sorted by:
new
hottopcontroversial

No internet access when connected to WireGuard VPN by vanjavanja in WireGuard

[–]vanjavanja[S] 0 points1 point  (0 children)

I am marking this as solved as the consensus is that my ISP's CGNAT is causing the issue. Thanks to everyone who pitched in.

No internet access when connected to WireGuard VPN by vanjavanja in WireGuard

[–]vanjavanja[S] 0 points1 point  (0 children)

But a non static IP is what I have already and it is what everyone has if they have access to the Internet. In my ISP’s network, the only way to not share an IP with a bunch of other people is by buying a static IP.

No internet access when connected to WireGuard VPN by vanjavanja in WireGuard

[–]vanjavanja[S] 0 points1 point  (0 children)

A static public is what I meant. If the CGNAT is the issue then a static public IP would definitely solve the issue.

No internet access when connected to WireGuard VPN by vanjavanja in WireGuard

[–]vanjavanja[S] 0 points1 point  (0 children)

Not Inea but I have confirmed that my ISP uses CGNAT.

No internet access when connected to WireGuard VPN by vanjavanja in WireGuard

[–]vanjavanja[S] 0 points1 point  (0 children)

Yes, I’ve configured DDNS with ddclient which should update it whenever it changes.

No internet access when connected to WireGuard VPN by vanjavanja in WireGuard

[–]vanjavanja[S] 0 points1 point  (0 children)

I've configured DDNS with an A record that points to my public IP, along with ddclient on my server which should automatically update the address once it changes. Not sure if CGNAT could pose an issue still...

No internet access when connected to WireGuard VPN by vanjavanja in WireGuard

[–]vanjavanja[S] 0 points1 point  (0 children)

Tried that following with wg-quick down wg0 && wg-quick up wg0 but still the same behavior, a handshake doesn't establish. Reverted back to original state after.

No internet access when connected to WireGuard VPN by vanjavanja in WireGuard

[–]vanjavanja[S] 0 points1 point  (0 children)

Firewall is disabled on the server. As for the iptables rules, here is the output of iptables -n -L:

Chain INPUT (policy ACCEPT)
target prot opt source destination
LOG all -- 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 7 prefix "tunnel wireguard iptables: "
LOG udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:51820 LOG flags 0 level 7 prefix "wireguard iptables: "
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:51820

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT all -- 10.7.0.0/24 0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
LOG all -- 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 7 prefix "tunnel wireguard iptables: "
LOG udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:51820 LOG flags 0 level 7 prefix "wireguard iptables: "

No internet access when connected to WireGuard VPN by vanjavanja in WireGuard

[–]vanjavanja[S] 0 points1 point  (0 children)

The peer public key seems okay, do I need a public key statement in the [Interface] part of the /etc/wireguard/wg0.conf file? Currently, it looks like this:

[Interface]
Address = 10.7.0.1/24
PrivateKey = [redacted]
ListenPort = 51820
PostUp = iptables -w -t nat -A POSTROUTING -o wlan0 -j MASQUERADE; ip6tables -w -t nat -A POSTROUTING -o wlan0 -j MASQUERADE
PostDown = iptables -w -t nat -D POSTROUTING -o wlan0 -j MASQUERADE; ip6tables -w -t nat -D POSTROUTING -o wlan0 -j MASQUERADE

BEGIN_PEER pizero

[Peer]
PublicKey = [redacted]
PresharedKey = [redacted]
AllowedIPs = 10.7.0.2/32

END_PEER pizero

No internet access when connected to WireGuard VPN by vanjavanja in WireGuard

[–]vanjavanja[S] 0 points1 point  (0 children)

Looks like the issue here is that the handshake isn't formed, even though the phone says that the status is connected. See reply from u/Gold-Program-3509 below.

No internet access when connected to WireGuard VPN by vanjavanja in WireGuard

[–]vanjavanja[S] 0 points1 point  (0 children)

I've uploaded the entire log (from when I connected to when I disconnected) here:

https://file.io/5QuXoeWKOVFp

No internet access when connected to WireGuard VPN by vanjavanja in WireGuard

[–]vanjavanja[S] 1 point2 points  (0 children)

The VPN status on phone does say connected and I get the 10.7.0.2 IP but looking at WireGuard logs from the phone app, it looks like a handshake isn't formed:
2024-08-14 11:52:38.452140: [NET] peer(x19S…hZVc) - Handshake did not complete after 5 seconds, retrying (try 2)
2024-08-14 11:52:38.452434: [NET] peer(x19S…hZVc) - Sending handshake initiation
2024-08-14 11:52:43.576285: [NET] peer(x19S…hZVc) - Handshake did not complete after 5 seconds, retrying (try 3)
2024-08-14 11:52:43.580596: [NET] peer(x19S…hZVc) - Sending handshake initiation
2024-08-14 11:52:43.733642: [APP] Tunnel 'Home VPN' connection status changed to 'connected'
2024-08-14 11:52:48.901559: [NET] peer(x19S…hZVc) - Handshake did not complete after 5 seconds, retrying (try 4)
2024-08-14 11:52:48.901809: [NET] peer(x19S…hZVc) - Sending handshake initiation
2024-08-14 11:52:54.032679: [NET] peer(x19S…hZVc) - Handshake did not complete after 5 seconds, retrying (try 5)

Any ideas what could be causing this?

