Wireguard: stuck after configurating - how and what to connect?

liutas4x4 · 13. Januar 2024

My Wireguard is configured this way:

Tunnel

Code

[Interface]
Address = 10.192.1.254/24
SaveConfig = true
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
ListenPort = 51820
PrivateKey = XXXXXXXXXXXXXXXXXXXXX

[Peer]
PublicKey = YYYYYYYYYYYYYYYYYYYYYY
PresharedKey = ZZZZZZZZZZZZZZZZZZZZZZ
AllowedIPs = 10.192.1.1/32

Alles anzeigen

Client

Code

[Interface]
Address = 10.192.1.1/24
PrivateKey = xxxxxxxxxxxxxxxxxxxxx

[Peer]
PublicKey = yyyyyyyyyyyyyyyyyyyyyyy
PresharedKey = zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
Endpoint = domain.duckdns.org:51820

AllowedIPs = 10.192.1.0/24, 10.0.0.3

On Android:

So. Now I feel like a fish in a PE bag from Nemo Toon: "So what?"

My Files app, browser - no one can not access anything.
It seems I don't know to which IP should refer, which port - in other words - how to use this tunnel.

Eugenijus

liutas4x4 · 13. Januar 2024

On OMV those ports are open/presented:

chente · 13. Januar 2024

If you define 0.0.0.0/0 in the AllowedIPs field of the client (android) you will be able to access everything. Do you need to split traffic for some reason?

liutas4x4 · 13. Januar 2024

Zitat von chente

If you define 0.0.0.0/0 in the AllowedIPs field of the client (android) you will be able to access everything. Do you need to split traffic for some reason?

If I define 0.0.0.0/0 I will lose my access to the Net - the phone goes to Dragons.

chente · 13. Januar 2024

Zitat von liutas4x4

I will lose my access to the Net - the phone goes to Dragons.

What do you mean? What is Dragons?

liutas4x4 · 13. Januar 2024

In this case, while 0.0.0.0/0 and wireguard is on, I get lost access to the network from my phone.

While wireguard is off, I can map my OMV to My Files app. But If wireguard is on - I lost connection:

chente · 13. Januar 2024

Zitat von liutas4x4

While wireguard is off, I can map my OMV to My Files app

Should I understand that the smartphone can access OMV when the Wireguard tunnel is disabled? How is that possible?

liutas4x4 · 13. Januar 2024

Zitat von chente

Should I understand that the smartphone can access OMV when the Wireguard tunnel is disabled? How is that possible?

Simply:

My Files app -> Network drive -> Samba with settings above. Through WiFi, WLAN on the router.

chente · 13. Januar 2024

Zitat von liutas4x4

Simply:
My Files app -> Network drive -> Samba with settings above. Through WiFi, WLAN on the router.

The purpose of Wireguard is to connect to your local network from outside the network. Maybe you should read here, there's no point testing your Wireguard tunnel with wifi enabled. https://wiki.omv-extras.org/do…v6:omv6_plugins:wireguard

chente · 13. Januar 2024

I just added this sentence to the Wireguard document on the wiki. When I wrote that document I assumed that the users who get there know what Wireguard is for. Looks like I was wrong

omv6:omv6_plugins:wireguard [omv-extras.org]

Zitat

The main purpose of Wireguard is to facilitate the connection of two devices over the Internet securely.

liutas4x4 · 13. Januar 2024

Zitat von chente

The purpose of Wireguard is to connect to your local network from outside the network. Maybe you should read here, there's no point testing your Wireguard tunnel with wifi enabled. https://wiki.omv-extras.org/do…v6:omv6_plugins:wireguard

I read it at least twice. There are many "... if jellyfin ...", but no example for OMV. The explanation there is like a part of dialog between two, who understand and know. But it is not an explanation for others, who are out of knowledge.

While testing, WiFi is off.

What the difference should be in the settings for going through the tunnel?
The tunnel does not substitute traffic for some IPs when it is On?

chente · 13. Januar 2024

Zitat von liutas4x4

I read it at least twice. There are many "... if jellyfin ...", but no example for OMV

You mean accessing the OMV GUI through the tunnel? The example there is applicable to any service, you can simply type your server's IP into a browser in the same way as if you were on your local network.

Zitat von liutas4x4

The explanation there is like a part of dialog between two, who understand and know. But it is not an explanation for others, who are out of knowledge.

