OpenWrt路由器B作为WireGuard客户端仅TX正常无RX数据故障排查求助

阿华AIGC实验室

2026-4-21

问题背景

我遇到一个头疼的问题：OpenWrt系统的路由器B作为WireGuard客户端时，只有TX（发送）数据正常，完全收不到RX（接收）数据，连不上网。但同一个WireGuard服务器（部署在树莓派4上）在电脑和手机上用客户端连接都没问题，而且路由器B用Surfshark、NordVPN这类商业VPN客户端完全正常，就自家树莓派的WireGuard不行，百思不得其解...

网络拓扑

主路由A（TP-Link，IP 192.168.0.1）负责接入互联网
WireGuard服务器部署在树莓派4上，通过LAN连主路由A，静态IP 192.168.0.101
路由器B（OpenWrt，IP 192.168.2.1）是二级路由，LAN口连主路由A，获取IP 192.168.0.104，自身子网为 192.168.2.0/24

各设备配置详情

主路由A（TP-Link `192.168.0.1`）配置

已在端口转发中把UDP 51820端口映射到树莓派服务器的IP 192.168.0.101
手动添加了静态路由：目标网段 192.168.2.0/24，网关 192.168.0.104（不确定是不是必要操作）

树莓派WireGuard服务器配置（通过pivpn debug导出）

安装参数

=============================================
::::        Installation settings        ::::
PLAT=Raspbian
OSCN=bullseye
USING_UFW=0
pivpnforceipv6route=1
IPv4dev=eth0
IPv4addr=192.168.0.101/24
IPv4gw=192.168.0.1
install_user=xxx
install_home=/home/xxx
VPN=wireguard
pivpnPORT=51820
pivpnDNS1=9.9.9.9
pivpnDNS2=149.112.112.112
pivpnHOST=REDACTED
INPUT_CHAIN_EDITED=0
FORWARD_CHAIN_EDITED=0
INPUT_CHAIN_EDITEDv6=
FORWARD_CHAIN_EDITEDv6=
pivpnPROTO=udp
pivpnMTU=1420
pivpnDEV=wg0
pivpnNET=10.yyy.0
subnetClass=24
pivpnenableipv6=0
ALLOWED_IPS="0.0.0.0/0, ::0/0"
UNATTUPG=1
INSTALLED_PACKAGES=(dnsutils grepcidr bsdmainutils iptables-persistent wireguard-tools qrencode unattended-upgrades)
=============================================

服务器端wg0配置

[Interface]
PrivateKey = server_priv
Address = 10.yyy.1/24
MTU = 1420
ListenPort = 51820

### begin testClient ###
[Peer]
PublicKey = testClient_pub
PresharedKey = testClient_psk
AllowedIPs = 10.yyy.2/32
### end testClient###

客户端（路由器B使用的配置模板）

[Interface]
PrivateKey = testClient
Address = 10.yyy.2/24
DNS = 9.9.9.9, 149.112.112.112

[Peer]
PublicKey = server_pub
PresharedKey = testClient_psk
Endpoint = REDACTED:51820
AllowedIPs = 0.0.0.0/0, ::0/0

服务器自检结果

:: [OK] IP forwarding is enabled
:: [OK] Iptables MASQUERADE rule set
:: [OK] WireGuard is running
:: [OK] WireGuard is enabled
(it will automatically start on reboot)
:: [OK] WireGuard is listening on port 51820/udp

路由器B（OpenWrt `192.168.2.1`）配置

网络接口配置

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option packet_steering '1'
	option ula_prefix 'fde8:xxx3::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ipaddr '192.168.2.1'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

config interface 'wg0'
	option proto 'wireguard'
	list dns '9.9.9.9'
	list dns '149.112.112.112'
	option auto '0'
	option private_key '2xxxkI='
	list addresses '10.yyy.2/24'

config wireguard_wg0
	option description 'something'
	option route_allowed_ips '1'
	option endpoint_port '51820'
	list allowed_ips '0.0.0.0/0'
	list allowed_ips '::0/0'
	option endpoint_host '84.xxx.100'
	option public_key 'p7xxxTQ='