I'm running wg-easy in Docker on an ASUS TUF-AX4200 router using OpenWrt. The Android WireGuard client connects successfully and shows traffic, but it cannot access either my LAN or the internet. DNS also fails: lookups time out against public DNS servers, and pinging 192.168.1.1 returns Destination Port Unreachable.
The client receives a 10.8.0.2 WireGuard address, while my LAN gateway and DNS server are at 192.168.1.1. I used the example Docker Compose configuration, including the 10.42.42.0/24 Docker bridge network, NET_ADMIN, IP forwarding, and the WireGuard UDP port mapping. What routing, firewall, NAT, and DNS configuration is needed on OpenWrt so WireGuard clients can reach 192.168.1.0/24 and the WAN?
1 Answer
The WireGuard handshake only proves that UDP traffic reaches the container; it does not automatically make the Docker bridge, OpenWrt LAN, and WAN routes work together. OpenWrt generally needs an explicit firewall zone for the Docker/WireGuard networks, forwarding from that zone to LAN and WAN, and masquerading for internet-bound traffic.
Also check the generated client configuration. Its AllowedIPs should include the networks you want to reach, commonly `0.0.0.0/0, ::/0` for a full tunnel, or at least `192.168.1.0/24` plus the WireGuard subnet for LAN-only access. Set the client DNS to the reachable resolver, such as `192.168.1.1`, rather than assuming wg-easy’s default will match your router.
On the OpenWrt side, confirm that IP forwarding is enabled and that traffic from the WireGuard client subnet is accepted and forwarded. If OpenWrt does not know how to return traffic to that subnet, either add a route for it via the Docker host/container path or enable source NAT where appropriate. The `Destination Port Unreachable` response from 192.168.1.1 strongly suggests that the packet is reaching the router but is being rejected by its firewall or routing policy.
Adding 192.168.1.1 to the compose file alone will not create a route to the LAN. The container’s 10.42.42.0/24 bridge and the client’s WireGuard subnet must be permitted by OpenWrt, and replies must be routed or masqueraded back through the WireGuard host.
The Termux permission warning is from inspecting interfaces on the Android phone; it is not evidence that the Docker container lacks NET_ADMIN. The compose file already grants the container NET_ADMIN. The more important issue is allowing the WireGuard/Docker source subnet through OpenWrt’s firewall and making sure 192.168.1.1 is actually assigned as the client’s DNS server.