FreshTomato Wiki

User Tools

Site Tools

Trace: • remote_upgrade_poc • ipt-24 • forward-dmz • advanced-tor • tools-wol • status-overview • advanced-vlan • ipt-realtime • nas-ftp • schedule_wol
vpn-wireguard

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
vpn-wireguard [2025/11/12 20:10] – [Interface] -Remove inappropriate Keepalive text hogwildvpn-wireguard [2026/03/08 21:42] (current) – pedro
Line 12: Line 12:
  
 Note that WireGuard only supports UDP stream, not TCP. Note that WireGuard only supports UDP stream, not TCP.
- 
  
 ===== Current development status ===== ===== Current development status =====
Line 35: Line 34:
   * Integrity VPN   * Integrity VPN
   * NordVPN   * NordVPN
-  * PIA (Private Internet Access+  * PIA (Private Internet Access)
   * ProtonVPN   * ProtonVPN
   * SurfShark   * SurfShark
Line 46: Line 45:
 [[https://www.linksysinfo.org/index.php?threads/wireguard-on-freshtomato.76295/page-23#post-348056|How to Connect to a VPN Provider's WireGuard Tunnel on FreshTomato]] [[https://www.linksysinfo.org/index.php?threads/wireguard-on-freshtomato.76295/page-23#post-348056|How to Connect to a VPN Provider's WireGuard Tunnel on FreshTomato]]
  
 +===== Scripts =====
 +
 +The Scripts tab allows you to define custom shell commands that are executed automatically at specific stages of the WireGuard interface lifecycle. This is useful for starting or stopping additional services, adding firewall rules (e.g. iptables), or configuring custom routing when the tunnel comes up or goes down. \\ \\  There are four script hooks available:
 +
 +  * Pre-Up Script – runs before the interface is brought up
 +  * Post-Up Script – runs after the interface has been brought up
 +  * Pre-Down Script – runs before the interface is taken down
 +  * Post-Down Script – runs after the interface has been taken down
 +
 +To reference the current WireGuard interface name dynamically within any script, use ''%i'' (without quotes) — it will be substituted with the actual interface name at runtime (e.g. wg0, wg1, etc.).
 +
 +Example:
 +
 +>iptables -A FORWARD -i %i -j ACCEPT
  
 ===== Status ===== ===== Status =====
Line 62: Line 75:
  
 {{::vpn-wireguard-stop_now-2025.3.png?76}}   terminates the current WireGuard VPN tunnel and stops the service. {{::vpn-wireguard-stop_now-2025.3.png?76}}   terminates the current WireGuard VPN tunnel and stops the service.
- 
  
 ===== Wireguard Configuration ===== ===== Wireguard Configuration =====
Line 85: Line 97:
  
 {{::vpn-wireguard-config_tab-2025.3.png?95}}  here, enter the main configuration settings for the chosen interface. {{::vpn-wireguard-config_tab-2025.3.png?95}}  here, enter the main configuration settings for the chosen interface.
- 
  
 ===== Interface ===== ===== Interface =====
Line 101: Line 112:
 **Poll Interval** - a watchdog timer for the WireGuard connection (in minutes) **Poll Interval** - a watchdog timer for the WireGuard connection (in minutes)
  
-This causes FreshTomato to ping 1.1.1.1 via the WireGuard interface, if not reply is received in time, the wg services is restarted.\\  \\ +This causes FreshTomato to ping 1.1.1.1 via the WireGuard interface. If no reply is received in time, the wg service is restarted.\\  \\ 
- +
  \\  \\
  
Line 217: Line 228:
   * Routing Policy - this lets you create rules, specifying which devices \\ or destination addresses/subnets should have their Internet traffic \\ routed through the VPN or directly to the internet, without encryption. \\ This can include "split-tunneling". \\ \\    * Routing Policy - this lets you create rules, specifying which devices \\ or destination addresses/subnets should have their Internet traffic \\ routed through the VPN or directly to the internet, without encryption. \\ This can include "split-tunneling". \\ \\ 
   * Routing Policy (Strict) - only explicitly-defined traffic will go through the\\ tunnel. All other traffic is excluded and can't use the tunnel.   * Routing Policy (Strict) - only explicitly-defined traffic will go through the\\ tunnel. All other traffic is excluded and can't use the tunnel.
- 
  
 ===== Peer Parameters ===== ===== Peer Parameters =====
Line 284: Line 294:
  
  \\  \\
- 
  
 ===== Import Config from file ===== ===== Import Config from file =====
Line 315: Line 324:
  
 {{::vpn-wireguard-peers_tab-2025.3.png?95|Peers}} in this tab, you enter settings for the peer devices. {{::vpn-wireguard-peers_tab-2025.3.png?95|Peers}} in this tab, you enter settings for the peer devices.
- 
  
 ===== Peers ===== ===== Peers =====
- 
  
 This section allows you to enter and view settings for all peers of this WireGuard interface/instance. This section allows you to enter and view settings for all peers of this WireGuard interface/instance.
Line 363: Line 370:
  
 \\ \\
- 
  
 ===== Peer's Parameters ===== ===== Peer's Parameters =====
Line 422: Line 428:
  
 {{::vpn-wireguard-peers-peers_parameters-add_to_peers-2025.3.png?80}} clicking this adds all completed settings in the section to the [Peers] section in the WireGuard Configuration file. \\   \\   \\ {{::vpn-wireguard-peers-peers_parameters-clean-2025.3.png?80}}** **clicking this will clear all fields in this section, but won't save those changes until you click Save. {{::vpn-wireguard-peers-peers_parameters-add_to_peers-2025.3.png?80}} clicking this adds all completed settings in the section to the [Peers] section in the WireGuard Configuration file. \\   \\   \\ {{::vpn-wireguard-peers-peers_parameters-clean-2025.3.png?80}}** **clicking this will clear all fields in this section, but won't save those changes until you click Save.
- 
  
 ===== Status ===== ===== Status =====
Line 452: Line 457:
   - Latest Handshake performed   - Latest Handshake performed
   - Number of bytes sent and received by this peer   - Number of bytes sent and received by this peer
- 
  
 ===== WireGuard Notes and Troubleshooting ===== ===== WireGuard Notes and Troubleshooting =====
Line 465: Line 469:
  
  \\  \\
- 
  
 ==== General Troubleshooting ==== ==== General Troubleshooting ====
Line 481: Line 484:
     * Remote LAN IP     * Remote LAN IP
  
- \\  The point of failure you find will provide critical insight into the type of issue you are facing.+ \\  The point of failure you find will guide you in understanding what type of issue you are facing.
  
  \\  \\
 +
 +==== Problem: Traffic flowing in only one Direction ====
  
  \\  \\
 +
 +Sometimes, it may occur that from one end of your setup ("A)", you can ping devices and both VPN virtual interfaces at the other end ("B"), however, from end B, you cannot ping the remote router or devices or the client VPN virtual interface at end A.
 +
 +It this occurs, please check that there are default routes setup from B to A. Also, please check that on the client side, (in this case, end B), the "Inbound firewall" option is disabled. On the server side, make sure to add the client's subnet, so it knows how to route traffic from the server back to the client.
  
  
vpn-wireguard.1762978223.txt.gz · Last modified: by hogwild

Page Tools

Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki