Wireguard Client fails while Win11 Wireguard Client (with same config) works fine...
I've been looking for a decent 5G hotspot with a built in VPN client and I had high hopes for the M8550. I've been fighting with this for a couple of days now...
Basic Problem: Can not get the Wireguard client to pass traffic properly to/from my router (OPNsense 25.7.10-amd64 = latest)
- The M8550 seems to work fine as a hotspot for my test PC to/from the Internet. So that is good. To simplify things, my Test PC is connected directly to the ethernet port on my M8550.
- I have tested my configuration using the generic Wireguard client on my Test PC. It works just fine. This confirms that my router and my test configuration is appropriate and functional. I am even using the M8550 in this configuration as my hotspot (obviously with the M8550's Wireguard client disabled).
- Trying to import the simple Wireguard Configuration file is all but impossible on the M8550. I don't think I have ever seen it succeed so I always have to enter the corresponding client configuration data by hand (copy/pasting the all-important public/private keys to be sure they are correct).
- Even when entering the data by hand, the M8550 always seems to want more data then is available in the config file (like MTU and PersistentKeepalive). The M8550 never reports a meaningful error (just "9007 invalid data" - even when a field is left blank). Anyway, I finally know which fields arte required and I can get a proper config entered by hand.
- In comparing the manually entered configuration data with the data in the client configuration file everything seems consistent and accurate.
- The M8550 shows that the connection is established once the client is activated but this is pretty useless data. I have seen the "connected" message on the M8550 when even a knowingly incorrect config parameter was provided. The client "connected" indication is essentially useless for troubleshooting.
- The M8550 also provides no useful VPN data in the system log files even at "debug" level.
- However, I can see on my router when a Wireguard Client (any client) successfully negotiates a tunnel. The router will indicate when a tunnel has been established and also when it collapses. I can see from my router that it looks like the M8550 is successfully opening a Wireguard tunnel.
- After the M8550 appears to successfully open the wireguard tunnel, it looks like something is broken with respect to the routing tables on the device. If I try to ping an internal IP address in my network (from my test PC), I will get a "192.168.1.1: Destination host unrerachable". To me, this looks like the M8550 (192.168.1.1) does not understand what it needs to do to reach the internal network on the other side of the Wireguard tunnel. "AllowedIPs = 0.0.0.0/0" is set in my cleint config so all traffic should be passed via the tunnel. Again, this exact same configuration works just fine when imported into the generic Wireguard client on my Test PC.
- I have also tried "AllowedIPs = 0.0.0.0/1" as I have seen that used as an example in various TP-Link documentation - but it also does not work.
- I have tried "AllowedIPs = 172.20.0.0/16" in the M8550 (and reconfiguring the OpnSense router accordingly) as that is the RFC1918 Class B address of my internal/private network - but it also does not work.
I don't think there is anything else I can do here. I've been at this literally for days. The fact that the generic Wireguard client on my Test PC works just fine and the M8550 client does not is a pretty good indication where the problem is. It would be helpful if the Client Config import actually worked properly (not hanging) and also if it would give meaningful information if it thought it had a configurastion issue. This is pretty lazy programming I think...
Anyone have any ideas?
- Copy Link
- Subscribe
- Bookmark
- Report Inappropriate Content
- Copy Link
- Report Inappropriate Content
- Copy Link
- Report Inappropriate Content
I've never played with the Teltonika stuff.
I run a Draytek at home, and find it does what it says on the tin. The only issue I have found is trying to log to USB, causes reboots.
- Copy Link
- Report Inappropriate Content
- Copy Link
- Report Inappropriate Content
- Copy Link
- Report Inappropriate Content
Passthrough being any router that can host as a client or server behind it, so nothing special. do a price comparsion and see how it looks I suppose.
- Copy Link
- Report Inappropriate Content
While testing M8550 to M8550 would certainly be a good test, that is something TP-Link should have tested. Hell, we can't even get them to test the proper import of a handful of config values from a test file. If they didn't/can't/won't even test the simple import of a config file, how much time do you think they spent testing the VPN functionality at all?
These config files are extremely simple with very minimal data. I am using a known good configuration which has been tested using the generic Wireguard client on my PC. The CONF file works perfectly if imported into the PC Wireguard client. The very same CONF data does NOT work if loaded into the M8550 by hand (cause TP-Link can't seem to figure out how to do this from a text file). ...and yes, the MAC of my client PC is "authorized" on the M8550 VPN page.
- Copy Link
- Report Inappropriate Content
I've been looking for a portable 5G hotspot with VPN for years.
I have the 4G Mudi from GLiNet (both the GL-E750 and the GL-750V2 variants). At 4G it works fine but its not fast enough. They have never released a 5G variant although folks have been continually asking for it. I have been watching for something...
I also have a GL.iNet Puli AX (GL-XE3000) 5G Cellular Router with a huge onboard Battery. It also promises an oboard VPN client but I couldn't even get it to reliably connect with 5G service at all. They kept throwing firmware for the onboard modem at me but nothing improved very much. If they can't get the 5G connection established I had little hope for the VPN. It was also quite big and heavy. The only thing that made it "portable" was this huge battery mounted under the device. Not worth wasting my time...
I have a Netgear Nighthawk 5G (both the M1 and M6 Pro) but it doesn't have an onboard VPN client (only a VPN Server) - so check the fine print...
I have an Inseego MiFi X3000 Pro 5G hotspot but the onboard VPN simply work either. (...and I wasn't inclined to try and work with a relatively unknown communications company to try and help them to fix their stuff)
So then came TP-Link. I've always had good luck with their equipment so I thought this would be a good bet. ...and they are a tier-1 cmanufacturer so I figured they would likely have good support for their products if I needed it. (and we obviously do)
I've been looking for a 5G hotspot with onboard VPN so I can simply have the configuration done once (at the hotspot) and then all my remote clients (phone, laptop, fireTV, etc) can use the same tunnel. I've been looking for this capability FOR YEARS (while I was working in the data security/forensics industry) but now I am retired. I originally wanted it for business use. Now I'ld like it just to get a private link back to my home router. I'm now much less motivated to waste my time BUYING and beta testing some product that should have been working in the first place. I'll give TP-Link some time but I'm not going to waste it to help them import config data from a text file. Being retired, I'm much less motivated to find a solution than I once was. If they can't figure out how to import config data from a text file on their own, I'm certainly not going to waste my time with them...
For me, I would still like to find a portable 5G hotspot with VPN! Seems like everybody is using some variant of open source router firmware but nobody is fully testing their implementations...
- Copy Link
- Report Inappropriate Content
@evanevery Thanks a lot for your insights – this is incredible helpful and saves me a lot of time! Especially your experience with the GL.iNet devices – shame that the 4G Mudi is not fast enough.
The LTE routers from Ubiquity look nice but only seem to support LTE CAT4 as well.
Did you happen to look into the Teltonika devices? Not exactly pocket devices but seem to be very powerful...
- Copy Link
- Report Inappropriate Content
Thanks for the recommendation but I'm looking for something small and battery powered.
(I also want to use it for the TV in my BMW i7 so I can use it to get "local" stations via Hulu on my FireTV on the road. This requires a VPN connection back home so my FireTV thinks its inside my home network. This would also allow me to get local stations with a fireTV stick on TV's while in a hotel.)
- Copy Link
- Report Inappropriate Content
Information
Helpful: 1
Views: 497
Replies: 28
