to try 'wg' without OPVN, so can I disabled OPVN and setup wg with those 2 policy rules above?
If so can someone smarter than help me setup the 2 policy rules?
thelonelycoder
Part of the Furniture
I have pushed a hotfix for amtm that fixes this, see here.
It can be done as @Torson mentioned.
In wgm,
Code:
E:Option ==> peer wg11 rule add vpn 192.168.1.0/24 comment All_to_WGVPN
Code:
E:Option ==> 6 wg11Yes, that is doable and well documented in prior posts in this thread.
However, the pre-requisite to doing so (at the router level) is having valid wg.conf files from your VPN service provider (or 3rd party.) The likes of .ovpn configurations you can download or generate on the provider's site for OpenVPN tunneling.
Since you're using PIA, the question to ask is if they provide those Wireguard configuration files. I don't know what the current situation is. Earlier this year when I used them I had it working with configuration files generated as described at https://github.com/hsand/pia-wg which is a 3rd party. Since I don't use that method anymore (or PIA for that matter) I don't know if that still works, or maybe PIA are now offering a method of their own to generate the .conf files.
So, find out what the current situation is.
Next, providing that you have valid .conf file(s) test them first with a known working wireguard client (i.e. https://www.wireguard.com/install/).
At that point we'll make your current OVPN configuration work with Wireguard.
Whoops ...just updated my signature to reflect I'm now using VPN Unlimited.
They do support wireguard.
I read chongnt's post before yours and my question is how would I add the router policy rule (192.168.1.1) to go thru WAN?
He provided the rule for all traffic to go thru the VPN.
Thanks.
I'm think I'm making this too complicated : )
They do support wireguard.
I read chongnt's post before yours and my question is how would I add the router policy rule (192.168.1.1) to go thru WAN?
He provided the rule for all traffic to go thru the VPN.
Thanks.
I'm think I'm making this too complicated : )
Code:
peer wg11 rule add wan 192.168.1.1 comment Router to WANSo I'm in the process of installing wg.
Can anyone assist on how do I upload my VPN wg.conf file to wgm?
Also upon wgm installation, it asked me I want to create a 'device' peer for 'server' peer (wg21) which I skipped since I want to setup wg11 correct?
Thanks and I apologize for the noob questions.
Thansk again.
Update: this is what is currently showing but it created this automatically for me.
Code:
WireGuard ACTIVE Peer Status: Clients 0, Servers 1
1 = Update Wireguard modules 7 = Display QR code for a Peer {device} e.g. iPhone
2 = Remove WireGuard/wg_manager 8 = Peer management [ "list" | "category" | "new" ] | [ {Peer | category} [ del | show | add [{"auto="[y|n|p]}] ]
9 = Create Key-pair for Peer {Device} e.g. Nokia6310i (creates Nokia6310i.conf etc.)
3 = List ACTIVE Peers Summary [Peer...] [full] 10 = IPSet management [ "list" ] | [ "upd" { ipset [ "fwmark" {fwmark} ] | [ "enable" {"y"|"n"}] | [ "dstsrc"] ] } ]
4 = Start [ [Peer [nopolicy]...] | category ] e.g. start clients
5 = Stop [ [Peer... ] | category ] e.g. stop clients
6 = Restart [ [Peer... ] | category ] e.g. restart servers
? = About Configuration
v = View ('/jffs/addons/wireguard/WireguardVPN.conf')
e = Exit Script [?]
E:Option ==> 3
interface: wg21 Port:51820 10.50.1.1/24 VPN Tunnel Network # GT-AX11000 Server #1
WireGuard ACTIVE Peer Status: Clients 0, Servers
Last edited:
Yes, I think you want wg client as in wg11. If you have the wg11.conf file ready, you can put it in /opt/etc/wireguard.d
Code:
##create wg client, create wg11.conf in /opt/etc/wireguard.d
E:Option ==> import wg11
[✔] Config wg11 import success
##create wg client peer policy rule
E:Option ==> peer wg11 rule add vpn 192.168.1.111 comment MyVPNrule
[✔] Updated RPDB Selective Routing rule for wg11
##set wg client policy mode
E:Option ==> peer wg11 auto=p
[✔] Updated 'wg11' AUTO=PFor the wg server, you can choose to delete it by
Code:
E:Option ==> peer wg21 delI have everything setup but my devices are not connecting to the internet. Any ideas what might be causing this?
