ER605 v2.0 Wireguard setup

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
12

ER605 v2.0 Wireguard setup

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
17 Reply
Re:ER605 v2.0 Wireguard setup-Solution
2023-07-03 20:43:41 - last edited 2023-08-21 01:53:00

  @wilcomir90 Apologies if my post is confusing! No fake peers required, you need to have the wireguard interface in a network range that you havent defined.

 

In my case my main LAN is 192.168.10.1/24 and I also have an IOT network on 192.168.107.1/24

 

 

I picked a local IP for my wireguard interface that doesn't live in either of those network ranges (ie: 192.168.99.2)

 

 

Your wireguard peer "Allow Address" should reside in the same theoretical range as your wireguard interface IP, in my case I just chose another free /32 ip in the 192.168.99.1/24 range.

 

 

You can define additional peers as normal

 

 

My wireguard client config for my peers look something like this:

 

[Interface]
PrivateKey = ABCDEFG=
Address = 192.168.99.10/24
DNS = [internal-dns-ip]

 

[Peer]
PublicKey = HIJKLMNOP=
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = [fqdn/public-ip]:51820

 

Recommended Solution
  0  
  0  
#12
Options
Re:ER605 v2.0 Wireguard setup
2023-07-04 06:25:25

  @deeo Thanks for your thorough explanation.

 

I made some trials, also using a different client, and it seems I might be getting somewhere.

 

I believe my iOS client has some issues for some reason, my linux laptop did work for a brief moment, without DNS for some reason, but it did work. My original ip range for the overlay network was a 10.101.x.x therefore I am inclined to believe that all the issues I have been seeing up to now are iOS specific, and the DNS problem depends instead on the linux laptop.

 

I will further investigate, but I think that most definitely something is happening behind the scenes here, and it would be good to get an official word from tp-link on the inner workings.

 

I shall report back here with my findings.

 

Thanks again for your great help.

 

V

  0  
  0  
#13
Options
Re:ER605 v2.0 Wireguard setup
2023-07-20 19:22:38

  @deeo This was super helpful.... got me up and running. Tried on three occasions over the last few months - for me it was setting the IPs right, toggling the wireguard inteface and waiting for a bit of propogation which took maybe 5mins.  Thank you!!!!

  0  
  0  
#14
Options
Re:ER605 v2.0 Wireguard setup
2023-07-22 20:26:45
I found this short documentation from tplink: https://www.tp-link.com/en/support/faq/3559/ worked that way
  0  
  0  
#15
Options
Re:ER605 v2.0 Wireguard setup
2023-11-20 10:20:05

  @wilcomir90 

Same issue here. Wireguard routing is not ok.

Ping from the Wireguard client until the ER605 ip is ok , but can't reach any other LAN clients. Ping not ok.

VPN with IPSec works like a charm ,but over there you HAVE to put an IP in the LAN range that you want to reach.

Problem is that aside from view the routing table on your Wireguard client computer ,there's nothing you can see of the wireguard config on the ER605.

  0  
  0  
#16
Options
Re:ER605 v2.0 Wireguard setup
2023-11-21 09:48:26

Hi @Mr_K 

Thanks for posting in our business forum.

Mr_K wrote

  @wilcomir90 

Same issue here. Wireguard routing is not ok.

Ping from the Wireguard client until the ER605 ip is ok , but can't reach any other LAN clients. Ping not ok.

VPN with IPSec works like a charm ,but over there you HAVE to put an IP in the LAN range that you want to reach.

Problem is that aside from view the routing table on your Wireguard client computer ,there's nothing you can see of the wireguard config on the ER605.

Configuration Guide How to Configure WireGuard VPN on Omada Controller

Have you confirmed that your settings are 100% correct?

Ping to the ER605 is working means the VPN is working. Do you have another VLAN interface? Ping its gateway. I don't care the ping to other clients, just verify if the gateway and devices like EAP or switch are pingable.

If they all work, simply not working with some of your clients, you should consider the firewall after you have verified your settings are correct.

 

The routing table on the router does not contain the VPN routing tables.

If you wanna discuss this issue further, please start a new thread with your screenshots of the all related parameters and a simple diagram. Mosaic the sensitive parts.

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Official and Beta firmware. NEW features! Subscribe for the latest update!Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting ★ ☚ ● Be kind and nice. ● Stay on the topic. ● Post details. ● Search first. ● Please don't take it for granted. ● No email confidentiality should be violated. ● S/N, MAC, and your true public IP should be mosaiced.
  0  
  0  
#17
Options
Re:ER605 v2.0 Wireguard setup
2023-11-21 10:07:38

Wireguard is 10x easier to setup and use on Ubiquiti stuff.  Hopefully TP Link get to that point where you essentially just turn it on, create the users and can export a config file for each of the users to directly import! .........  

 

TPLink is very much playing catch up with Ubiquiti.

  0  
  0  
#18
Options