Beryl GL-MT1300 Site to Site wireguard routing salad

Technical Support for Routers VPN, DNS, Leaks
1

Hi guys,

I have Wireguard tunnel set-up between two routers: one is my travel Beryl (running official firmware 4.3.19) and the other one is a Linksys, running OpenWRT. The subnets are:

Wireguard Beryl site: 192.168.20.0/24
Wireguard Linksys site: 192.168.1.0/24

This whole setup works perfectly fine, since I can access hosts from both sites towards both sites as if they were in the same LAN. On the OpenWRT site, that is done with routes towards the wireguard interface, as it would be done on any Linux. On the Beryl site though, this is done in a way that I can't really figure out, so the ip route output is always the same before and after I switch on the Wireguard tunnel.

Now, I have this specific situation where I have an intermediate internet gateway (e.g. a public wifi) which I want to bridge through the Beryl, and that WiFi is using the same subnet as my Linksys router. So the routing path looks as follows:

Beryl (subnet 192.168.20.0/24) -> Intermediate Gateway (192.168.1.0/24) -> Linksys (192.168.1.0/24).

And the ip route output of Beryl, with the Wireguard tunnel enabled, looks as follows:

default via 192.168.1.1 dev wlan-sta0 proto static src 192.168.1.3 metric 20
192.168.1.0/24 dev wlan-sta0 proto static scope link metric 20
192.168.20.0/24 dev br-lan proto kernel scope link src 192.168.20.1

In that situation, the whole Linksys (192.168.1.0/24) subnet is unreachable, although the internet is correctly routed through the Wireguard tunnel.

I know I could solve it with OpenWRT firmware on the Beryl and then using that version of Wireguard, but I want to use the official firmware.
Can someone guide me through the way routing works here, and what exactly am I missing?

Thank you in advance!

2

This won't work because routing can't route if there is a duplicated network.
The best would be to just change your linksys network to one that does not overlap here, imho.

3

But I don't want to have a duplicate network. I want the intermediate router and all the intermediate 192.168.1.0/24 to be inaccessible from the Beryl subnet. In favor of the Linksys one. So in essence I want the 192.168.1.0/24 to be routed through the Beryl's wgclient interface.

But somehow the Beryl routes everything through the br-lan interface, which is something I do not understand at all.
I mean, if I shut down the Wireguard link from the web-interface, the ip route command will have exactly the same output!

I would like to understand what is happening under the hood here, I cannot understand how does the Beryl handle routing. Am I missing something here?

4

If the wireguard enabled, it creates an interface 'wgclient' on the ifconfig, as well as a route ip route.

image
image813×186 6.78 KB

If the Beryl is not repeated to the 'Intermediate Gateway', does it have the wg route?