Flint Stuck in endless loop on Wireguard start

globalgenki · 2022-11-02T16:30:40.169Z

I just purchased the AXT1800 and I am having the same problem with client loop.My logs look the same as above.

Server details:
New AXT1800 set up as wireguard server, using DDNS, ddns bypass vpn in global options, router mode, ISP modem/router combo in bridge mode

Client details:
New AXT1800 set up as wireguard client.

I have:
Verfied timezone/date/time sync
Tried every method of config upload/entry on client
Reset router
Re-generated config on router 2X
Tried to manually configure in wireguard ios app for alternative testing, “connects” but no internet.

alzhao · 2022-11-03T04:34:59.552Z

globalgenki:

New AXT1800 set up as wireguard server, using DDNS, ddns bypass vpn in global options, router mode, ISP modem/router combo in bridge mode

Pls note, if you vpn cannot connect at all, it is not this problem. The thread is talking about vpn can connect but broken for no reason.

Did you:

change LAN IP of at least one router from 192.168.8.1 to others
Have you verified the ddns is correctly resolved?
Do you have vpn client configured on server AXT1800?

akki · 2022-11-17T17:24:04.154Z

@stickybit

All he has been saying for months on multiple threads where many people complained about the same

I cant replicate at my end - what is he using? a windows xp?
Your provided config is wrong - yet people are connecting with the same config on other routers
Your vpn doesnt work - yet people are connecting with the same config on other routers

and keeps asking for configs
When repeatedly people have said , the configs work on other systems.

@alzhao Stop pointing fingers at others . Clearly its your device/firmware issue. Own it take responsibility and fix it rather than asking people for configs. I can assure u that u will never be able to replicate/or the config will be invalid if you are not willing to own ur mistakes

We did not spend 3 times the money of a normal router(on most of which openwrt can be install eitherways) to go through this and do ur job to debug ur buggy system . We paid more to get the product and service . It’s ridiculous to say i cant replicate at my end … Get ur own devices/ur own configs/servers whatever to replicate and find a solution.

It is not our job to provide you with configs. The vpns and servers run clearly elsewhere its your system problem. Admit and fix it

NLCJohn · 2022-11-17T21:56:37.566Z

@alzhao the issue is that we can’t connect at all using Wireguard, the outgoing configs are not the issue since OpenVpn works and portforward work.

It is an infinite loop where we see the timeouts.

danbratu · 2022-11-17T22:48:56.050Z

strange but if you will manually assign dns servers (to public google for eg.) and disable ipv6, wireguard connects without any issue. when dns is set on auto, and/or ipv6 enabled… endless loop (rekey blah blah).

K3rn3l_Ku5h · 2022-11-17T23:08:23.010Z

Oh dam is it fw3 to fw4 migration issue again
If you are on openwrt 22.03.x NFTables are starting to be used. Config files that are created pry to 22.03.x use IPtables. Best solution I have found is set up everything from scratch and make a config based on that.

alzhao · 2022-11-18T05:11:59.954Z

akki:

It is not our job to provide you with configs.

If you have issues need to provide something. Otherwise how to solve.

I supported many many users. They decided the method how to help, e.g. providing config (usually for openvpn) or do remote check. I solved many cases related to Wireguard already.

akki:

Stop pointing fingers at others

Sorry for my bad English. What do you mean?

akki:

Clearly its your device/firmware issue. Own it take responsibility and fix it rather than asking people for configs. I can assure u that u will never be able to replicate/or the config will be invalid if you are not willing to own ur mistakes

I didn’t say the firmware has no issues.
I do replicte the problem and solved some cases. The TIMEOUT message is a very general message and it could relate to a lot of different cases.

xize11 · 2022-11-18T06:20:07.698Z

Besides it might be the iptables to nftables issue,
Could anyone check what the result is if you remove the preshared key option both from server and client?, I believe for openvpn that is a tls key.

When I hosted my own openvpn server a really long time ago, it only complicated configuration, you want the config as simple as possible to get a start.

alzhao · 2022-11-18T07:40:10.260Z

xize11:

Could anyone check what the result is if you remove the preshared key option both from server and client?, I believe for openvpn that is a tls key.

I got a case that this happens on ProtonVPN Wireguard. It does not come with a pre-shared key.

I am testing ProtonVPN Wireguard now.

gor1kgor1k · 2022-11-29T10:28:18.644Z

Same issue here - works on the laptop itself, but can’t connect my router.
Tue Nov 29 13:26:32 2022 user.notice wireguard-debug: USER=root ifname=wgclient ACTION=REKEY-TIMEOUT SHLVL=2 HOME=/ HOTPLUG_TYPE=wireguard LOGNAME=root DEVICENAME= TERM=linux SUBSYSTEM=wireguard PATH=/usr/sbin:/usr/bin:/sbin:/bin PWD=/
Tue Nov 29 13:26:37 2022 user.notice wireguard-debug: USER=root ifname=wgclient ACTION=REKEY-TIMEOUT SHLVL=2 HOME=/ HOTPLUG_TYPE=wireguard LOGNAME=root DEVICENAME= TERM=linux SUBSYSTEM=wireguard PATH=/usr/sbin:/usr/bin:/sbin:/bin PWD=/

