Trouble Connecting Beryl AX Router (GL-MT3000) to WireGuard (Mullvad) and OpenVPN (ProtonVPN) on Firmware v4.6.9

Technical Support for Routers VPN, DNS, Leaks
1

Hello everyone,

I’m running into a connectivity issue with my GL.iNet Beryl AX (GL-MT3000) router on firmware v4.6.9. Despite repeated attempts, I haven’t been able to establish successful connections with either WireGuard (using Mullvad) or OpenVPN (using ProtonVPN). I’d really appreciate any advice or insight from anyone who might have encountered similar issues or knows where to start troubleshooting.

Here are some details from the logs for both connection attempts:

WireGuard (Mullvad) Log:

Sun Nov 10 15:36:20 2024 daemon.notice netifd: Interface 'wgclient' is setting up now
Sun Nov 10 15:36:20 2024 daemon.notice netifd: wgclient (17782): RTNETLINK answers: Permission denied

WireGuard with IPv6 Enabled:

Sun Nov 10 16:49:20 2024 user.notice nat6: Firewall config="wgclient" zone="wgclient" zone_masq6="1".
Sun Nov 10 16:50:16 2024 user.notice nat6: Firewall config="wgclient" zone="wgclient" zone_masq6="1".
Sun Nov 10 16:50:21 2024 user.notice nat6: Firewall config="wgclient" zone="wgclient" zone_masq6="1".
Sun Nov 10 16:50:33 2024 daemon.notice netifd: Interface 'wgclient' is setting up now
Sun Nov 10 16:50:35 2024 user.notice nat6: Firewall config="wgclient" zone="wgclient" zone_masq6="1".
Sun Nov 10 16:50:35 2024 user.notice nat6: Found firewall zone_name="wgclient" with zone_masq6="1" zone_masq6_privacy="1".
Sun Nov 10 16:50:35 2024 user.notice nat6: Setting up masquerading nat6 for zone_name="wgclient" with zone_masq6_privacy="1"
Sun Nov 10 16:50:35 2024 user.notice nat6: Ensuring ip6tables chain="zone_wgclient_postrouting" contains our MASQUERADE.
Sun Nov 10 16:50:35 2024 user.notice nat6: Ensuring ip6tables chain="zone_wgclient_input" contains our permissive DNAT rule.
Sun Nov 10 16:50:35 2024 user.notice nat6: Ensuring ip6tables chain="zone_wgclient_forward" contains our permissive DNAT rule.
Sun Nov 10 16:50:35 2024 user.notice nat6: Done setting up nat6 for zone="wgclient" on devices:
Sun Nov 10 16:52:19 2024 user.notice wireguard-debug: USER=root ifname=wgclient ACTION=REKEY-GIVEUP SHLVL=1 HOME=/ HOTPLUG_TYPE=wireguard LOGNAME=root DEVICENAME= TERM=linux SUBSYSTEM=wireguard PATH=/usr/sbin:/usr/bin:/sbin:/bin PWD=/
Sun Nov 10 16:52:19 2024 daemon.notice netifd: Interface 'wgclient' is now down
Sun Nov 10 16:52:19 2024 daemon.notice netifd: Interface 'wgclient' is setting up now
Sun Nov 10 16:52:19 2024 user.notice firewall: Reloading firewall due to ifdown of wgclient ()
Sun Nov 10 16:52:19 2024 user.notice nat6: Firewall config="wgclient" zone="wgclient" zone_masq6="1".
Sun Nov 10 16:52:19 2024 user.notice nat6: Found firewall zone_name="wgclient" with zone_masq6="1" zone_masq6_privacy="1".
Sun Nov 10 16:52:19 2024 user.notice nat6: Setting up masquerading nat6 for zone_name="wgclient" with zone_masq6_privacy="1"
Sun Nov 10 16:52:19 2024 user.notice nat6: Ensuring ip6tables chain="zone_wgclient_postrouting" contains our MASQUERADE.
Sun Nov 10 16:52:19 2024 user.notice nat6: Ensuring ip6tables chain="zone_wgclient_input" contains our permissive DNAT rule.
Sun Nov 10 16:52:19 2024 user.notice nat6: Ensuring ip6tables chain="zone_wgclient_forward" contains our permissive DNAT rule.
Sun Nov 10 16:52:19 2024 user.notice nat6: Done setting up nat6 for zone="wgclient" on devices:

OpenVPN (ProtonVPN) Log:

Sun Nov 10 15:35:09 2024 daemon.notice netifd: Interface 'ovpnclient' is setting up now
Sun Nov 10 15:35:09 2024 daemon.notice ovpnclient[14565]: OpenVPN 2.5.3 aarch64-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Sun Nov 10 15:35:09 2024 daemon.notice ovpnclient[14565]: library versions: OpenSSL 1.1.1q  5 Jul 2022, LZO 2.10
Sun Nov 10 15:35:09 2024 daemon.warn ovpnclient[14565]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sun Nov 10 15:35:09 2024 daemon.notice ovpnclient[14565]: TCP/UDP: Preserving recently used remote address: [AF_INET]185.107.56.76:80
Sun Nov 10 15:35:09 2024 daemon.notice ovpnclient[14565]: UDP link local: (not bound)
Sun Nov 10 15:35:09 2024 daemon.notice ovpnclient[14565]: UDP link remote: [AF_INET]185.107.56.76:80
2

Hi,

May I know if the Mullvad/ProtonVPN profile is connected normal in the WireGuard of PC client?

Please follow this thread to check in the router if PC WireGuard is normal:

4

Hi @bruce,

I’m unsure how my PC is related to this issue, as the main concern seems to be with the router itself. Specifically, the issue appears to be with the router not successfully establishing a functional tunnel between its WireGuard client (GL.iNet Beryl AX (GL-MT3000)) and Mullvad’s servers.

5

Are you somewhere where VPN usage is not allowed?
Are the used servers up? Servers

6

@admon I'm based in Germany, and the system seems to be working correctly from all other devices except for this one.

7

Please check if the used servers are up.
Some FRA servers are down since a few weeks now.

8

I'm using other servers in Switzerland, they seem to be working.

10

It seems to be working now—thank you for your help and time!

Mfg hw

11

glad its working , nice :ok_hand: