Spitz X3000 WG Server cant access downstream router Lan

[blancmange]

Spitz is on latest firmware 0803release

I can access the Spitz admin panel (192.168.6.1) from mobile data on WG server, and I have WG client internet, but I cant access downstream router on 192.168.50.1 or it’s devices.

Spitz can ping downstream router and vice versa.

PING 192.168.50.1 (192.168.50.1): 56 data bytes
64 bytes from 192.168.50.1: seq=0 ttl=64 time=345.853 ms
64 bytes from 192.168.50.1: seq=1 ttl=64 time=40.885 ms
64 bytes from 192.168.50.1: seq=2 ttl=64 time=47.373 ms
64 bytes from 192.168.50.1: seq=3 ttl=64 time=42.657 ms
64 bytes from 192.168.50.1: seq=4 ttl=64 time=54.107 ms

--- 192.168.50.1 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 40.885/106.175/345.853 ms

[will.qiu]

Hi

Could you draw a network topology and label the devices' IP addresses and roles (WireGuard server/client) so we can better understand your issue?

[blancmange]

@will.qiu Hopefully it’s easier to understand my previous comment from this….let me know if it’s not clear.. And all 3 routers are in Router mode

[will.qiu]

Could you clarify whether the router with 192.168.50.1 is directly connected to the X3000 or connected as a WireGuard client through a VPN tunnel?

Also, is your goal wish to connect to the X3000 via WireGuard on your phone while accessing devices at both 192.168.6.1 and 192.168.50.1?

[blancmange]

@will.qiu

Could you clarify whether the router with 192.168.50.1 is directly connected to the X3000 or connected as a WireGuard client through a VPN tunnel?

Yes, the 192.168.50.1 router is connected via Ethernet cable to the Spitz, it gets its internet WAN from the Spitz.

And yes, from mobile id like to access 192.168.50.1 and all of its devices….

At the moment using the WG server of the Spitz, I can only access the Spitz from my mobile. I cant access the downstream router or its devices on my home network.

[will.qiu]

Thank you for the clarification.
We'll need some time to set up the test environment and take a look. We'll provide an update later.

[will.qiu]

We have successfully verified this configuration locally using a Spitz AX (GL-X3000) running firmware v4.8.3 as the primary router.

To allow your WireGuard clients to access resources on a downstream router (like a BE9300 at 192.168.50.1), please follow these steps:

1. On the Spitz AX (Primary Router)

• Enable Remote Access: Go to VPN > WireGuard Server > Options and turn on "Allow Remote Access to the LAN Subnet."
  

  

• Add a Static Route: To tell the Spitz AX how to find the 192.168.50.x network, navigate to LuCI > Network > Routing > Static IPv4 Routes and add a new route:

  • Interface: lan
  • Target: 192.168.50.0/24
  • Gateway: [Enter the IP address that the Spitz AX has assigned to the downstream router].

• Pro-Tip: Assign a Static IP to the downstream router (under Network > LAN) to ensure this route remains active if the device reboots.
  
  

2. On the Downstream Router (e.g., BE9300)

• Firewall Adjustment: By default, routers block incoming traffic on the WAN port. To allow the WireGuard remote traffic through, go to LuCI > Network > Firewall and modify the WAN zone to allow Forwarding to the LAN zone.
  
  
  
  
  

3. Verification: Once these steps are complete, your mobile WireGuard clients will be able to reach the downstream router and its connected devices directly.
   

[blancmange]

Thank you SO much @will.qiu It works! I’ve been wanting to do this for a few years! Finally!

Wireguard server can't access downstream router and LAN

I can access the Brume2 Wireguard server remotely, and the admin panel of the Brume2, but I cant access the router downstream, or all the devices connected to it. “Remote access Lan” is on. “IP Masquerading” is on. How do I gain access. I’ve tried opening a port… Which setting am I missing please.

I asked a few years ago and nobody could help.

I’m very happy! Incidentally the downstream router is an Asus. Thank you again.