I might have missed out the restart step. Have you restart your wg11 client?
Perhaps a bit more description of the problem will be helpful. Is your wg11 connected? Then if your devices can ping to something like 8.8.8.8 and google.com to check if it is DNS related issue or something else etc.
Some command may be helpful to check, like "wg show wg11". If you have persistent keepalive set, then you can see the latest handshake timer keep refreshed after sometime indicating it is running.
By the way, for initial setup I think is is easier to add rule for single test host ip rather than the whole network. After make sure the single host works then later we can add the whole network in.
Last edited:
I did restart the wg11 wirh no luck.
So you're saying 1st setup the router to WAN rule and make sure everything works before putting the MyVPN rule for the whole network?
Sorry for not being clear. What I mean is for first time setup, it may be better to route just one of your client into wg11 instead of the whole network 192.168.1.0/24. Reason being in case it breaks and does not work in the first setup, it only impact one client and other devices still have internet access.
There are a few possibility that I can think of.
1. If your wg11.conf file imported successfully?
2. Is wg11 connected to your VPN provider? Here is a sample of my wg11 which is connected. I am connected to NordVPN. With persistent keepalive set to every 25 seconds, the latest handshake timer will reset to 0 when it incremented to 2 minutes. This is a sign that wg11 is connected. ifconfig wg11 can also see if the tx and rx counter increases when there is traffic over wg11.
Code:
admin@RT-AC86U-DBA8:/tmp/home/root# wg show wg11
interface: wg11
public key: XXXXXXXXXXXXXXXX
private key: (hidden)
listening port: 42009
peer: XXXXXXXX
endpoint: xx.xx.xx.xx:51820
allowed ips: 0.0.0.0/0
latest handshake: 56 seconds ago
transfer: 1.94 GiB received, 21.90 MiB sent
persistent keepalive: every 25 seconds
admin@RT-AC86U-DBA8:/tmp/home/root# ifconfig wg11
wg11 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.5.0.2 P-t-P:10.5.0.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MTU:1420 Metric:1
RX packets:1470748 errors:0 dropped:0 overruns:0 frame:0
TX packets:218523 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:2086099340 (1.9 GiB) TX bytes:22990520 (21.9 MiB)3. Is your route is correctly applied? ip rule output should reflect the vpn rule added, eg
Code:
E:Option ==> peer wg11 rule add vpn 192.168.1.0/24 comment All_to_WGVPN
Code:
admin@RT-AC86U-DBA8:/tmp/home/root# ip rule
...snipped...
9911: from 192.168.1.0/24 lookup 121
...snipped...4. Verify if the route is working properly. Example below show that for my client to reach google dns 8.8.8.8, it will go through wg11.
Code:
admin@RT-AC86U-DBA8:/tmp/home/root# ip route get 8.8.8.8 from 192.168.1.111 iif eth0
8.8.8.8 from 192.168.1.111 dev wg11
cache iif eth05. Verify with client. Example from your pc, use command prompt ping and trace route to 8.8.8.8 and also google.com to check internet connectivity.
ZebMcKayhan
Very Senior Member
@ZebMcKayhan
Thanks for the follow-up.
I did give up last week since I could see never get my devices to get online. However, I have some free time again this week during the day so I will try to tackle wireguard again.
It seems everything installs correctly, I also upload the wg11.conf file and when I run the 'wg show wg11' & 'ip rule', everything shows as connected.
I am running x3mRouting (option 3) which may be the reason it may not be working.
Guess I can temporarily uninstall x3m and disable OVPN and start with a fresh wgm install. Any additional step-by-step you can recommend to get this working?
My 2 policy rules I use with OVPN are:
192.168.1.1 --> Router --> WAN
192.168.1.0/24 -->All traffic --> VPN
As a side note, what would be the reason some folks use both 'wg' and OPVN simultaneously?
ZebMcKayhan
Very Senior Member
X3m manages and routes ipsets only right? I use it myself but only to create and manage the ipsets.
I don't think this would be conflicting unless possible for sites included in your ipsets.
It is quite common that these problem is dns related. What dns did you put it the conf file?
You can test to change it online in wgm:
Code:
peer wg11 dns 192.168.1.1Wgm uses dnat for dns so client request are redirected to wg dns before routing. Setting it to router will make it use dnsmasq as other devices.
Are you using any dns scripts?
When testing, in wgm, please post the output of:
Code:
Peer wg11Also the output of
Code:
ip ruleUsing "ip rule" you could delete some rules from x3m if you suspect they interfer.
This is my output:
Code:
admin@RT-AC86U-D7D8:/tmp/home/root# ip rule
0: from all lookup local
9900: from 192.168.1.1/24 fwmark 0x8000 lookup main
9910: from all to 192.168.1.1/16 lookup main
9911: from 192.168.1.1/24 lookup 121
9921: from 192.168.6.0/24 lookup 122
32766: from all lookup main
32767: from all lookup defaultI also agree with @chongnt, start simple. Only rule you need is to add a single computer/ip so you don't bring down your entire network as you are debugging. Then add more as things are starting to work
//Zeb
Edit: take a look at post #310 @chongnt identified wan mark is out-proritized by wgm policy rules. Try adding an additional wan rule with higher priority as suggested in following posts.
Last edited:
@Kingp1n, some good news and some guidance to follow...
Late last week I configured for a relative Wireguard with VPN Unlimited. It works well (with the observations noted below.)
Here are the high level steps:
1. If Wireguard Session Manager is installed, remove it and choose to delete all configuration files.
2. Re-install the script from the dev branch at: https://github.com/MartineauUK/wireguard/tree/dev
3. Time saving tip! Install the Wireguard client on your smartphone (from the Android or iOS store as applicable.)
4. On the VPN Unlimited site, generate a Wireguard configuration file for the location of your choice (they have well defined streaming locations too.)
5. On the same page, after the configuration file was generated you'll see a QR code.
6. Load the QR code on the phone application ('+' and 'Scan from QR code'.) Do not skip this step - it's a time (and head banging) saver. I had 2 configuration (out of 5) that did not connect, so no reason to troubleshoot the script for that. Make sure it connects and works on the phone - remove the phone from your network WiFi for this exercise.)
7. Disconnect the OpenVPN client
8. Edit the .conf file on your PC (use Notepad++) and make it look similar to this:
Replace '???' with the values from your working .conf file.
9. Rename the file to wg11.conf and copy to /opt/etc/wireguard.d
10. On your PC start wgm and copy and paste the following one line at a time - make sure there are no errors.
11. At this point you should see that the client is connected.
12. Test connectivity (all other devices on the network are unaffected at this point since OpenVPN client is disconnected.) Only your configured PC is tunneled through the wg11 client.
13. If all looks good carry on with the following (to route the whole network through the tunnel)
14. Hopefully that's the end 
.
NOTES:
- x3m can stay - it only routes IP sets through the OpenVPN clients - no harm done.
- if you use Unbound and use VPN redirection make sure you disable (delete) that such that it will work through the WAN (at least for now.)
- I still use OpenVPN for some real world work since it's the proven path. Wireguard is 2-2.5 times faster on my router and looks promising for the future and current personal stuff...
If I skipped a step, please post and I'll edit here. Good luck!
EDIT: Changed command line numeric entries to text as per @Martineau and modified the Router to WAN statement.
Late last week I configured for a relative Wireguard with VPN Unlimited. It works well (with the observations noted below.)
Here are the high level steps:
1. If Wireguard Session Manager is installed, remove it and choose to delete all configuration files.
2. Re-install the script from the dev branch at: https://github.com/MartineauUK/wireguard/tree/dev
3. Time saving tip! Install the Wireguard client on your smartphone (from the Android or iOS store as applicable.)
4. On the VPN Unlimited site, generate a Wireguard configuration file for the location of your choice (they have well defined streaming locations too.)
5. On the same page, after the configuration file was generated you'll see a QR code.
6. Load the QR code on the phone application ('+' and 'Scan from QR code'.) Do not skip this step - it's a time (and head banging) saver. I had 2 configuration (out of 5) that did not connect, so no reason to troubleshoot the script for that. Make sure it connects and works on the phone - remove the phone from your network WiFi for this exercise.)
7. Disconnect the OpenVPN client
8. Edit the .conf file on your PC (use Notepad++) and make it look similar to this:
Code:
# Comment of your choice (i.e. location)
[Interface]
PrivateKey = ???
ListenPort = 51820 - remove this line altogether; a dynamic port will be assigned
Address = ???
DNS = ???
[Peer]
PublicKey = ???
PresharedKey = ???
