WireGuard / wireguard-vyatta-ubnt

WireGuard for Ubiquiti Devices
https://www.wireguard.com/
GNU General Public License v3.0
1.46k stars 69 forks source link

No Internet Access after Configuration er-x router #9

Open droidforever opened 4 years ago

droidforever commented 4 years ago

I installed the new version of wireguard. Generated a new Mullvad config on Mullvad's wesite. Then proceeded with this configuration:

configure
edit firewall name wgIn
set description 'established only'
set default-action drop
set rule 10 action accept
set rule 10 state established enable
set rule 10 state related enable
exit
edit firewall name wgLocal
set description 'established only'
set default-action drop
set rule 10 action accept
set rule 10 state established enable
set rule 10 state related enable
exit
edit firewall ipv6-name wgIn6
set description 'established only'
set default-action drop
set rule 10 action accept
set rule 10 state established enable
set rule 10 state related enable
exit
edit firewall ipv6-name wgLocal6
set description 'established only'
set default-action drop
set rule 10 action accept
set rule 10 state established enable
set rule 10 state related enable
exit
edit interfaces wireguard wg0
set description mullvadvpn
set address {Mullvad Provided IP}/32
set address {Mullvad Provided ipv6}/128
set listen-port 51820
set route-allowed-ips false
set peer {Public Key Mullvad} endpoint {Mullvad IP}:51820
set peer {Public Key Mullvad} allowed-ips 0.0.0.0/0
set peer {Public Key Mullvad} allowed-ips ::0/0
set private-key {Private Key Mullvad}
set fwmark 190
set firewall in name wgIn
set firewall in ipv6-name wgIn6
set firewall local name wgLocal
set firewall local ipv6-name wgLocal6
exit
edit protocols static table 190
set description 'mullvad'
set interface-route 0.0.0.0/0 next-hop-interface wg0
exit
edit service nat rule 5190
set description 'masq mullvad'
set outbound-interface wg0
set type masquerade
exit
edit firewall modify lanInModify rule 187
set description 'do not mod wireguard ever'
set action accept
set destination port 51820
set protocol udp
exit
edit firewall modify lanInModify rule 188
set description 'allow access to ISP modem'
set action accept
set destination group address-group NETv4_eth0
exit
edit firewall modify lanInModify rule 189
set description 'do not mod local targets'
set action accept
set destination group address-group NETv4_switch0
exit
edit firewall modify lanInModify rule 190
set action modify
set modify table 190
exit
set interfaces switch switch0 firewall in modify lanInModify
edit firewall name wanLocal rule 190
set action accept
set description 'accept wireguard'
set destination port 51820
set protocol udp
exit
edit firewall ipv6-name wanLocal6 rule 190
set action accept
set description 'accept wireguard'
set destination port 51820
set protocol udp
exit
edit protocols static interface-route 1.1.1.1/32
set next-hop-interface wg0
exit
commit ; save
exit
sudo ip6tables --table nat --append POSTROUTING --out-interface wg0 -j MASQUERADE

after rebooting I show RX activity but no TX and am unable to browse the internet. Any help with this would be greatly appreciated.

FossoresLP commented 4 years ago

I might be completely off but you are allowing only established connections for local and remote devices. Are you sure your devices are allowed to establish new connections to the internet?

droidforever commented 4 years ago

Yes I'm testing the connection with this computer first before taking it network wide. I have 3 GB ethernet connections and one wireless on this computer. I am using a second ethernet interface for testing. I followed one other guide and it worked fine but I went from 400+ Mb connection to a 30Mb so I discarded that one.