Gargoyle 1.15.x OpenWrt 24.10 - 2026-01-28

[fifonik]

Thanks.
I did not think I was crazy, but I was slightly frustrated as I know if dev unable to find/re-produce the issue -- it will never be fixed.
Now I have a hope.

[boldga]

If I recall correctly, guest Wi-Fi should not be able to connect to LAN hosts. However, after Flash the firmware in AX4200Q, when connected to guest Wi-Fi, it can connect to LAN hosts. Is this a bug?

Guest Network:
Enabled (2.4GHz Only)
Encryption:
WPA3/WPA2 SAE/PSK

Fast Roaming:
Disabled
Broadcast SSID:
Enabled
Wireless Client Isolation:
Enabled

wireguard enabled as server.

I have PM'd you a fix.
If I haven't heard back in a week I'll push it out anyway, but it would be great to get a verification, if you have the time and are able to assist.

Thank you

Thanks Lantis,
I'm currently on vacation and will test it next Monday.

[boldga]

If I recall correctly, guest Wi-Fi should not be able to connect to LAN hosts. However, after Flash the firmware in AX4200Q, when connected to guest Wi-Fi, it can connect to LAN hosts. Is this a bug?

Guest Network:
Enabled (2.4GHz Only)
Encryption:
WPA3/WPA2 SAE/PSK

Fast Roaming:
Disabled
Broadcast SSID:
Enabled
Wireless Client Isolation:
Enabled

wireguard enabled as server.

I have PM'd you a fix.
If I haven't heard back in a week I'll push it out anyway, but it would be great to get a verification, if you have the time and are able to assist.

Thank you

I found it partially works, but there still seem to be some bugs with wireguard.
Since I use WireGuard to connect two routers (192.168.1.1 and 192.168.8.1), if I connect to the guest Wi-Fi of the 192.168.1.1 router, it isolates me from 192.168.1.0/24 but allows access to 192.168.8.0/24. Conversely, connecting to the guest Wi-Fi of the router at 192.168.8.1 isolates me from 192.168.8.0/24 but permits access to 192.168.1.0/24.

[Lantis]

If I recall correctly, guest Wi-Fi should not be able to connect to LAN hosts. However, after Flash the firmware in AX4200Q, when connected to guest Wi-Fi, it can connect to LAN hosts. Is this a bug?

Guest Network:
Enabled (2.4GHz Only)
Encryption:
WPA3/WPA2 SAE/PSK

Fast Roaming:
Disabled
Broadcast SSID:
Enabled
Wireless Client Isolation:
Enabled

wireguard enabled as server.

I have PM'd you a fix.
If I haven't heard back in a week I'll push it out anyway, but it would be great to get a verification, if you have the time and are able to assist.

Thank you

I found it partially works, but there still seem to be some bugs with wireguard.
Since I use WireGuard to connect two routers (192.168.1.1 and 192.168.8.1), if I connect to the guest Wi-Fi of the 192.168.1.1 router, it isolates me from 192.168.1.0/24 but allows access to 192.168.8.0/24. Conversely, connecting to the guest Wi-Fi of the router at 192.168.8.1 isolates me from 192.168.8.0/24 but permits access to 192.168.1.0/24.

Ah got it!
Have a look here: https://github.com/lantis1008/gargoyle/ ... #L716-L719
If you add in lines 716-719 to your file that should fix that as well.
I did think those might still be required but convinced myself otherwise. WireGuard (and OpenVPN) are the exceptions.

[boldga]

I have PM'd you a fix.
If I haven't heard back in a week I'll push it out anyway, but it would be great to get a verification, if you have the time and are able to assist.

Thank you

I found it partially works, but there still seem to be some bugs with wireguard.
Since I use WireGuard to connect two routers (192.168.1.1 and 192.168.8.1), if I connect to the guest Wi-Fi of the 192.168.1.1 router, it isolates me from 192.168.1.0/24 but allows access to 192.168.8.0/24. Conversely, connecting to the guest Wi-Fi of the router at 192.168.8.1 isolates me from 192.168.8.0/24 but permits access to 192.168.1.0/24.

Ah got it!
Have a look here: https://github.com/lantis1008/gargoyle/ ... #L716-L719
If you add in lines 716-719 to your file that should fix that as well.
I did think those might still be required but convinced myself otherwise. WireGuard (and OpenVPN) are the exceptions.

Thanks Lantis!

Another question. I noticed that when I restarted the firewall in one of my routers, which I set some restrictions by MAC addresses, it displayed the following prompt:

/usr/lib/gargoyle/restart_firewall.sh
nft add rule inet fw4 egress_restrictions meta l4proto tcp ether saddr {some MAC addresses here} reject with tcp reset
nft add rule inet fw4 egress_restrictions ether saddr {some MAC addresses here} reject
Error: There is no such init script like 'miniupnpd'.

Is this an error?