Mudi 7 - WireGuard: no internet

Router VPN, DNS, Leaks
1

hi,

i use a wireguard config to connect to my home net 10.10.x.x

It works fine, but i have no internet after connect. ping to 8.8.8.8 not working.

same config works on my mac book as WG client:

[Interface]
Address = 192.168.2.4/32
PrivateKey = yEo*******************=
DNS = 8.8.8.8,192.168.2.1
MTU = 1420

[Peer]
AllowedIPs = 10.10.0.0/16
Endpoint = dial-in.my-provider.de:51820
PersistentKeepalive = 25
PublicKey = gBY******************=

my second config with routing all traffic 0.0.0.0/0 works fine.

what is the problem here?

best regards,
daniel

2

Try disabling the Kill Switch and see if will work.

3

Thanks for your response — I missed this configuration button:

image
image1172×906 60.7 KB

But there was no success. The internet is still unavailable when the VPN is on:

$ ping 10.116.0.10
PING 10.116.0.10 (10.116.0.10): 56 data bytes
64 bytes from 10.116.0.10: icmp_seq=0 ttl=62 time=99.723 ms
64 bytes from 10.116.0.10: icmp_seq=1 ttl=62 time=117.137 ms
^C
--- 10.116.0.10 ping statistics ---
2 packets transmitted, 2 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 99.723/108.430/117.137/8.707 ms

$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
^C
--- 8.8.8.8 ping statistics ---
4 packets transmitted, 0 packets received, 100.0% packet loss
4

I tryed to fix it with claude via ssh checks, the final response:

Now it's 100% clear. The GL.iNet WireGuard client is always adding the killswitch rules regardless of the UI toggle. This is a bug (or the UI toggle doesn't do what you think).

For the full chat link, please pm me.

5

I disagree. Kill-switch has nothing to do with it.
In the top-right of the "VPN Dashboard" you have "VPN Mode". Likely you have selected "Global mode". That mode means: Route all traffic through the VPN tunnel.

At the same time your VPN says:

AllowedIPs = 10.10.0.0/16

and is therefore blocking all internet traffic send there!

For what you need, you want "Policy" mode. In there you can define that traffic from all clients for just 10.10.0.0/16 needs to go through that VPN. All other traffic should just go the normal way.

This isn't a kill-switch issue, but a routing issue...

2 Likes
6

Many thanks — I hadn't seen that configuration before - its working now.

image
image1710×1138 106 KB

And it's very nice — I can add a routing list from a URL, which opens up so many possibilities.

7

There is an impressive array of wrong and confusing information here, except for groentjuh’s post. So let me make it worse.

One needs to distinguish between the policy routing and the wg configuration. Starting with the WG configuration, your peer is trying to reach a 192.168.2.4 address, which isn’t routable, so I don’t know where you are connecting from or to in the first place. Second, your allowed ips for this peer is a subnet 65,000 addresses large that encompasses all of the 10.10.xx.xx range, but none of the 10.116.xx.xx range, so I don’t see how your later configuration can reach 10.10.xx.xx. You ought to be able to manage with 10.10.0.0/24. So in the first instance, WG will only pass traffic in that allowed range. It blocks everything else, including any routable address. That’s why 0.0.0.0/0 works–WG passes all traffic over the tunnel, and the internet is reached from the other side of the tunnel.

The policy routing is on top of that, and manages what will be sent to WG in the first place. So when you define 10.10.0.0/16 to go over WG, that means everything else, including the internet, is reached from the near side of the tunnel. So it seems to work, but is that what you wanted?

8

my peer has this ip in the VPN tunnel to the endpoint 192.168.2.1 and uses the .1 as gateway to my home net. (so the mudi router is not in my homenet 10.10…..)

the 10.116.0.0 is from another screenshot - its another vpn tunnel i used for testing so i’m sure its not a problem on the other side.

sorry for not made this clear.

9

Got it. Thanks. I think you need 192.168.2.0/24 in your allowed ips.

10

only if you want the clients can contact each other.