I'm sorry this is so, I always try to write in a way that anyone can understand. I had the same difficulties when I started to delve a little deeper into Linux and try to make reading easy. Maybe Wireguard is more difficult to explain in simple words, I suppose it is necessary to have some minimal knowledge of networks. Which part causes you a problem understanding? I can try to help with this.

Zitat von liutas4x4

What the difference should be in the settings for going through the tunnel?

You are setting specific network range parameters in the AllowedIPs field. What this does is restrict your smartphone traffic to the tunnel only through the defined ranges. You should remove that and set 0.0.0.0/0 to check that the tunnel is working correctly. Once verified, if you need to split traffic for some reason, you can experiment in that area until you find the right configuration for your needs.

Zitat von liutas4x4

The tunnel does not substitute traffic for some IPs when it is On?

The Wireguard tunnel is only a network interface. You can restrict traffic through that interface to the IPs you need.

liutas4x4 · 13. Januar 2024

OK. I got your positive emotions ))

But let's go back to knowledge:

In my first post, you see all the settings. It was the second iteration after 0.0.0.0/0 did not allow me to connect anything to anything.

Later, you can see the settings without the tunnel where I can connect to OMV locally.

When I turned the client's wireguard ON and WiFi off, the tunnel did not allow me to connect the same points.

What is the difference? In my case, should 10.0.0.3 (OVM address) remain the same? Port 445 (SMB) - the same or something other?

chente · 13. Januar 2024

Zitat von liutas4x4

In my first post, you see all the settings. It was the second iteration after 0.0.0.0/0 did not allow me to connect anything to anything.
Later, you can see the settings without the tunnel where I can connect to OMV locally.

When I turned the client's wireguard ON and WiFi off, the tunnel did not allow me to connect the same points.

What is the difference? In my case, should 10.0.0.3 (OVM address) remain the same? Port 445 (SMB) - the same or something other?

The first thing of all is to make sure that the tunnel works. Works? When you connect it, can you see that it sends and receives data from your smartphone? You should make sure of this before anything else.

Is your public IP accessible from the internet? Does the domain you have configured point to your public IP? Have you opened the corresponding port on your router (in your case 51820)?

This may help. https://wiki.omv-extras.org/do…_the_network_from_outside

Assuming it's working. 0.0.0.0/0 is just allowing any IP requests to be routed through the tunnel, this is what you want.

In your case, if I'm not mistaken, you need to reach 10.0.0.3 which I believe is the IP of your server. 0.0.0.0/0 will allow that traffic on any port.

The network range that configures the tunnel in this case is 10.192.1.0/24 and the IP of your server is 10.192.1.254 So you could also use that IP to reach, it should be the same.

liutas4x4 · 13. Januar 2024

Zitat von chente

....
Does the domain you have configured point to your public IP? Have you opened the corresponding port on your router (in your case 51820)?

If I open port, let's say 51820, I don't need any wireguard.
It is the way I connect to File Browser via https:// without any additional tunneling.

No need for any tunnel there - port forwarding is enough.

Zitat von chente

This may help. https://wiki.omv-extras.org/do…_the_network_from_outside

Assuming it's working. 0.0.0.0/0 is just allowing any IP requests to be routed through the tunnel, this is what you want.
In your case, if I'm not mistaken, you need to reach 10.0.0.3 which I believe is the IP of your server. 0.0.0.0/0 will allow that traffic on any port.
The network range that configures the tunnel in this case is 10.192.1.0/24 and the IP of your server is 10.192.1.254 So you could also use that IP to reach, it should be the same.

That IP. OK. 10.192.1.254?

And which port?

chente · 13. Januar 2024

Zitat von liutas4x4

OK. I got your positive emotions ))

Any user has them when we start talking

Zitat von liutas4x4

If I open port, let's say 51820, I don't need any wireguard.
It is the way I connect to File Browser via https:// without any additional tunneling.
No need for any tunnel there - port forwarding is enough.

?? Do you have any services pointing to that port? In that case there is a conflict, you should not use the same port for two different services.

Zitat von liutas4x4

That IP. OK. 10.192.1.254?
And which port?

The port you want to access. What service do you want to access?

Wireguard: stuck after configurating - how and what to connect?

Jetzt mitmachen!

Tags