VPN Wireguard Config

Configuration
1

Hello guys,

Probably is a question already made several times.
I have just added the wireguard VPN here my config file:

peers:
  - addresses:
      - 192.168.1.51
    allowed_ips: []
    client_allowed_ips:
      - 192.168.1.0/24
    name: MyMobile
server:
  addresses:
    - 192.168.1.50
  dns:
    - 192.168.1.254
    - 1.1.1.1
  host: myduckdns.duckdns.org

My network has the 192.168.1.x IPs

doubts:

  • in server address: 192.168.1.50 is the address that it will assume when connected?
  • in peer address : 192.168.1.51 is the address that mobile will assume when connected?

with this config i’m able to connect to the internet, BUT cant connect to HA.

My HA IP address is: 192.168.1.127:8123 (configured in mobile and accessible via wifi)

Have a port forward in router: Port 51820 UDP — > 51820

Also tried this config, that i think is the recommended, but before i need to understand the IPs, and what i’m doing, with this config, not able to connect to internet in myMobile.

peers:
  - addresses:
      - 192.168.2.2
    allowed_ips: []
    client_allowed_ips:
      - 192.168.1.0/24
      - 192.168.2.0/24
    name: MyMobile
server:
  addresses:
    - 192.168.2.1
  dns:
    - 192.168.1.254
    - 1.1.1.1
  host: myduckdns.duckdns.org
2

Yes but…

No. And the question makes me think I may need to clarify what “yes” actually means to your first question.

Wireguard makes its own network and assigns IP addresses on it to clients as they connect. If you put 192.168.1.50 in server then that is setting the address of the gateway on that network. So when your mobile phone connects it gets assigned the IP 192.168.1.51 on that network and is told the gateway is 192.168.1.50. Wireguard will listen on 192.168.1.50 and answer any queries it can and forward the ones it can’t on to the rest of your network.

Note that Wireguard is not accessible at 192.168.1.50 on your normal LAN. Nor is your phone accessible at 192.168.1.51 on your LAN when it’s connected. In fact there may be another device with that IP address on your LAN since you said you use 192.168.1.0/24. Your router has no idea Wireguard has made this subnetwork so it could give that address out via DHCP. That is quite confusing possibly problematic, my advice would be don’t do that. Pick a different subnet for Wireguard, 192.168.2.0/24 seems fine.

Also have you tried removing client_allowed_ips and seeing if that works? Nothing else is jumping out at me but I don’t use that config myself, I want all traffic to go through my VPN when I connect personally. I would suggest at least trying without it and then if that works you know that’s the issue.

3

Many thanks for your time.

Have changed to the following config. But cant connect to HA on mobile.

peers:
  - addresses:
      - 192.168.2.2
    allowed_ips: []
    client_allowed_ips: []
    name: MyMobile
server:
  addresses:
    - 192.168.2.1
  dns:
    - 192.168.1.254
    - 1.1.1.1
  host: myduckdns.duckdns.org

It seems the mobile is not accessing. Seeing the log it says:

E WireGuard/GoBackend/HomeAssistant: peer(zD04…XfXc) - Failed to send data packet: write udp4 0.0.0.0:45848->xx.xxx.xx.81:51820: sendto: network is unreachable

From HA it seems ok seeing the log.

Any toughts?

Other info:
My HA IP address is: 192.168.1.127:8123 (configured in mobile and accessible via wifi)
Don’t need to change the IP, right? accessing via vpn

Have a port forward in router: Port 51820 UDP — > 51820

image

If I change the address http://myduckdns.duckdns.org in HA on mymobile it redirects and opens the Router login page… :woozy_face:

4

You could also try wgeasy. I made an addon for it. Way simpler to use and has a web interferface to edit clients.

https://github.com/jdeath/homeassistant-addons/tree/main/wgeasy

1 Like
5

Thanks… but I would prefer to understand the issue and fix it.
Later I can test your add-on (even i’m not confortable to install it, but I’m sure you can help in that case)

6

Hi

Meanwhile the HA stuck and I needed to do a restart.
Don’t ask me why but I have tried and it worked.

Case closed :slight_smile: