Wireguard VPN no access to LAN IPs

quit7327

I have the following setup:

Fritzbox Router acting as wireguard server (192.168.178.1)
Adguard Home Server at 192.168.178.210
Pixel 10 GOS on mobile data away from home network connected via wireguard (192.168.178.204)

Wireguard successfully connects and I can reach normal websites through the VPN. Also I can access the router interface on 192.168.178.1 and the Adguard Home Admin Panel on 192.168.178.210. Any other local IPs I cannot access (like Home Assistant or smb shares). Weirdly enough the same wireguard config works on my iPhone. So I suppose there is some specialty in GOS here.
Can anyone help me troubleshoot this?

AcclaimSublevel19

quit7327

Please make sure you're using the official WireGuard app.
What is your Allowed IPs setting set to? It should be 0.0.0.0/0, ::/0 if you want to route all traffic through the VPN.

FWIW I'm running my own WireGuard VPN on my home network (port forwarded) and I've had no issues with GOS.

onehalf3544

quit7327 I have a similar setup and I don't have any restrictions from the GOS side for sure - I tried pinging another VPN client j the internal network and it worked - i.e. accessing IP from that local VPN network works.

Is it possible to run tcpdump on the router itself?

quit7327

I used the wireguard app and then also tried WGtunnel. Unfortunately no luck with both. Allowed IPs is set to 0.0.0.0/0.
Also I disabled block connections without VPN and private DNS.
I really have no idea on how to narrow down the issue here.

I wonder why it works on iPhone and not on my new GOS Pixel 10.

AcclaimSublevel19

quit7327 interesting. The next thing I'd personally try is setting up wireguard in the built-in Linux vm (you need developer options to enable that though) and checking if everything works as expected through there.

By the way, is the iPhone that works connected to the VPN via mobile data too? Try comparing the two configs, maybe it has an extra setting that isn't included in your new one.

Stephan-P

Coincidentally I'm struggling with setting up a WG vpn on my home server using wg-easy in combination with nginx proxy manager. (Not yet fully succesfull)
Today I learned some things about the settings that need to be made in the Admin panel on the wg-easy server. See: https://forums.truenas.com/t/struggling-with-wg-easy-configuration-on-truenas-scale/52466/2

For me it was helpful to change the dns servers:

192.168.2.254 (home router)
The dns server of my ISP
The address of OpenDNS

Stephan-P

I was pleasantly surprised to experience how well the WG VPN gets automatically integrated into the GOS Network system on my Pixel 7a

quit7327

The configs on iPhone and GOS are exactly the same except for the keys of course.
Also on my Linux Notebook I can reach any LAN IP over wireguard with the same configs.
Unfortunately I dont really know how to start troubleshooting this issue in the linux VM ypu mentioned.

Oggyo

quit7327 The configs on iPhone and GOS are exactly the same except for the keys of course.

What about assigned IP address compared to iPhone one?
Maybe you can try the exact iPhone config on your GrapheneOS (when iPhone is not connected, of course) to see if it is an IP address issue/conflict.

I haven't specified your VPN subnet, so if you have no dedicated WireGuard network then can be some routing conflicts.

quit7327

Ok now we are getting closer. I tested esch config file on the other phone:

GOS config on iPhone: does not work
iPhone config on GOS: does work
Since the config files are identical except for the keys, the issue must be in the fritzbox router. Just for information the working config has the IP 192.168.178.213 and the broken one 192.168.168.204. I also created another new config on the router with, which also does not work correctly.
Since there are no options when creating the wireguard config on the router, I suspect a software issue there. Maybe I can rollback the firmware and try again.

Oggyo

quit7327 Just for information the working config has the IP 192.168.178.213 and the broken one 192.168.168.204

178 vs 168? These are from two different subnets. Check the firewall rule on Fritz box re. the allowed WireGuard subnet. Maybe it allowed only for one IP (/32), not its whole subnet (/24).

I can confirm nothing wrong with GrapheneOS and/or WG client (official) or WG Tunnel app.
I have on my phone both, one set to connect to my router, one to a WG server inside my LAN (port forwarding) and both work as expected. Should be routing or firewall rule issue.

quit7327

Both are 178, this was a typo...

Oggyo

quit7327

So far, I missed if you set a dedicated subnet for WG or you use the same net-scheme as your LAN?
If the same - this can create issues/conflicts.

quit7327

On the fritzbox router you can't choose the subnet. It used the same by default

Oggyo

No idea then. You can make sure the DHCP assigned range is not overlapping with the range used for WG IP addresses. If works for one device, might be IP address conflicts.

quit7327

That was the solution. Somehow the router assigned an IP adress which was alteady used by another device.
Thanks a lot for the support.