AllowedIPs = 0.0.0.0/0
Endpoint = ???
PersistentKeepalive = 259. Rename the file to wg11.conf and copy to /opt/etc/wireguard.d
10. On your PC start wgm and copy and paste the following one line at a time - make sure there are no errors.
Code:
import wg11
peer wg11 rule add 192.168.1.xxx comment wg test pc - replace 'xxx' as appropriate
peer wg11 auto=p
start wg11
list12. Test connectivity (all other devices on the network are unaffected at this point since OpenVPN client is disconnected.) Only your configured PC is tunneled through the wg11 client.
13. If all looks good carry on with the following (to route the whole network through the tunnel)
Code:
peer wg11 rule add wan 192.168.1.1 comment Router to WAN
peer wg11 rule add 192.168.1.0/24 comment LAN to VPN
peer wg11 - you'll see 3 lines there - make note of the ID number of the original rule
peer wg11 rule del <ID> - ID is the number from the previous step (1 probably)
peer wg11 auto=y
peer wg11 dns=192.168.1.1
restart wg11NOTES:
- x3m can stay - it only routes IP sets through the OpenVPN clients - no harm done.
- if you use Unbound and use VPN redirection make sure you disable (delete) that such that it will work through the WAN (at least for now.)
- I still use OpenVPN for some real world work since it's the proven path. Wireguard is 2-2.5 times faster on my router and looks promising for the future and current personal stuff...
If I skipped a step, please post and I'll edit here. Good luck!
EDIT: Changed command line numeric entries to text as per @Martineau and modified the Router to WAN statement.
Last edited:
Thanks for the assist.
So I believe I have everything setup correctly (or maybe not) since I can't use the internet at all. Any ideas what I'm doing wrong???? At this point, I know is user error haha
Here is the output fo peer wg11:
This is what I get for IP Rule:
wg show wg11:
ifconfig wg11:
So I believe I have everything setup correctly (or maybe not) since I can't use the internet at all. Any ideas what I'm doing wrong???? At this point, I know is user error haha
Here is the output fo peer wg11:
Code:
E:Option ==> peer wg11
Peers (Auto=P - Policy, Auto=X - External i.e. Cell/Mobile)
Client Auto IP Endpoint DNS MTU Public Private Annotate
wg11 P 10.100.0.xxx/32 199.115.xxx.xx :51820 Wm/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx= mxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx= # N/A
Selective Routing RPDB rules
ID Peer Interface Source Destination Description
1 wg11 VPN 192.168.1.222 Any wg test pc
WireGuard ACTIVE Peer Status: Clients 1, Servers 0This is what I get for IP Rule:
Code:
admin@GT-AX11000-xxxx:/tmp/home/root# ip rule
0: from all lookup local
9911: from 192.168.1.222 lookup 121
9990: from all fwmark 0x8000/0x8000 lookup main
9995: from all fwmark 0x1000/0x1000 lookup ovpnc1
32766: from all lookup main
32767: from all lookup defaultwg show wg11:
Code:
E:Option ==> wg show wg11
WireGuard Userspace Tool:
interface: wg11
public key: dxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=
private key: (hidden)
listening port: 51820
peer: Wm/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=
preshared key: (hidden)
endpoint: 199.115.xxx.xx:51820
allowed ips: 0.0.0.0/0
transfer: 0 B received, 6.65 KiB sent
persistent keepalive: every 25 seconds
ENABLED WireGuard ACTIVE Peer Status: Clients 1, Servers 0ifconfig wg11:
Code:
dmin@GT-AX11000-xxxx:/tmp/home/root# ifconfig wg11
wg11 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.100.0.162 P-t-P:10.100.0.162 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MTU:1420 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:86 errors:0 dropped:1145 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:12728 (12.4 KiB)
Last edited:
Similar threads
Similar threads
Similar threads
-
New Addon - ChatAI - have a chat session with Googles Gemini AI Bot- Started by JGrana
- Replies: 2
-
Solved How do I remove WG Manager from amtm without resetting amtm?
- Started by DJones
- Replies: 2
Latest threads
-
-
Ubuntu Linux impacted by decade-old 'needrestart' flaw that gives root- Started by PR3MIUM
- Replies: 0
-
-
-
Support SNBForums w/ Amazon
If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!
Sign Up For SNBForums Daily Digest
Get an update of what's new every day delivered to your mailbox. Sign up here!