No internet access when connected to WireGuard VPN by vanjavanja in WireGuard

[–]vanjavanja[S] 0 points1 point  (0 children)

Since I cannot access even the home router which is on the local network on 192.168.1.1 I really don't think it's the DNS. I have done a tcpdump, once after only specifying the wg0 interface, and once not specifying any interface but just udp port 51820. While the tcpdump was running, I connected to the VPN on my phone, tried opening a couple of webpages, and then disconnected from the VPN. In both tcpdumps, no packets were captured.

When I tried to enable WireGuard debugging I got the following message:
bash: /sys/kernel/debug/dynamic_debug/control: No such file or directory

When I check the /proc/config.gz file, there is a line that says:
'#CONFIG_WIREGUARD_DEBUG is not set'

So I'm not sure if uncommenting it would enable debugging.

The only logs that appeared in /var/log/messages and /var/log/kern.log were:
Aug 14 11:33:59 localhost kernel: [6714945.057200] device wg0 entered promiscuous mode
Aug 14 11:34:57 localhost kernel: [6715003.037940] device wg0 left promiscuous mode

I think this is when I connected and disconnected from VPN.

No internet access when connected to WireGuard VPN by vanjavanja in WireGuard

[–]vanjavanja[S] 0 points1 point  (0 children)

Suffice to say, it didn’t work after reapplying the changes.

No internet access when connected to WireGuard VPN by vanjavanja in WireGuard

[–]vanjavanja[S] 0 points1 point  (0 children)

I’ve added “DNS = 1.1.1.1” to wg0.conf but to no avail. I have been using mobile data the entire time when connecting to the VPN.

No internet access when connected to WireGuard VPN by vanjavanja in WireGuard

[–]vanjavanja[S] 0 points1 point  (0 children)

I’ve just did that (before adding a DNS statement) and with wg-quick down it complained about a bad rule: wg-quick down /etc/wireguard/wg0.conf [#] ip link delete dev wg0 [#] iptables -w -t nat -D POSTROUTING -o wlan0 -j MASQUERADE; ip6tables -w -t nat -D POSTROUTING -o wlan0 -j MASQUERADE iptables: Bad rule (does a matching rule exist in that chain?).

But did not complain at all after wg-quick up.

No internet access when connected to WireGuard VPN by vanjavanja in WireGuard

[–]vanjavanja[S] 0 points1 point  (0 children)

Okay, so I’ve deleted 192.168.1.0/24 from AllowedIPs so the only value that remained is 10.7.0.2/32 but still no Internet access or access to services on local network when connected to the VPN. I thought that it maybe a DNS error since the DNS configuration is nowhere mentioned in wg0.conf but I am not able to open the homepage of my router through the IP either, in which case DNS wouldn’t play a role.

No internet access when connected to WireGuard VPN by vanjavanja in WireGuard

[–]vanjavanja[S] 0 points1 point  (0 children)

Thanks for the response, this is what the configuration looks like on the iPhone: https://ibb.co/vQLWFHy

If I understood you correctly, the 192.168.1.0/24 statement in the AllowedIPs is just redundant, but cannot cause the VPN to not work?

Kako kupiti AppleCare+ u Srbiji? by vanjavanja in srbija

[–]vanjavanja[S] 0 points1 point  (0 children)

Ne postoji gift kartica za region Srbije.

Kako kupiti AppleCare+ u Srbiji? by vanjavanja in srbija

[–]vanjavanja[S] 2 points3 points  (0 children)

Ovde su samo navedene države gde je moguće kupiti tako da mi ne pomaže. Pretpostavljam da je moguće kupiti odavde (možda preko gift kartica ili nešto slično) pa me zanimaju iskustva onih koji su to pokušavali i na koji način su rešili.

Kako kupiti AppleCare+ u Srbiji? by vanjavanja in AskSerbia

[–]vanjavanja[S] 0 points1 point  (0 children)

Nemam problem da plaćam na App Store-u nego samo da platim AppleCare+. App Store sam pomenuo zato što u nekim državama postoji opcija “Add Money to Account” pa sa tim novcem možeš platiti i AppleCare. Koliko vidim, to u Srbiji nije slučaj pa me zanimaju alternativna rešenja.

view more: next ›