4 ms·

For anyone else wanting to set this up at home, I’d recommend installing the vyatta-wireguard module [1] on an EdgeRouter X instead. It costs about the same as

by sjy 7y ago

For anyone else wanting to set this up at home, I’d recommend installing the vyatta-wireguard module [1] on an EdgeRouter X instead. It costs about the same as a Raspberry Pi, and you get a reliable network appliance with four gigabit ports and PoE, rather than a general purpose Linux box with graphics and USB. I’ve found the WireGuard module to be fast enough to keep up with my 100/40 Mbps internet connection, and now when my Linux server goes down, the network it’s connected to stays up. [1]: https://github.com/Lochnair/vyatta-wireguard https://github.com/Lochnair/vyatta-wireguard

axiomdata316 7y ago
I have this router and set up the wg interface but got stuck at how to route all my home traffic through wg. Any recommendations on how to troubleshoot this part?
- mchristen 7y ago
  I believe you can do this with policy based routing rules. Effectively you create a second routing table where the default route goes through your wireguard device and then you create firewall modify rules that assign traffic to that routing table by source, your local LAN range and interface in this case. The following article has an example of using policy based routing. Your setup isn't all that different, you don't need to have more than one default route in each routing table is all and you also might only need one additional route table. https://help.ubnt.com/hc/en-us/articles/204952274-EdgeMAX-Policy-based-routing-source-address-based- https://help.ubnt.com/hc/en-us/articles/204952274-EdgeMAX-Po...
- sjy 7y ago
  As suggested in the sibling comment, use policy-based routing, specifically something like: set protocols static table <table-number> interface-route 0.0.0.0/0 next-hop-interface wg1
- jotef 7y ago
  I recommend following this blog post. Helped me a lot: https://andrew.dunn.dev/posts/wireguard-from-your-isp/ https://andrew.dunn.dev/posts/wireguard-from-your-isp/
0xEFF 7y ago
I upgraded from an ER-X to an ER-4 because the X can’t do full 1000 Mbit with PPPoE fiber without hardware offload. With hardware offload turned on there’s a bug in the hardware that causes some sites, most notably Netflix, to not route at all. The ER-4 has been great with the Cavium hardware. No hardware offload issues like this. Edit: The ER-X tops out around 500 Mbit with hardware offload turned off.
- whalesalad 7y ago
  Love my ER-4 and all its offloading capabilities. I just wish it had a switch chip so you could bridge ports without a performance penalty.
- msh 7y ago
  Huh. I have a er-x with hardware offloading turned on. I have noticed no issues with netflix. I get about 900 megabit on my gigabit fiber.
  - quaa55 7y ago
    while i don’t use it it should be possible for ppoe with hw offloading, so i don’t get it either. maybe that’s disabled on the slow one... https://help.ubnt.com/hc/en-us/articles/115006567467-EdgeRouter-Hardware-Offloading https://help.ubnt.com/hc/en-us/articles/115006567467-EdgeRou... but i’d assume it should handle fast rates like this if hw offloading was on.
- bisby 7y ago
  I had an ER Lite, and hardware offload was re-validating packets. Things would come in as error, and come out the other side still invalid, but validated. And at the time my ISP was sending me a lot of uncorrectable errors. So a lot of services would refuse to run with hardware offload on, because the errors weren't being handled. (with it off, the errors were identified as errors and handled. slow, but accurate). Then the pole outside my house got hit by lightning and fried the thing, and I replaced it with something from mikrotik.
karlshea 7y ago
Be careful with this module, lots of the `set` and `delete` commands aren't quite working right yet, leading to some commit failed errors for me. I was trying to get something working and ended up with an ERX that couldn't pass traffic last night. Luckily I had a serial-to-USB cable so I could fix it.
- tssva 7y ago
  That's partially my fault. I wrote a lot of the configuration command stuff for that module and there are a couple of bugs when it comes to validation for setting and deleting items so you can get yourself in a bad position. Plus there are some issues with EdgeOS which this seems to trigger. I migrated from Wireguard to ipsec quite a long time ago because it was less complicated for my particular needs. It has probably been close to 2 years. No one else seems to have taken up resolving the lingering problems with the configuration issues.
  - karlshea 7y ago
    I'm running the latest 2.x firmware so I wasn't sure where to point fingers :) I'll give it another shot at some point, but it was more just to try out. I've also got ipsec set up on that router and that continues to work just fine.
    - tssva 7y ago
      I may dust my personal ER-X off soon and take a look at addressing the issues. I would have more enthusiasm about it if it didn't involve writing perl scripts. If you do attempt it again there are "generate" commands which will generate they keys needed and place them in the proper area in the file system. Most of the guides to configuring Wireguard on edgeos seem unaware these exist and have people using the "wg" command directly instead to generate keys.
      - karlshea 7y ago
        Ahhh good to know! I think part of my issue is just that I need to do some more reading around what IPs should be what. It's usually clear what's going on in WireGuard-land, but not clear how that interacts with the other interfaces or the networks on either side.

