VPN tunnel using pivpn on a raspberry pi4B doesn't work

[y0ur5h4d0w]

hey guys, i'm currently trying to make a vpn tunnel using wireguard as server/client to connect my laptop when i'm not at home to control my main PC, i've followed 5 different guides on youtube on how to setup the raspberry pi as a VPN using wireguard but still i can't connect anything to the pivpn and i don't understand why. this is what i have/have done:

 

- installed pivpn on my PI 

- set a DNS pointing to my public ip address to a domain name (somethingsomething.domain.com)

- set the DNS on pivpn

- set the raspberry pi IP to a static one on my router

- set the DNS using google ones during install

- opened the port of my router (51820 which is the default for wireguard)

- created the user for my laptop

- connected wireguard on my laptop (kali linux) using the output .conf file as configuration file for wg0.conf

- created the user for my phone

- installed wireguard on my phone

- connected my phone with the QR code output from the pivpn terminal

 

i've tried even to reconfigure pivpn to use my public ip address to avoid issues with the DNS but looks like it wasn't the issue

 

the result is:

- i can't connect anything to the pi

- i can't ping anything to the pi

- i don't understand what's the issue

- i'd love to check some logs but i don't know how to.......

 

the most recent video i followed was from 8 months ago, i don't think it's outdated (?) do you guys have any other way to setup a VPN with even other software and always using the raspberry or even some other ideas i can try even if the raspberry is not involved


this is the ouput of pivpn -d (which shows the debug

 

::: Generating Debug Output
::::        PiVPN debug         ::::
=============================================
::::        Latest commit         ::::
Branch: master
Commit: a85d3752ef94ed1aaad70ba6d483f93583152eca
Author: Orazio
Date: Wed Dec 13 18:09:55 2023 +0100
Summary: fix(scripts): disallow using server's name as client name (#1791)
=============================================
::::        Installation settings         ::::
PLAT=Raspbian
OSCN=bookworm
USING_UFW=0
pivpnforceipv6route=1
IPv4dev=eth0
dhcpReserv=1
IPv4addr=192.168.1.30/24
IPv4gw=192.168.1.1
install_user=y0ur5h4d0wpi
install_home=/home/y0ur5h4d0wpi
VPN=wireguard
pivpnPORT=51820
pivpnDNS1=8.8.8.8
pivpnDNS2=8.8.4.4
pivpnHOST=REDACTED
INPUT_CHAIN_EDITED=0
FORWARD_CHAIN_EDITED=0
INPUT_CHAIN_EDITEDv6=
FORWARD_CHAIN_EDITEDv6=
pivpnPROTO=udp
pivpnMTU=1420
pivpnDEV=wg0
pivpnNET=10.52.114.0
subnetClass=24
pivpnenableipv6=0
ALLOWED_IPS="0.0.0.0/0, ::0/0"
UNATTUPG=1
INSTALLED_PACKAGES=()
=============================================
::::  Server configuration shown below   ::::
[Interface]
PrivateKey = server_priv
Address = 10.52.114.1/24
MTU = 1420
ListenPort = 51820
### begin ShadowDragon ###
[Peer]
PublicKey = ShadowDragon_pub
PresharedKey = ShadowDragon_psk
AllowedIPs = 10.52.114.2/32
### end ShadowDragon ###
=============================================
::::  Client configuration shown below   ::::
[Interface]
PrivateKey = ShadowDragon_priv
Address = 10.52.114.2/24
DNS = 8.8.8.8, 8.8.4.4

[Peer]
PublicKey = server_pub
PresharedKey = ShadowDragon_psk
Endpoint = REDACTED:51820
AllowedIPs = 0.0.0.0/0, ::0/0
=============================================
::::     Recursive list of files in     ::::
::::    /etc/wireguard shown below     ::::
/etc/wireguard:
configs
keys
wg0.conf

/etc/wireguard/configs:
clients.txt
ShadowDragon.conf

/etc/wireguard/keys:
server_priv
server_pub
ShadowDragon_priv
ShadowDragon_psk
ShadowDragon_pub
=============================================
::::        Self check         ::::
:: [OK] IP forwarding is enabled
:: [OK] Iptables MASQUERADE rule set
:: [OK] WireGuard is running
:: [OK] WireGuard is enabled 
(it will automatically start on reboot)
:: [OK] WireGuard is listening on port 51820/udp
=============================================
:::: Having trouble connecting? Take a look at the FAQ:
:::: https://docs.pivpn.io/faq
=============================================
:::: WARNING: This script should have automatically masked sensitive       ::::
:::: information, however, still make sure that PrivateKey, PublicKey      ::::
:::: and PresharedKey are masked before reporting an issue. An example key ::::
:::: that you should NOT see in this log looks like this:                  ::::
:::: YIAoJVsdIeyvXfGGDDadHh6AxsMRymZTnnzZoAb9cxRe                          ::::
=============================================
::::        Debug complete         ::::
::: 
::: Debug output completed above.
::: Copy saved to /tmp/debug.log
::: 
 

[AbydosOne]

2 minutes ago, y0ur5h4d0w said:

opened the port of my router (51820 which is the default for wireguard)

Did you "open" the port, or did you "forward" the port to the specific IP of your RasPi? You need to do the latter in order for traffic to pass from outside network to inside device.

[y0ur5h4d0w]

1 minute ago, AbydosOne said:

Did you "open" the port, or did you "forward" the port to the specific IP of your RasPi? You need to do the latter in order for traffic to pass from outside network to inside device.

in my router i have "port mapping" so i guess it's more a port forwarding :think

i can use "port mapping" or "port triggering" from what i found on google port mapping is what i should have used

[AbydosOne]

1 minute ago, y0ur5h4d0w said:

in my router i have "port mapping" so i guess it's more a port forwarding :think

i can use "port mapping" or "port triggering" from what i found on google port mapping is what i should have used

Is your "public IP" globally unique or does your ISP have another router above you? (i.e. double NAT) Does your routers WAN IP address match your public IP?

[y0ur5h4d0w]

1 minute ago, AbydosOne said:

Is your "public IP" globally unique or does your ISP have another router above you? (i.e. double NAT) Does your routers WAN IP address match your public IP?

i've just noticed that i had the port mapped for TCP and not UDP... the whole day of formatting the PI and reconfiguring everything from scratched multiple times probably killed my brain, at least it works now, checking if "port mapping" was the right term made me notice the issue ^^" 

what worked in the end is:

settings the public IP and not the DNS
mapping the port as UDP

[AbydosOne]

5 minutes ago, y0ur5h4d0w said:

mapping the port as UDP

Yeah, usually I will map both (Unifi has the option for both) for any given port to simplify matters.