Serd · 2022-12-12T20:50:25.314Z

This is my endless loop

ser.notice wireguard-debug: USER=root ifname=wgclient ACTION=REKEY-TIMEOUT SHLVL=2 HOME=/ HOTPLUG_TYPE=wireguard LOGNAME=root DEVICENAME= TERM=linux SUBSYSTEM=wireguard PATH=/usr/sbin:/usr/bin:/sbin:/bin PWD=/

I have two wireguard VPN servers (created with pivpn) on two different raspberrys, but after updating to the last Flint version I can’t connect to them, but they are working as I can connect using MV1000 and using the android wireguard client

Any ideas ? Do you need any extra info?

K3rn3l_Ku5h · 2022-12-12T20:54:45.255Z

Are you using GUI of LuCi for setup?

Serd · 2022-12-13T07:23:12.733Z

I used GUI for the setup

alzhao · 2022-12-13T09:38:11.965Z

It does not connect at all, or it connect and break?

If it is the first case, may need to verify the config once again on your phone etc.

If you can, send me one config in private message.

Serd · 2022-12-13T20:13:34.546Z

it doesn’t connect
it works in the MV1000 and in the phone

blindman · 2023-01-14T03:50:23.660Z

I am getting the same problem

tech333 · 2023-01-16T01:16:43.982Z

Same. Did anyone figure this out? @alzhao @Serd

K3rn3l_Ku5h · 2023-01-16T15:28:54.245Z

Update Uboot
Do a clean install to 4.x using Uboot
Setup.

Most of the issues is caused by keeping settings

Back ups that are created in LuCi seem to work (don’t reuse a backup config file generated in 3.x

tech333 · 2023-01-16T21:57:23.513Z

Thanks for replying. Looks like it was a config file misconfiguration with the public key. I got it working, but now I keep getting this in the log, is it normal?

Mon Jan 16 16:45:47 2023 kern.info kernel: [ 1147.694386] wireguard: wireguard-hotplug IFNAME=wgclient ACTION=KEYPAIR-CREATED
Mon Jan 16 16:45:47 2023 user.notice wireguard-debug: USER=root ifname=wgclient ACTION=KEYPAIR-CREATED SHLVL=1 HOME=/ HOTPLUG_TYPE=wireguard LOGNAME=root DEVICENAME= TERM=linux SUBSYSTEM=wireguard PATH=/usr/sbin:/usr/bin:/sbin:/bin PWD=/
Mon Jan 16 16:47:47 2023 kern.info kernel: [ 1268.161091] wireguard: wireguard-hotplug IFNAME=wgclient ACTION=KEYPAIR-CREATED
Mon Jan 16 16:47:47 2023 user.notice wireguard-debug: USER=root ifname=wgclient ACTION=KEYPAIR-CREATED SHLVL=1 HOME=/ HOTPLUG_TYPE=wireguard LOGNAME=root DEVICENAME= TERM=linux SUBSYSTEM=wireguard PATH=/usr/sbin:/usr/bin:/sbin:/bin PWD=/
Mon Jan 16 16:49:47 2023 kern.info kernel: [ 1388.646300] wireguard: wireguard-hotplug IFNAME=wgclient ACTION=KEYPAIR-CREATED
Mon Jan 16 16:49:48 2023 user.notice wireguard-debug: USER=root ifname=wgclient ACTION=KEYPAIR-CREATED SHLVL=1 HOME=/ HOTPLUG_TYPE=wireguard LOGNAME=root DEVICENAME= TERM=linux SUBSYSTEM=wireguard PATH=/usr/sbin:/usr/bin:/sbin:/bin PWD=/
Mon Jan 16 16:51:48 2023 kern.info kernel: [ 1509.035397] wireguard: wireguard-hotplug IFNAME=wgclient ACTION=KEYPAIR-CREATED
Mon Jan 16 16:51:48 2023 user.notice wireguard-debug: USER=root ifname=wgclient ACTION=KEYPAIR-CREATED SHLVL=1 HOME=/ HOTPLUG_TYPE=wireguard LOGNAME=root DEVICENAME= TERM=linux SUBSYSTEM=wireguard PATH=/usr/sbin:/usr/bin:/sbin:/bin PWD=/

K3rn3l_Ku5h · 2023-01-17T01:18:51.664Z

Who is the VPN provider? alzhao I think did mention something about certain VPN that the keypair did not work. Also it might be a issue in you vpn config file.

Not sure if this is related:

Slate AX (GL-AXT1800) Wireguard Issue (REKEY-TIMEOUT) Technical Support for Routers

Today I worked with @hectorricardo to solve the problem. Several problems are identified. The wireguard config from Starvpn use domain name as endpoint. The domain resolves to several IP addresses. Different network will resolve to different IP address. Some IP addresses does not work. When hard core to certain IP address, it works OK. So this is definately a problem of Startvpn. This is verified on windows pc as well. Two bugs identified on our firmware: (a) The firmware does not work well wi…