Wireguard on Asus: Can only see router, not LAN Devices!

[cheerio]

How the heck do I get clients connected via wireguard to see devices on the LAN?

I have an ASUS AX88U running latest Merlin firmware [3004.388.4]

I can only see intenet and the router LAN ip from devices connected via wireguard vpn. I need to be able to connect to internal devices. I got this working with OpenVPN but can't seem to get Wireguard working. I thought it was supposed to be simple.

Settings below.. what am I missing??

Peer settings:

 

[jacklul]

If you're trying to access LAN shares through the VPN then the connections are probably denied by each individual device due to connection not coming from LAN IP (but instead it comes from the WireGuard's network IP).

The working workaround is to either add MASQUERADE iptables rules on the router for the required ports (in nat-start script on Merlin firmware, look below) or configure LAN devices to accept connections from 10.6.0.0/24 network.

OpenVPN I believe does this transparently already?

Spoiler: /jffs/scripts/nat-start

#!/bin/sh

# adjust these when needed
VPN_NETWORK="10.6.0.0/24"
LAN_NETWORK="192.168.1.0/24"

if ! iptables -t nat -nL "SAMBA_MASQUERADE" > /dev/null 2>&1; then # no idea if required
    iptables -t nat -N "SAMBA_MASQUERADE"
    iptables -t nat -A "SAMBA_MASQUERADE" -p tcp --dport 445 -j MASQUERADE
    iptables -t nat -A "SAMBA_MASQUERADE" -p tcp --dport 139 -j MASQUERADE
    iptables -t nat -A "SAMBA_MASQUERADE" -p udp --dport 138 -j MASQUERADE
    iptables -t nat -A "SAMBA_MASQUERADE" -p udp --dport 137 -j MASQUERADE
    iptables -t nat -A "SAMBA_MASQUERADE" -p icmp --icmp-type 1 -j MASQUERADE
    #iptables -t nat -A "SAMBA_MASQUERADE" -j RETURN # not required
    iptables -t nat -A POSTROUTING -s "$VPN_NETWORK" -d "$LAN_NETWORK" -o br0 -j "SAMBA_MASQUERADE"
fi

 

[cheerio]

ah. I was hoping it was just a configuration oversight on my end.

What I gather from searching around is that the Asus/Merlin WireGuard implementation isn't complete if it necessitates logging in via ssh and updating routing rules manually.

The OpenVPN implementation is more complete as it doesn't require manual intervention.

Hoping that gets updated someday as I heard WireGuard is much faster than OpenVPN and I'm not a fan of adding in additional configuration outside of what is possible via the provided firmware screens.

That said, I'll try that out since I"m just experimenting with WireGuard to test the throughput of WireGuard compared to OpenVPN.