Business Community > Routers > ER605 V2 WireGuard - Cannot add multiple peers to one interface
< Routers

ER605 V2 WireGuard - Cannot add multiple peers to one interface

ER605 V2 WireGuard - Cannot add multiple peers to one interface

ER605 V2 WireGuard - Cannot add multiple peers to one interface
ER605 V2 WireGuard - Cannot add multiple peers to one interface
2024-01-09 15:49:17 - last edited 2024-01-16 08:13:38
Tags: #VPN #WireGuard
Model: ER605 (TL-R605)  
Hardware Version: V2
Firmware Version: 2.2.3

Hello,

 

I have a WireGuard interface set up on my ER605 through Omada. I have one peer working well (allowed IP: 10.0.0.1/24, 192.168.8.0/24) [192.168.8.0/24 range is for LAN access] and I have added a second peer (10.0.0.2/24, 192.168.8.0/24). The second peer can connect using WireGuard client software, but no data is ever transferred.

 

All other configuration settings are identical (except public key for peer and interface on the WG peer side, which matches the allowed IP from peer setup e.g. 10.0.0.1/24). I have tried giving each peer a specific endpoint with no change. I have also tried giving different LAN IPs for each e.g. 192.168.8.0/24 and 192.168.8.1/24 ensuring no conflicts with other devices, again no change.

 

What am I doing wrong here?

 

Thanks

  0      
 
  0      
 
#1
Options
1 Accepted Solution
Re:ER605 V2 WireGuard - Cannot add multiple peers to one interface-Solution
2024-01-15 14:51:34 - last edited 2024-01-16 08:13:38

  @Sam_CS 

 

I have multiple peers on one interface, but try 192.168.88.10/32 and 192.168.88.11/32 in allowed address, then edit wireguard client file to match with /32

 

Recommended Solution
  0  
  0  
#8
Options
10 Reply
Re:ER605 V2 WireGuard - Cannot add multiple peers to one interface
2024-01-10 01:08:14

Hi @Sam_CS 

Thanks for posting in our business forum.

Post your config here and your test results here with screenshots. Mosaic your sensitive information.

I need to know how you tested it. What commands did you use?

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Beta firmware got some NEW features! Subscribe for the latest update! ☛Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting Manual ★ ☚ (Disclaimer: Short links are used above solely for guidance to TP-Link subdomains and are safe and tracker-free. Exercise caution with short links from non-official members on forums. We are not liable for external content or damage from non-official members' link use.)
  0  
  0  
#3
Options
Re:ER605 V2 WireGuard - Cannot add multiple peers to one interface
2024-01-12 13:24:53 - last edited 2024-01-12 13:25:29

  @Clive_A  Hi Clive,

 

Please find screenshots of the config and WireGuard log attached. I did not use any commands to test it - The peer Pete_WG works, peer Sam_WG does not. Sam_WG only ever receives keepalive packets from the ER605; no internet, no LAN, no ability to ping anything either LAN or WAN. 

 

Sam

 

 

 

 

 

  0  
  0  
#4
Options
Re:ER605 V2 WireGuard - Cannot add multiple peers to one interface
2024-01-12 13:26:04

  0  
  0  
#5
Options
Re:ER605 V2 WireGuard - Cannot add multiple peers to one interface
2024-01-15 01:20:21

Hi @Sam_CS

Sam_CS wrote

 

Hmm, I still suspect that this is a problem with the other peer. You have two peers, have you tried to disable the other Pete_WG and try this Sam_WG enabled? If this Sam_WG still does not work, that'll be an issue with the device. Not the WG config on the router.

 

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Beta firmware got some NEW features! Subscribe for the latest update! ☛Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting Manual ★ ☚ (Disclaimer: Short links are used above solely for guidance to TP-Link subdomains and are safe and tracker-free. Exercise caution with short links from non-official members on forums. We are not liable for external content or damage from non-official members' link use.)
  0  
  0  
#6
Options
Re:ER605 V2 WireGuard - Cannot add multiple peers to one interface
2024-01-15 14:26:14 - last edited 2024-01-15 14:38:23

  @Clive_A 

 

Hi Clive

 

If Pete_WG is disabled and only Sam_WG is enabled, Sam_WG still does not work. You can see the settings for the device WireGuard client - the settings are identical except the keys and the allowed IP. 

 

I am running this test on the same device; I just have 2 tunnels set up in the same WireGuard client application and switching between the 2 to do the tests.

 

*** EDIT AND UPDATE ***

With Pete_WG diabled and Sam_WG enabled, if I click the 'edit' button for Sam_WG and click 'apply' without making any changes, Sam_WG begins working. As soon as I enable Pete_WG again, it stops working. 

 

If both peers are enabled and then I disable Sam_WG, I must click 'edit' then 'apply' on Pete_WG to get Pete_WG to work. 

 

I believe there must be some issue with having 2 peers enabled, but I can't see where there are any conflicts between the 2 peers.

  0  
  0  
#7
Options
Re:ER605 V2 WireGuard - Cannot add multiple peers to one interface-Solution
2024-01-15 14:51:34 - last edited 2024-01-16 08:13:38

  @Sam_CS 

 

I have multiple peers on one interface, but try 192.168.88.10/32 and 192.168.88.11/32 in allowed address, then edit wireguard client file to match with /32

 

Recommended Solution
  0  
  0  
#8
Options
Re:ER605 V2 WireGuard - Cannot add multiple peers to one interface
2024-01-15 14:55:56 - last edited 2024-01-15 15:01:23

Instant success, thank you very much!! Both peers are now working absolutely fine. It makes sense I guess as /32 will constrain it to a single IP address. But why the ER605 can't handle this itself I don't know. 

 

Especially as the instructions here: https://community.tp-link.com/en/business/forum/topic/619652 use /24 as CIDR.

  0  
  0  
#9
Options
Re:ER605 V2 WireGuard - Cannot add multiple peers to one interface
2024-01-15 15:17:04

  @Sam_CS 

 

the person who wrote the guide was probably a bit hasty and did not test with several peers.smiley

 

same thing with unifi routers, always /32 on ip in vpn tunnel.

 

  0  
  0  
#10
Options
Re:ER605 V2 WireGuard - Cannot add multiple peers to one interface
2024-01-16 06:58:18

Hi  @Sam_CS 

Sam_CS wrote

Instant success, thank you very much!! Both peers are now working absolutely fine. It makes sense I guess as /32 will constrain it to a single IP address. But why the ER605 can't handle this itself I don't know. 

 

Especially as the instructions here: https://community.tp-link.com/en/business/forum/topic/619652 use /24 as CIDR.

So, here's the thing, if you have multiple peers, each peer will have a different public key and the IP overlaps. That's the reason why it does not work. If you are configuring the peer to multiple peers, you need to set the peer > allowed-ips to a specific one.

If you don't overlap the IP in 192.168.88.1/24, setting its interface to 192.168.89.1/24 on the other peer, and allowed-ips on the ER605, you would not experience the issue.

 

The guide was only creating one for illustration. I did not take this into consideration at that time. Just thought about peer-to-peer instead of peer to multi peer. Will add one note to that for extra reference.

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Beta firmware got some NEW features! Subscribe for the latest update! ☛Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting Manual ★ ☚ (Disclaimer: Short links are used above solely for guidance to TP-Link subdomains and are safe and tracker-free. Exercise caution with short links from non-official members on forums. We are not liable for external content or damage from non-official members' link use.)
  0  
  0  
#11
Options
Re:ER605 V2 WireGuard - Cannot add multiple peers to one interface
2024-01-16 09:05:50

  @Clive_A 

 

Hi Clive,

 

Apologies, I didn't realise that you wrote the guide. The same CIDR value is also used in the guide for the ER605 in standalone mode (https://www.tp-link.com/uk/support/faq/3559/) which would also benefit from an update.

 

As a 'small business' product line, many users are just like me - I have a reasonable idea of networking setup, but definitely not in a professional capacity! Such guides are really key to getting the network setup correctly as we don't have the funds for employing/contracting another party to do it for us.

 

Thank you for your help and I am glad it was a simple fix in the end.

  0  
  0  
#12
Options

Information

Helpful: 0

Views: 615

Replies: 10

Tags

VPN
WireGuard
Related Articles
How many Wireguard peers does ER605 and ER7206 support?
190 0
ER605 v.2 L2TP bridge
181 0
ER605 V2 wireguard
1833 0
Wireguard Site-To-Site not working / ER605, V2, Firmware 2.2.2
344 0
ER605 v2.0 Wireguard setup
3218 0
ER605 v2.0 fw 2.2.2 Wire guard peer - can't select interface to create peer (solved; not fw issue)
301 0
About Us
Press
Copyright © TP-LINK CORPORATION PTE. LTD. All rights reserved.