WireGuard Server Clients Allowed IPs Not Getting Set

[HarryMuscle]

I'm working at setting up the WireGuard server on a RT-AX6000 running 388.4 and I've got a weird issue happening. I've added several clients to the server and everything was working fine, but as soon as I reboot the router I am unable to connect again. After some troubleshooting it looks like the allowed ips on the server side are not getting set for all of the clients except one (that one client works fine after the reboot). Here's the output from the wg command (I've removed the keys from the output):

peer: [[key]]
  preshared key: (hidden)
  allowed ips: (none)

peer: [[key]]
  preshared key: (hidden)
  allowed ips: (none)

peer: [[key]]
  preshared key: (hidden)
  allowed ips: (none)

peer: [[key]]
  preshared key: (hidden)
  allowed ips: 10.6.0.4/24

Other than the keys and IP addresses there is no difference between the various clients. Further reboots result in the exact same outcome. Removing a client and re-adding it also results in the same outcome after a reboot. Anyone know what's going on?

Thanks,
Harry

 

[HarryMuscle]

So apparently the issue is related to using a /24 subnet mask for the allowed IPs. If I switch it back to a /32 mask the allowed IPs get correctly populated on the server as per the wg command output. The question now is then, whey can't I use a /24 subnet mask? I would like to have all of the connected client be able to communicate with each other and my understanding was that in order to do that you use a /24 subnet mask.

Thanks,
Harry

 

[ZebMcKayhan]

The question now is then, whey can't I use a /24 subnet mask?

Because wg uses this for routing. There cannot be same routes to different targets.

I would like to have all of the connected client be able to communicate with each other and my understanding was that in order to do that you use a /24 subnet mask.

Yep, but on the client's, not on the server. That is if you don't use 0.0.0.0/0 in that case it should already work as the firewall already allows this.

Edit: if you are using vpndirector to route internet data from server clients to vpn then you might have a route problem?