Wireguard addon not connecting

Third party integrations
1

Hello all,
about a month ago i setup wireguard addon on my HA Yellow for my phone. After a bit troubleshooting it was working fine.
Tonight i wanted to add client for notebook as well but that caused everything to break.
yaml in addon :

server:
  host: <public HA address>
  addresses:
    - 172.27.66.1
  dns:
    - 1.1.1.1
  public_key: <HA addon public key>
  private_key: <HA addon private key>
peers:
  - name: phone
    public_key: <phone public key>
    addresses:
      - 172.27.66.2/32
    allowed_ips: []
    pre_shared_key: <phone preshared key>
    client_allowed_ips: []
  - name: notebook
    public_key: <notebook public key>
    addresses:
      - 172.27.66.3/32
    allowed_ips: []
    pre_shared_key: <notebook preshared key>
    client_allowed_ips: []

Addon does start and i am getting traffic

  allowed ips: 172.27.66.2/32
  transfer: 32.38 KiB received, 20.27 KiB sent
  persistent keepalive: every 25 seconds

However on the phone now i am getting rx: 0 and logs say error about failing handshake in 5s.

Can someone please point me in direction of how to get this to work?

2

To my understanding, the WireGuard Add-on doesn’t work like a traditional peer-to-peer WireGuard setup. It forces the HA machine to become a host/server, as can be seen in the yaml. I’m assuming this is by design for security to only allow a narrow tunnel to the HA machine, instead of actually creating a more robust WireGuard VPN. No other WireGuard compatible device works like that, that I’ve come across. I use WireGuard on my OpenWrt router, my phone, and my laptop, and they all use peer settings credentials. I’ve also heard/seen the add-on is quite fickle with devices and firmware.

3

That’s fine by me. My use case is e-2-e encryption of traffic for away devices. So 0.0.0.0/0 for allowed IPs and HA being server is my exact use case.

I am just puzzled why it doesn’t work suddenly when it was fine for couple weeks.

4

Did something change at the ISP level (What type of IP (NATing type)? Are you using dDNS (Dynamic DNS and FQDN)? Did you do any updates (HA, Home network)?

1 Like
5

I was literally just going to mention that possibility, lol. Definitely! @koudy check your router/modem settings or investigate the port traffic with something like Wireshark. ISP’s are public enemy #1 with VPN’s and DNS providers.

6

This is rather strange. I took a break from phone settings and moved to notebook. It just works there. I connected to the mobile phone hotspot and enabled wireguard. Whatismyip was showing my public home IP address.

So after small break i went back to the phone just now and rebooted it. And now it works. I have no idea what happened there. Quote from IT crowd “Have you tried to turn it off and on again” comes to mind however… :man_facepalming:

I very much appreciate all the quick replies. Thank you very much for the help!