Wireguard client connection from GL-MT1300 toWG-server

zyx360 · 2021-07-14T13:14:19.464Z

Hi,

I’m trying to setup a wireguard client connection from my GL-MT1300 to my wireguard-server at the office. I’ve used the online documentation to create the client connection: WireGuard Client - GL.iNet Docs

After creating the configuration and connecting the wireguard vpn through the gl-inet web interface i can’t seem to get traffic to pass through the tunnel.

Connection diagram1: wg-server <-> internet <-> gl-inet

My wireguard subnet is 10.11.12.0/24 where the server has .1/24 and the gl-inet has .2/32

I’m trying to ping 10.11.12.1 from the gl-inet device.

One strange thing i noticed that is when i do a traceroute from the gl-inet to 10.11.12.1 it seems to take the default gateway (internet) as opposed to the tunnel. Tcpdump on the server confirms no packets are received on tunnel and ethernet interface when i ping from the gl-inet.

To debug a little further i took the configuration from the gl-inet (wg showconf wg0) and copied it to a windows pc with wireguard behind the gl-inet

Connection diagram2: wg-server <-> internet <-> gl-inet <-nat-> test-windows-pc

When trying to establish the connection from the windows pc everything works as expected.
Ping to 10.11.12.1 works and traceroute shows a path through the tunnel on the windows pc.

I’m running out of ideas to test, and tbh i don’t see why diagram2 works and diagram1 does not.

So far i think it rules out a server-issue and a wireguard-client-config issue.
I tried lowering MTU to 1400 just for testing and that made no difference.

Anyone with a good hint ?

Cheers,
Zyx

alzhao · 2021-07-16T08:00:49.897Z

Did you do traceroute on the router? I think maybe it is because the default routing policy is not to use vpn for the router itself.

Set up vpn policy as below and check again.

image720×581 17.7 KB

zyx360 · 2021-07-31T19:33:47.239Z

Thanks for the reply and sorry for the long delay, just only now got the free time to debug further.

So i am on the road most of the time and therefor am a little afraid of testing while away only to find out i locked myself out of my home network.
As far as i understand this toggle it means that the router will then use the default gateway over the wg0 interface, is that right?

Do you know if there’s a less (potentially) destructive test?, or am i reading the functioning of the toggle wrong?

Regards,
Z

alzhao · 2021-08-03T06:00:59.716Z

The above settings in on the client side, so it will not lock you out because you have the client device with you.