@GRL Hey, thanks for the reply. can you please direct me to the post as I am a total newbie and dont understand where I have to go to change that setting.

I turned all the ACLs off but still dont have internet access or LAN access when on my phone (and when wiregaurd is activated).

Can you elaborate where exactly "WAN IN gateway ACLs" are?

Here is screenshot form my OC200:

Thanks!

  @parhamsan I can confirm that for some odd reason my OpenVPN connection is also not working after the upgrade.

I tried to downgrade in staddealone mode and can't go back to 1.2.3; so after the latest Firmware upgrade I am completely without VPN!!!

There must be something I'm completely missing in the new Firmware!

  @parhamsan 

I have firmware 1.3.1 and both Wireguard and OpenVPN work after upgrading.

  @MR.S Hello,

So here is what I did. I Forgot the ER8411 from the OC200 (the ER8411 got factory reset), enabled the SSH and SSHed to ER8411.

I then roll-back to the previouse Firmware, 1.2.3, and adopted the ER8411 again.

I can now confirm that the Wiregaurd is working as before so it must be a setting on the new firmware that is blocking the traffic.

Maybe someone can explain what is preventing the wiregaurd to work on the new firmware:

To start I have 2 LANS:

Default 192.168.1.1/24

LAN69 192.168.69.1/24 (LAN69 is only setup to be used in the ACL for Wiregaurd to block access to LAN1, which I found is usless)

On Wiregaurd I have 2 Servers (both port 51800 and 51820 are open in NAT):

And below are the Peers:

And the ACL for LAN69 (which is kind of useless, since when I created LAN69 and used it on the wiregaurd VPN, I only have access to WAN and no LAN regardless of the ACL being on or off, which is not an issue I can deal with that by having 2 different addressess for the wiregaurd). 

With this configuration wiregaurd works fine.

But when upgarded to firmware 1.3.1 everything stopped working???

Is there a setting I need to set for the wiregaurd to work on the new firmware?

Any help would be appreciated.

Thanks!

  @parhamsan 

ok, first of all, do you have port forwarded wireguard or OpenVPN then delete all of these. you shouldn't do that.
you also shouldn't use VPN ip that overlaps with any of your other networks. it didn't look like you had done that here.
and you use /32 on allowed ip, that's good. so then it should work.

start by deleting port forward (NAT) if you have something like that.

As for ACL, it doesn't work with Wireguard,

  @MR.S Hey,

Thanks for getting back to me!

Sure I have followed you instructions as below:

1-Removed LAN69 from networks.

2-Disabled Port forwarding rules for wiregaurd and OpenVPN (I can confirm that Wiregaurd is still working, and previousely OpenVPN was not working and after removing port 1194 from NAT it is working again, so thank you so much for the tip!!!)

3-Removed any ACL rules regarding LAN69 (so there is no way I can block a wiregaurd connection from accessing certain LANs; I wanted for certain wiregaurd connections to only access WAN and not LAN!!!)

I will upgrade to the new firmware, 1.3.1, tomorrow morning and let you know about the results.

Thanks Again!!!

Clive_A wrote

 @parhamsan

parhamsan wrote

  @MR.S Hello,

 

So here is what I did. I Forgot the ER8411 from the OC200 (the ER8411 got factory reset), enabled the SSH and SSHed to ER8411.

I then roll-back to the previouse Firmware, 1.2.3, and adopted the ER8411 again.

 

I can now confirm that the Wiregaurd is working as before so it must be a setting on the new firmware that is blocking the traffic.

Maybe someone can explain what is preventing the wiregaurd to work on the new firmware:

 

To start I have 2 LANS:

 

Default 192.168.1.1/24

LAN69 192.168.69.1/24 (LAN69 is only setup to be used in the ACL for Wiregaurd to block access to LAN1, which I found is usless)

 

On Wiregaurd I have 2 Servers (both port 51800 and 51820 are open in NAT):

 

 

 

And below are the Peers:

 

 

 

And the ACL for LAN69 (which is kind of useless, since when I created LAN69 and used it on the wiregaurd VPN, I only have access to WAN and no LAN regardless of the ACL being on or off, which is not an issue I can deal with that by having 2 different addressess for the wiregaurd). 

 

 

 

 

 

With this configuration wiregaurd works fine.

 

But when upgarded to firmware 1.3.1 everything stopped working???

Is there a setting I need to set for the wiregaurd to work on the new firmware?

 

Any help would be appreciated.

 

Thanks!

I don't understand what you would set up like that. 

Allowed peer should be an existing network. If you allow 192.168.50.0/24, which is non-existed, what's the reason? 

 

As for the 192.168.69.0/24, when your phone is connected, and your phone settings are missing from the reply, you should be able to ping the 192.168.69.1, so did you verify that?

As for the phone, WG has to be configured with the DNS. 

 

 

If you ask why, that seems to be a config issue. Not sure if you have read the config guide on the forum. Mr.S is suggesting you remove all the non-related settings to verify the integrity of WireGuard. 

I also don't see a problem with the WG on my test bench. 

  @Clive_A 

Hello Clive,

Thanks for your reply!

To answer your questions:

I followed this video to create and setup Wiregaurd on the ER8411 and on my phone:

https://youtu.be/ySovFaq9FV0?si=0t9kMSZ46ytjDroP

I though the WG server IPs and peers should be on a completely different subnet from my existing LAN subnet (in my case I only have 192.168.1.0/24)!!!

As for the 192.168.69.0/24, when I created the LAN on ER8411, the only reason was to be able to control peers access to WAN only and to deny access to my default LAN.

On my phone I am using 8.8.8.8 as DNS

Seems the ACL will not work for WG and there is no way to control and deny access through the ACL rules, correct?

For now I will stick to 1.2.3 Firmware, and will not upgrade to 1.3.1, since after the upgrade my router and internet went completely offline and I have to manually restart and unplug the router for a couple of time for it to come back online (it could be also related to my XGS-PON, so don't want to blame the Firmware for this issue!!!)

The only request that I have now is how can I control the way WG peers/clients can have limited access to WAN or LAN (if there is a way).

For example in Archer AX55 there is an option to limit client access by a simple rule correct? Why cant this be implemented in ER8411?

Thanks again for your help and reply!!!