Wireguard Client To Client Communication Issue

Hi-Volt · 2022-10-25T21:12:49.934Z

Hi to everyone, I’m a new user!
I have searched and read discussions started by other users with similar issues and followed different suggestions found in the web, but, unfortunately, due also to my limited experience in networking, without success.
I have two Mango GL-MT300N-V2 in my network, as shown in the attached picture. One of them configured as Wireguard server, the other as a client. Server is connected through WAN port to my ISP modem/router with public static-IP. The modem forwards traffic received at the port 51820 (Wireguard) to the server.
The Mango client is connected to Internet through a LTE usb dongle and an IP camera is connected to its LAN port.
In the client I have configured a port forwarding that redirects all the traffic received from the Wireguard network at the port 8080 to my IP camera at port 80.
In addition, I have another client in my smartphone through the Wireguard APP.
From the server I’m able to reach my IP camera without issues. No luck from my smartphone. From my smartphone I’m able to ping the server IP address (10.0.0.1) but not the other client’s IP. I know that it is necessary to configure another port forwarding to obtain client to client communication: I have followed different solutions as described above but without success. I’m able to modify files inside Mango by WinSCP.
Please could you help me? If necessary, I will paste here my firewall, network and Wireguard files.
Thank you in advance for the support!

Network1920×1080 171 KB

yuxin.zou · 2022-10-26T01:55:46.953Z

Did you add 10.0.0.2/24 to AllowedIPs in the WireGuard configuration file on your phone?

Hi-Volt · 2022-10-26T19:53:20.766Z

Thank you for the answer
I did as suggested but unfortunately without success

yuxin.zou · 2022-10-27T09:06:12.911Z

I am not sure if this is a problem with the phone. Can you test it on a PC using the same profile and check the routing table?

Hi-Volt · 2022-10-27T19:36:50.489Z

Hi,
same issue, I’ve created another user, now I have:

Cam
Mobile
PC
From PC I was not able to ping also the server 10.0.0.1, then I have added 10.0.0.1 to the Allowed IPs in the PC configuration and now I’m able to ping it. Adding 10.0.0.2 (the IP address of the Cam Client) to the PC configuration, nothing change, always unable to reach the Cam Client.
During my tests, I have followed the suggestions reported Here . In my network configuration is not defined the interface “wg0”, then I have read this guide to create WG server manually but, always without success.
I hope that links above could help.
Thank you!

yuxin.zou · 2022-10-28T07:50:37.717Z

Can you look at the routing table or trace the leap point on your PC? Use these commands to check that when you access 10.0.0.2, the data is correctly forwarded to the WireGuard tunnel.

# Windows
route print
tracert 10.0.0.1
tracert 10.0.0.2

# Linux
route
traceroute 10.0.0.1
traceroute 10.0.0.2

Hi-Volt · 2022-10-28T21:24:22.315Z

Hi!
As visible in the screenshot, the Wireguard interface is enabled and both IP addresses (both in allowed IP address of Windows-PC Client) 10.0.0.1 (Server) and 10.0.0.2 (Cam Client) are routed to IP 10.0.0.4 (my Windows-PC Client).
Launching traces, only the first one to the IP 10.0.0.1 ends successfully.
I’ve tried a test with Open VPN and everything works fine, but performances are lower than Wireguard as expected

Route Print & Traces960×1301 255 KB

yuxin.zou · 2022-10-31T06:43:39.234Z

I notice that you have added a new node 10.0.0.4 to the PC. have you tried to see each other between 10.0.0.4 and 10.0.0.3?

Hi-Volt:

I’ve tried a test with Open VPN and everything works fine, but performances are lower than Wireguard as expected

The default MTU value of OpenVPN is 1500 and for WireGuard it is 1420. Maybe you can try changing the MTU value.

awolfend · 2022-10-31T12:25:44.956Z

MTU should not matter as Traceroute packet sizes are typically small.

awolfend · 2022-10-31T12:32:28.362Z

This is very likely the same Wirguard LAn access issue here:
Wireguard Client failed access to GLiNet Wireguard Server Lan (firmware 4.1) - GL.iNet (gl-inet.com)

alzhao · 2022-11-02T04:43:26.031Z

You are setting Site-2-Site setup. You need to mange the routing on each node.

You cannot ping from one Wireguard client to another Wireguard client withoug setting the routing.

Pls use our cloud managed solution to set up S2S network.