Wireguard Client fails while Win11 Wireguard Client (with same config) works fine...
I've been looking for a decent 5G hotspot with a built in VPN client and I had high hopes for the M8550. I've been fighting with this for a couple of days now...
Basic Problem: Can not get the Wireguard client to pass traffic properly to/from my router (OPNsense 25.7.10-amd64 = latest)
- The M8550 seems to work fine as a hotspot for my test PC to/from the Internet. So that is good. To simplify things, my Test PC is connected directly to the ethernet port on my M8550.
- I have tested my configuration using the generic Wireguard client on my Test PC. It works just fine. This confirms that my router and my test configuration is appropriate and functional. I am even using the M8550 in this configuration as my hotspot (obviously with the M8550's Wireguard client disabled).
- Trying to import the simple Wireguard Configuration file is all but impossible on the M8550. I don't think I have ever seen it succeed so I always have to enter the corresponding client configuration data by hand (copy/pasting the all-important public/private keys to be sure they are correct).
- Even when entering the data by hand, the M8550 always seems to want more data then is available in the config file (like MTU and PersistentKeepalive). The M8550 never reports a meaningful error (just "9007 invalid data" - even when a field is left blank). Anyway, I finally know which fields arte required and I can get a proper config entered by hand.
- In comparing the manually entered configuration data with the data in the client configuration file everything seems consistent and accurate.
- The M8550 shows that the connection is established once the client is activated but this is pretty useless data. I have seen the "connected" message on the M8550 when even a knowingly incorrect config parameter was provided. The client "connected" indication is essentially useless for troubleshooting.
- The M8550 also provides no useful VPN data in the system log files even at "debug" level.
- However, I can see on my router when a Wireguard Client (any client) successfully negotiates a tunnel. The router will indicate when a tunnel has been established and also when it collapses. I can see from my router that it looks like the M8550 is successfully opening a Wireguard tunnel.
- After the M8550 appears to successfully open the wireguard tunnel, it looks like something is broken with respect to the routing tables on the device. If I try to ping an internal IP address in my network (from my test PC), I will get a "192.168.1.1: Destination host unrerachable". To me, this looks like the M8550 (192.168.1.1) does not understand what it needs to do to reach the internal network on the other side of the Wireguard tunnel. "AllowedIPs = 0.0.0.0/0" is set in my cleint config so all traffic should be passed via the tunnel. Again, this exact same configuration works just fine when imported into the generic Wireguard client on my Test PC.
- I have also tried "AllowedIPs = 0.0.0.0/1" as I have seen that used as an example in various TP-Link documentation - but it also does not work.
- I have tried "AllowedIPs = 172.20.0.0/16" in the M8550 (and reconfiguring the OpnSense router accordingly) as that is the RFC1918 Class B address of my internal/private network - but it also does not work.
I don't think there is anything else I can do here. I've been at this literally for days. The fact that the generic Wireguard client on my Test PC works just fine and the M8550 client does not is a pretty good indication where the problem is. It would be helpful if the Client Config import actually worked properly (not hanging) and also if it would give meaningful information if it thought it had a configurastion issue. This is pretty lazy programming I think...
Anyone have any ideas?
- Copy Link
- Subscribe
- Bookmark
- Report Inappropriate Content
So now they are asking for me to install teamviewer on my PC so they can see why my M8550 is not establishing a tunnel.
Not sure what they are expecting to accomplish with remote access cause the instant I hit "connect" they will lose all connectivity. As soon as the M8550 (through which my PC is getting internet access) tries to open the VPN, they will lose all visibility. I'm not sure why they wouldn't understand this...
Perhaps its just another generic "we need remote access" request from a Tech Support which is not actually considering what they might accomplish?
I raised this question to them and haven't heard back. I also told them I would do this REGARDLESS if they could simply tell me what value it might provide. Still waiting...
They also asked what router I was using - which I clearly provided in my first posting and ALSO in the report I used to open my support ticket. This isn't my first rodeo. I always try to provide as much info and detail as possible so folks don't have to ask for it later. Yet they always seem to ask anyway... Anyone else of tired of Tech Support which doesn't read ALL the information you provide?
If anyone is having any better luck here, please keep us posted!
- Copy Link
- Report Inappropriate Content
@evanevery Did you ever come across the Cello C160 aka KuWFi C160? Seems to have L2TP VPN support but doesn't look terribly trustworthy.
