Can't add ESPHome device connected via Wireguard

I’m trying to add a Sonoff S31 I’ve flashed with ESPHome. It was previously working, but I’m moving it to a remote location and am attempting to configure it to use Wireguard (running on Unifi Dream Machine).

Here’s what is working:

  • Device successfully connects to WiFi on remote network
  • Wireguard tunnel connects successfully
  • I’m able to ping the device at its VPN IP (192.168.3.7) from my HAOS server (10.0.1.11, running on a Proxmox host)

When I attempt to add the device to the ESPHome integration as indicated here, it times out:

I tried with use_address set to the VPN IP (and without that configured as well), still no dice. I don’t see anything in any logs that would indicate what’s going wrong. Has anyone else been able to get a similar setup working?

My ESPHome YAML for the device is below:

esphome:
  name: "sonoff-s31-05"           #prepended to every entity name
  friendly_name: "Sonoff S31-05"  #if friendly name is set, the friendly name is prepended to entity friendly name
  comment: "Support Kitchen Freezer"

substitutions:
  update_interval: 10s #power data update interval

esp8266:
  board: esp01_1m

# Enable Home Assistant API
api:
  encryption:
    key: "<REDACTED>"

ota:
  platform: esphome
  password: "<REDACTED>"

# ********************************  Device Specific Config ********************************

# Enable logging
logger:
  baud_rate: 0 # (UART logging interferes with cse7766)

wifi:
  use_address: 192.168.3.7
  networks:
  - ssid: !secret wifi_ssid
     password: !secret wifi_password

  # Enable fallback hotspot (captive portal) in case wifi connection fails
  ap:
    ssid: "Sonoff-S31-05 Fallback Hotspot"
    password: "fallback"

# Time

time:
  - platform: sntp
    id: sntp_time
    timezone: Pacific/Honolulu
    servers:
     - 0.pool.ntp.org
     - 1.pool.ntp.org
     - 2.pool.ntp.org  

captive_portal:

# VPN

wireguard:
  address: 192.168.3.7
  private_key: !secret wg_privkey_plug_s05
  peer_endpoint: 66.75.126.7
  peer_public_key: "<REDACTED>"

  # Optional netmask (this is the default, no outgoing traffic
  # will pass through the tunnel if omitted)
  netmask: 255.255.255.255

  # Optional endpoint port (WireGuard default if omitted)
  peer_port: 51820

  # Optional pre-shared key (omit if not in use)
  peer_preshared_key: !secret wg_shrdkey_plug_s05

  # Optional list of ip/mask (any host is allowed if omitted)
  # peer_allowed_ips:
  #   - 192.168.3.1/32
  #   - 192.168.3.7/32
  #   - 10.0.1.1/32
  #   - 10.0.1.2/32
  #   - 10.0.1.11/32
  #   - 10.0.1.27/32
  #   - 0.0.0.0/0

  # Optional keepalive (disabled by default)
  peer_persistent_keepalive: 25s   

text_sensor:
  - platform: wireguard
    address:
      name: 'WireGuard Address'

preferences:
  flash_write_interval: "24h" #save flash write cycles

uart:
  rx_pin: RX
  baud_rate: 4800

binary_sensor:
  - platform: gpio
    pin:
      number: GPIO0
      mode: INPUT_PULLUP
      inverted: True
    name: Button
    internal: True
    on_press:
      - switch.toggle: relay
  - platform: status
    name: Status
  - platform: wireguard
    enabled:
      name: 'WireGuard Enabled'
  - platform: wireguard
    status:
      name: 'WireGuard Status' 

sensor:
  - platform: wifi_signal
    name: WiFi Signal
    update_interval: 60s
  - platform: cse7766
    current:
      name: Current
      state_class: measurement
      device_class: current
      accuracy_decimals: 2
      filters:
        - throttle_average: ${update_interval}
    voltage:
      name: Voltage
      state_class: measurement
      device_class: voltage
      accuracy_decimals: 1
      filters:
        - throttle_average: ${update_interval}
    power:
      name: Power
      state_class: measurement
      device_class: power
      accuracy_decimals: 2
      id: my_power
      filters:
        - throttle_average: ${update_interval}
  - platform: total_daily_energy
    name: Daily Energy
    power_id: my_power
    method: left
    state_class: total_increasing
    device_class: energy
    accuracy_decimals: 2
  - platform: wireguard
    latest_handshake:
      name: 'WireGuard Latest Handshake'

switch:
  - platform: gpio
    name: Relay
    icon: "mdi:power-socket-us"
    pin: GPIO12
    id: relay
    restore_mode: ALWAYS_ON # *************  Choose this wisely!!!! Depends on application

status_led:
  pin: GPIO13

I have a simlar setup (multiple ESPHome devices running wireguard connected to an UDM) without any issues. The config you’ve posted seems correct to me.

The only thing I can think of is that there’s a misconfiguration on your UDM where the subnet/vlan that your HA is on is unable to access the subnet/vlan where your wireguard is.

Can you connect for example a laptop to the same subnet/vlan as your HA and use it to connect to the ESPHome device (using the ip/port), e.g. using telnet?

Try with netmask value 255.255.255.0.

Static routes and outgoing connections

Thank for the insight. I tested running a simple webserver on a laptop connected via the VPN, and I was able to access it from a computer on the LAN, but I couldn’t access it from the HA server. So that might be a clue. For my other Sonoff devices that are on a local VLAN, I’m able to pull up a simple HTTP dashboard that give me access to logs and the ability to turn them on/off, but I can’t access that web dashboard on the device that’s connected over the Wireguard VPN.

It’s worth noting, I guess, that this HAOS VM believes it’s at 172.30.32.1 (due to the self-hosted Docker under HAOS) and not 10.0.1.11 as I normally access it, as evidenced via traceroute:

[core-ssh ~]$ traceroute 192.168.3.7
traceroute to 192.168.3.7 (192.168.3.7), 30 hops max, 46 byte packets
 1  a0d7b954-zerotier.local.hass.io (172.30.32.1)  0.022 ms  0.020 ms  0.020 ms
 2  unifi.mydomain (10.0.1.1)  0.539 ms  *  0.428 ms
 3  *  *  *
 4  *  *  *
 5  *  *  *
 6  *  *  *
...

So that might provide some insight as to where the issue is. I feel like there’s some sort of static route that needs to be added here, but I’m not entirely sure what that would look like. For purposes of completeness:

  • LAN: 10.0.1.0/24
  • Wireguard VPN: 192.168.3.0/24
  • HA (just gonna paste the gory details since I can’t copy/paste from the Proxmox console):

I like your thinking, but sadly that didn’t make a difference. Please see my post above, I’m guessing there’s something here with the Docker instance impacting things.

Update - whatever it was with my config, setting netmask: 0.0.0.0 allowed me to add the device successfully. Thank you @jkoukos for pointing me in the right direction!