by sjy 7y ago

axiomdata316 7y ago

I have this router and set up the wg interface but got stuck at how to route all my home traffic through wg. Any recommendations on how to troubleshoot this part?

mchristen 7y ago
I believe you can do this with policy based routing rules. Effectively you create a second routing table where the default route goes through your wireguard device and then you create firewall modify rules that assign traffic to that routing table by source, your local LAN range and interface in this case. The following article has an example of using policy based routing. Your setup isn't all that different, you don't need to have more than one default route in each routing table is all and you also might only need one additional route table. https://help.ubnt.com/hc/en-us/articles/204952274-EdgeMAX-Policy-based-routing-source-address-based- https://help.ubnt.com/hc/en-us/articles/204952274-EdgeMAX-Po...
sjy 7y ago
As suggested in the sibling comment, use policy-based routing, specifically something like: set protocols static table <table-number> interface-route 0.0.0.0/0 next-hop-interface wg1
jotef 7y ago
I recommend following this blog post. Helped me a lot: https://andrew.dunn.dev/posts/wireguard-from-your-isp/ https://andrew.dunn.dev/posts/wireguard-from-your-isp/

0xEFF 7y ago

I upgraded from an ER-X to an ER-4 because the X can’t do full 1000 Mbit with PPPoE fiber without hardware offload. With hardware offload turned on there’s a bug in the hardware that causes some sites, most notably Netflix, to not route at all. The ER-4 has been great with the Cavium hardware. No hardware offload issues like this. Edit: The ER-X tops out around 500 Mbit with hardware offload turned off.

whalesalad 7y ago
Love my ER-4 and all its offloading capabilities. I just wish it had a switch chip so you could bridge ports without a performance penalty.
msh 7y ago
Huh. I have a er-x with hardware offloading turned on. I have noticed no issues with netflix. I get about 900 megabit on my gigabit fiber.
- quaa55 7y ago
  while i don’t use it it should be possible for ppoe with hw offloading, so i don’t get it either. maybe that’s disabled on the slow one... https://help.ubnt.com/hc/en-us/articles/115006567467-EdgeRouter-Hardware-Offloading https://help.ubnt.com/hc/en-us/articles/115006567467-EdgeRou... but i’d assume it should handle fast rates like this if hw offloading was on.
bisby 7y ago
I had an ER Lite, and hardware offload was re-validating packets. Things would come in as error, and come out the other side still invalid, but validated. And at the time my ISP was sending me a lot of uncorrectable errors. So a lot of services would refuse to run with hardware offload on, because the errors weren't being handled. (with it off, the errors were identified as errors and handled. slow, but accurate). Then the pole outside my house got hit by lightning and fried the thing, and I replaced it with something from mikrotik.

karlshea 7y ago

Be careful with this module, lots of the `set` and `delete` commands aren't quite working right yet, leading to some commit failed errors for me. I was trying to get something working and ended up with an ERX that couldn't pass traffic last night. Luckily I had a serial-to-USB cable so I could fix it.

tssva 7y ago
That's partially my fault. I wrote a lot of the configuration command stuff for that module and there are a couple of bugs when it comes to validation for setting and deleting items so you can get yourself in a bad position. Plus there are some issues with EdgeOS which this seems to trigger. I migrated from Wireguard to ipsec quite a long time ago because it was less complicated for my particular needs. It has probably been close to 2 years. No one else seems to have taken up resolving the lingering problems with the configuration issues.
- karlshea 7y ago
  I'm running the latest 2.x firmware so I wasn't sure where to point fingers :) I'll give it another shot at some point, but it was more just to try out. I've also got ipsec set up on that router and that continues to work just fine.
  - tssva 7y ago
    I may dust my personal ER-X off soon and take a look at addressing the issues. I would have more enthusiasm about it if it didn't involve writing perl scripts. If you do attempt it again there are "generate" commands which will generate they keys needed and place them in the proper area in the file system. Most of the guides to configuring Wireguard on edgeos seem unaware these exist and have people using the "wg" command directly instead to generate keys.
    - karlshea 7y ago
      Ahhh good to know! I think part of my issue is just that I need to do some more reading around what IPs should be what. It's usually clear what's going on in WireGuard-land, but not clear how that interacts with the other interfaces or the networks on either side.