- Copy Link
- Report Inappropriate Content
@evanevery
Not sure what they are expecting to accomplish with remote access cause the instant I hit "connect" they will lose all connectivity.
That is actually quite hilarious ![]()
I can't say that I have been terribly impressed by the performance of the support agents so far. They sent me the beta firmware that could not be installed even though you had already received newer ones. When I contacted them again with the error report, they sent me the same firmware version again.
- Copy Link
- Report Inappropriate Content
Surely with remote access if a tunnel is not built, they will not lose the connection? Like I say mine just keeps flashing up "connecting" and no more.
I'm shocked at the lack of testing resource behind this, like you say. I'll run that firmware up tomorrow morning UK time and try it.
I'm not confident that it will work, and has probably broken other stuff too. I might even try the server tomorrow with the RJ45 in WAN mode, see how that fairs up. I bet that is broken, or has never worked too.
At least with my AMIT (GEM route Pro 420), they gave me a fix that only allowed PPTP dial in all them years ago when I lived in a remote location and could get a public IPv4 address with H3G, then Apple in the wise wisdom decided to do away with PPTP (yes security I know, but it's like it is all about control).
I think I will probably end up sending it back, for the money I can get a 5G Draytek without the need for silly power saving cures, and is guaranteed to do "what it says on the tin"!
- Copy Link
- Report Inappropriate Content
(Anybody wonder why the "remember me" button on the TP-Link community web site log in page doesn't work and we still have to log in EVERY TIME? <sigh>)
Sure, I would expect their remote access to work just fine untill the moment I hit "connect"... (Once I hit "connect" my PC can't see anything on the other side of the M8550. This includes both the VPN and the Internet).
If all they want to witness is a total loss of connectivity (inc their remote session) when I hit the "connect" button, I don't think that gains us much.
I'm guessing this is probably because pretty much everybody is using open source router software (that they don't fully understand) and are trying to tweak it to work with their individual hardware (which they don't fully test).
- Copy Link
- Report Inappropriate Content
That didn't go well!
I thought that rather than keep removing the sim card out of my company phone to test, I'd initially use the WAN connection, and guess what, the dictionary definition opposite of consistency, what a joke. I was going to upgrade the firmware and make sure all was "okay" before I went down the route of dial out / in, etc.
The GUI even reported it wasn't online when it was, and within a couple of minutes it would just drop out. I haven't chanced upgrading the firmware as reading everything "advanced" about this "router", can you even call it that at this stage is a complete joke, and that is what they market this thing on. Even if it fixed tht issue, there is going to be a million and one bugs, and reminds me of my AMIT (badged GemRoute 420) years ago. Even the half hearted attempt of my request they gave me a firmware version that done PPTP at least back in the day.
I feel like I have had the right p155 taken out of me in regards to this, it is factory reset with the latest official firmware and all boxed up and ready for returns. I'm not going through that ball ache, like you said "Why should I?"
- Copy Link
- Report Inappropriate Content
I'm with you...
I have no problem working with Tech Support if they would please not waste my time.
- One would think they should be able to test the sucessful import of a config text file without any of our assistance. (Apparently not)
- Please stop throwing BETA firmware at us if you haven't tested it to see if it actually fixes anything (like a proper text import for example)
- Please read all the information I have carefully gathered and posted and stop asking for it multiple times. Its pretty apparent the folks reading the tech support messages are only reading the very last reply...
- There are so many glaring problems with the user interface and no one (but actual customers) seems to notice/care.
- If they are going to ask for customer help in FIXING THEIR PRODUCTS, they should value our time and should only ask us to provide meaningful things. (Otherwise, I'll be happy to negotiate a consulting rate)
If I don't see some simple progress here in very short order (like properly importing data from a text file), I'll just step away for a month or two and come back later to see if they have actually accomplished anything. (I'm out of the country for several weeks starting next Friday - and I told them this...) I'm sure there are other customers that they can take advantage of who are more compliant than myself...
Still wondering why the "Remember Me" button on the web site Log In page doesn't work... Perhaps the same people who are NOT testing the web pages are the ones NOT testing the hotspot firmware?
- Copy Link
- Report Inappropriate Content
I wish you all the best of luck. If I find anything suitable in the meantime I'll update you.
- Copy Link
- Report Inappropriate Content
Information
Helpful: 1
Views: 499
Replies: 28
