Unable to Access Hubitat from WireGuard VPN

🛎️ Get Help
1

Hi I am trying to connect to my hun via the WireGuard VPN provided by my Firewalla Purple router.

I can ping the Hub but my browser will not open the page, I can access other IPs on my LAN such as my Shelly switch so I am confident my VPN is working okay.

Has anyone else come across this problem?

I am using a iPhone 15 with latest iOS and safari browser.

I realise I can use the dashboard for most things but it would be handy to be able to access the hub itself when I am away from home should there be any issues.

Thanks.

Hub = C5 and Hub Version = 2.3.6.146

2

What are you entering as the browser URL?

2 Likes
3

First thing I'd try in this situation is another browser. Maybe a caching issue?

4

This sounds similar to a problem I've been having. I have a remote site linked via Wireguard site to site VPN on Ubiquiti UDMs. I can view the web pages of some remote devices, but not all. All remote devices can be pinged, but no data is received. This includes a remote Hubitat hub. I have tried other types of VPN (IPSec, OpenVPN) makes no difference. I have also tried a server/client VPN - no difference. I have started to get the impression that it is something to do with MTU settings (I finally got data returned from my remote Synology NAS after reducing the MTU in the NAS settings). But the remote Hubitat and most remote cameras - no dice!

5

I don’t have any difficulty reaching my hub (or other devices on my LAN) when remotely connected to the wiregaurd server running on my UniFi UXG-Pro.

Sharing a screenshot of the wireguard tunnel configuration might be helpful as well.

6

I've got WG running on my ER12, and I have never had any problems connecting to my hub which is on my IoT VLAN on the ER via Ethernet. MTU settings can affect the hub, but typically if you're running Jumbo Frames w/their high MTU settings the hub will keep getting bumped off the network, but it doesn't sound like that's happending to you. In any case you will get best results w/standard 1500 MTU settings for routers/switches/APs that the hub is connected to.

7

Screenshot isn't showing, senor Knife. :slight_smile:

8

I am using Wireguard with Firewalla and am having no issues with the website typing in the numerical hub IP. If you are trying to use "hubitat.local" that is something that has never worked for me in a browser.

Also, if you are using the phone app, instead of using "Connect to Hub" on the tools page, you will want to use "Registered Hubs" and then click on the "Connect To Hub" button while on your VPN over cellular. This is also a good way to verify you are typing in the correct IP address as it is shown on that page.

*** Edited to add that I am on Firewalla Gold, not Purple

1 Like
9

Also, adding a silly question, are you trying to connect through VPN over cellular? Or WIfi? Because I have had issues when on a hotel Wifi where they had the same IP range as my home router and that created IP conflicts trying to access devices on my home router. This is why I carry my travel router now after I changed my IP range on my home router.... that was a pain with all my reservations and shortcuts.

1 Like
10

Sorry I meant if OP shares their wireguard tunnel settings as well as the URL they enter when trying to connect remotely :slightly_smiling_face:.

2 Likes
11

Hi All thanks for the quick replies.
Just to answer a few questions:

  1. I use the Hub IP address to try and connect to it.
  2. I'm trying over the cellular network.
  3. I have tried both Safari and Chrome, I get a message saying the connection was closed.

that information do need regarding the tunnel? Firwalla end or phone end?

12

I have a quick update on my issue. I have changed the MTU setting on my client to automatic and this has cured a problem I was having accessing my my DVR server via the app. The change to the MTU has fixed the access problem for this.
Unfortunately I still cannot access the Hubitat Hub.

13

I haven't read the earlier posts.... But found I could not access hubs via one method in the app due to what I expected was a DNS difference between the VPN compared to being on the local LAN. If I used a method that used IP addresses while I was on the VPN I could access the HE hub. Could this be the issue?

14

Both, I suppose?

I’ll go first (at @danabw’s request :wink:):

Server (UniFi UXG-Pro)

IMG_6665
IMG_66651179×2130 167 KB

Client (iPhone)

IMG_6666
IMG_66661179×2077 199 KB

1 Like
15

Here are mine that work with Firewalla. I am using the default automatic setup and the config files that Firewalla created for the clients.

Client

Screenshot_20231222_142043_WireGuard
Screenshot_20231222_142043_WireGuard983×943 102 KB

Server

Screenshot_20231222_141927_Firewalla
Screenshot_20231222_141927_Firewalla1435×884 117 KB

1 Like
16

Does this work from a laptop or another device?

Are you able to ping in the other direction using the ping tool on the hub (settings -> network settings, network test)?

What method do you use to connect to your DVR server? Is that also using a web browser?

Did your telecom provider configure a proxy server setting on your phone?

Are you able to access the hub using this device locally (wifi?) when not using wireguard?

Does the Firewalla device have an intrusion detection/prevention system that might be blocking this?

I'll add myself to the "It works for me" list, but I've got a Ubnt EdgeRouter instead.

17

Here are my settings:

Firewalla Router:

IMG_3347
IMG_33471179×2556 207 KB

My Phone Setup:

IMG_3348
IMG_33481179×2556 216 KB

18

Is your VPN and hubitat on the same subnet?

19

IIRC, the hub will block the IP subnet that you're using since it's not a private IP subnet.

2 Likes
20

Yes I can ping my phone from the hub.

Firewalla doesn't allow that as far as I know.

Could you explain please as I thought all 192. address are private?

Thanks