Can't connect to PiVPN (WireGuard) - what am I missing?

Question

I'm looking for some help to get my PiVPN running correctly.

I have PiHole installed on a Raspberry Pi and I'm now trying to install PiVPN on it to be able to make use of the ad blocking while I'm on the go.

I've followed the PiVPN installation guide (I've tried with both WireGuard and OpenVPN) but I can't connect to the VPN. The installation seems to go fine and when running pivpn -d it says OK for all "Self checks".

I've now installed PiVPN with WireGuard on port 51820, which I've also forwarded in my router to my Raspberry Pi.

On the question "We have detected a Pi-hole installation, do you want to use it as the DNS server for the VPN, so you get ad blocking on the go?" I said Yes.

I don't get a static IP from my ISP so I've registered a domain on https://www.duckdns.org/ that I've entered as the domain on the question "Will clients use a Public IP or DNS Name to connect to your server"

In the PiHole settings I've enabled "Permit all origins" in the DNS tab.

On my Android phone I've download the WireGuard app and scanned the QR code generated from pivpn -qr. When trying to connect to the VPN on the phone the app doesn't say that it fail but I can see that on the Transfer row it says rx:0B. I've also tried viewing a website but nothing shows up. My phone is using mobile data, not the WiFi.

When running tcdump on the Raspberry while I'm trying to connect I can see data being received , but no data seems to be sent back from the server:

root@raspberrypi:/home/pi# tcpdump -n -i eth0 udp port 51820
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
19:38:24.847693 IP 94.191.136.132.19556 > 192.168.1.10.51820: UDP, length 148
19:38:30.118143 IP 94.191.136.132.19556 > 192.168.1.10.51820: UDP, length 148
19:38:35.437406 IP 94.191.136.132.19556 > 192.168.1.10.51820: UDP, length 148
19:38:40.727581 IP 94.191.136.132.19556 > 192.168.1.10.51820: UDP, length 148

What am I missing? All help is greatly appreciated!

Below is some configs and outputs:

pi@raspberrypi:~ $ pivpn -c
::: Connected Clients List :::
Name               Remote IP                Virtual IP      Bytes Received      Bytes Sent      Last Seen
g-mobil      94.191.136.132:19556      10.6.0.2        8,0KiB              5,0KiB          (not yet)
::: Disabled clients :::

/etc/wireguard/wg0.conf (I've replaced some content with ******):

[Interface]
PrivateKey = ******
Address = 10.6.0.1/24
MTU = 1420
ListenPort = 51820
### begin g-mobil ###
[Peer]
PublicKey = ******
PresharedKey = ******
AllowedIPs = 10.6.0.2/32
### end g-mobil ###

/etc/wireguard/configs/g-mobil.conf (I've replaced some content with ******):

[Interface]
PrivateKey = ******
Address = 10.6.0.2/24
DNS = 10.6.0.1

[Peer]
PublicKey = ******
PresharedKey = ******
Endpoint = ******.duckdns.org:51820
AllowedIPs = 0.0.0.0/0, ::0/0

iptables: (I'm a noob when it comes to this so I'm not sure what this is or what the config should look like. I've added some lines from a guide I found online so I'm not sure if this looks alright)

pi@raspberrypi:~ $ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere             udp dpt:51820 /* wireguard-input-rule */
ACCEPT     udp  --  anywhere             anywhere             state NEW udp dpt:openvpn
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             10.6.0.0/24          ctstate RELATED,ESTABLISHED /* wireguard-forward-rule */
ACCEPT     all  --  10.6.0.0/24          anywhere             /* wireguard-forward-rule */
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere 

etc/pihole/setupVars.conf:

PIHOLE_INTERFACE=eth0
IPV4_ADDRESS=192.168.1.10/24
IPV6_ADDRESS=fd51:42f8:caae:d92e::ff
QUERY_LOGGING=true
INSTALL_WEB_SERVER=true
INSTALL_WEB_INTERFACE=true
LIGHTTPD_ENABLED=true
CACHE_SIZE=10000
WEBPASSWORD=******
BLOCKING_ENABLED=true
PIHOLE_DNS_1=8.8.8.8
PIHOLE_DNS_2=8.8.4.4
DNS_FQDN_REQUIRED=true
DNS_BOGUS_PRIV=true
DNSSEC=false
REV_SERVER=false
DNSMASQ_LISTENING=all

/etc/pihole/pihole-FTL.conf:

#; Pi-hole FTL config file
#; Comments should start with #; to avoid issues with PHP and bash reading this file
PRIVACYLEVEL=0
#delay added by me, hoping it would fix my issues
DELAY_STARTUP=5
#next line also added by me
DNSMASQ_LISTENING=all

Answer 1

Your listening port on the interface (e.g client) is probably not set to the port 51820 and it’s probably on automatic. So, you probably have to go to the wireguard app on your phone, click the profile and edit the config. Then, change the listening port to 51820 (or the port you have specified in the port forwarding).

Answer 2

One thing to be mindful of is that wireguard doesn't return errors if you are sending something funny. So, for example, if you have a key wrong your UDP packets are just dropped. You will see something similar with PSK or allowed IP as well.

I don't know anything about PiVPN but in the pure wireguard world, I would suggest you connect your client and enable logging on the wireguard server:

echo "module wireguard +p" > /sys/kernel/debug/dynamic_debug/control

Run tcpdump at both ends of your link and on the server ping your client:

ping 10.6.0.2

Check dmesg on the server to see the wireguard messages. Hopefully it will point you to the problem.

You can then do the reverse (ping 10.6.0.1) etc.

If that works then you have a more general routing problem (perhaps NAT?) rather than a VPN issue.

Don't forget to turn off the extra logging when done with:

echo "module wireguard -p" > /sys/kernel/debug/dynamic_debug/control