How to set up GLiNet as wireguard client?

Technical Support for Routers VPN, DNS, Leaks
1

Hi,

I have a GLiNet travel router that I'd like to use as a wireguard client to transparently route all traffic through my wireguard server I have set up at home. Basically I'd like all clients connected to my glinet travel router to appear as if they are connecting from home.

My current conf files look like this:

# server (some server on my home network)
[Interface]
Address = 10.0.0.1/24
PrivateKey = ...
ListenPort = 51820

[Peer]
PublicKey = ...
AllowedIPs = 10.0.0.2/32


#client (GLiNet)
[Interface]
Address = 10.0.0.2/32
PrivateKey = ...
MTU= 1420

[Peer]
AllowedIPs = 0.0.0.0/0
Endpoint = ...:51820
PublicKey = ...

The problem I'm having now is that though the tunnel can be established, I cannot actually reach the internet from any client connected to my glinet router. I think I need an additional step to tell the server how to route traffic from the wireguard tunnel back out to the internet, but I'm unsure how to do this. It seems like this would be a common use case of wireguard, so hopefully somebody can enlighten me. Thank you!

2

Hi,

check this WireGuard Client - GL.iNet Router Docs 4 and How to troubleshoot WireGuard for the most common issues.

1 Like
3

Hey Admon,

I've read through those docs but still have the same issue. My configuration is basically the same as your docs. Again, I can connect to the tunnel but cannot connect to the internet through it. For example all DNS queries go through the tunnel, but I think my server doesn't know how to send it along, so a response is never returned. I tried setting the DNS field, but regardless the server does not route internet traffic.

4

To be clear I am setting up the wireguard "server" on raspberry pi at home. I have the port forwarded so that's how the tunnel can be established. Is there some additional configuration I need so that the raspberry pi knows how to forward internet traffic?

5

I’m having the same exact issue. Please let me know if you find a solution…. Thanks

6

Some things to try:

From a CLI on the client

Try pinging a public IP address (or trace-route) to see if you can see the WAN from the server side of the tunnel.

Try a name lookup to see if it resolves or times out.

If you have logs available at the server end look to see if you can see the inbound traffic.

7

I think I need to do one or both of these things:

  1. Configure iptables to provide NAT to the wg0 interface
  2. Enable net.ipv4.ip_forward and net.ipv4.conf.all.forwarding

Will need to do some research to make sure I get those right.

8

I found https://www.cyberciti.biz/faq/how-to-set-up-wireguard-firewall-rules-in-linux/ which seems like exactly what I need.

1 Like