1.openwrt router talk to devices behind 2.openwrt router

Installing and Using OpenWrt Network and Wireless Configuration
1

Hey again

I'm currently playing with another second "openwrt-one" router since I had some trouble with it. I'm looking for other ways to access certain devices connected on the "openwrt-one" router.

The main "openwrt" router has a bunch of VLANs and the second "openwrt-one" is in the "VLAN 55".

How is it possible to reach the lan behind the "openwrt-one" router from the main "openwrt"?

MyDesktopDevice=192.168.50.141 (connected to the main router VLAN 50)

openwrt-one=192.168.55.129 (connected to the main router VLAN 55)

openwrt-third=192.168.1.213 (connected to the openwrt-one router VLAN 1 - this VLAN is only on the "openwrt-one" router)

Maybe that helps a bit:

diagram
diagram1360×629 43.2 KB

The connection from MyDesktopDevice to the "openwrt-one" router works already. I've GUI access to the openwrt-one router only for this IP=192.168.50.141 (MyDesktopDevice).

Now I wanna go one step further and reach the openwrt-third device. So basically 192.168.50.141 -> 192.168.1.213.

openwrt-one:

{
        "kernel": "6.12.87",
        "hostname": "OpenWrt-One",
        "system": "ARMv8 Processor rev 4",
        "model": "OpenWrt One",
        "board_name": "openwrt,one",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "25.12.4",
                "firmware_url": "https://downloads.openwrt.org/",
                "revision": "r32933-4ccb782af7",
                "target": "mediatek/filogic",
                "description": "OpenWrt 25.12.4 r32933-4ccb782af7",
                "builddate": "1778712129"
        }
}

network:

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        list ipaddr '127.0.0.1/8'

config globals 'globals'
        option dhcp_default_duid '00045b2a1d637abd4cc08d2d05a7bb8abdeb'
        option ula_prefix 'fddf:7ffc:ca64::/48'
        option packet_steering '1'

config interface 'wan'
        option device 'eth0'
        option proto 'dhcp'

config interface 'wan6'
        option device 'eth0'
        option proto 'dhcpv6'

config device
        option type 'bridge'
        option name 'VLANS'
        list ports 'eth1'

config bridge-vlan
        option device 'VLANS'
        option vlan '1'
        list ports 'eth1:t*'

config bridge-vlan
        option device 'VLANS'
        option vlan '5'
        list ports 'eth1:t'

config interface 'LAN'
        option proto 'static'
        option device 'VLANS.1'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option multipath 'off'

config interface 'checks'
        option proto 'static'
        option device 'VLANS.5'
        option ipaddr '192.168.5.1'
        option netmask '255.255.255.0'
        option multipath 'off'

config bridge-vlan
        option device 'VLANS'
        option vlan '8'
        list ports 'eth1:t'

config interface 'IoT'
        option proto 'static'
        option device 'VLANS.8'
        option ipaddr '192.168.8.1'
        option netmask '255.255.255.0'
        option multipath 'off'

firewall:

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'LAN'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'DROP'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'
        option enabled '1'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'
        option enabled '1'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'
        option enabled '1'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '1'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '1'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '1'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '1'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'
        option enabled '1'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'
        option enabled '1'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'Allow_GUI_on_WAN'
        list proto 'tcp'
        option src 'wan'
        option src_dport '443'
        option dest_ip '192.168.1.1'
        option dest_port '443'
        option src_ip '192.168.50.141'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'Allow_GUI_on_WAN(opnsense)'
        list proto 'tcp'
        option src 'wan'
        option src_dport '443'
        option dest_ip '192.168.1.1'
        option dest_port '443'
        option src_ip '192.168.50.132'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'Allow_SSH_on_WAN'
        list proto 'tcp'
        option src 'wan'
        option src_dport '38745'
        option dest_ip '192.168.1.1'
        option dest_port '38745'
        option src_ip '192.168.50.141'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'Allow_SSH_on_WAN(opnsense)'
        list proto 'tcp'
        option src 'wan'
        option src_dport '38745'
        option dest_ip '192.168.1.1'
        option dest_port '38745'
        option src_ip '192.168.50.132'

config zone
        option name 'checks'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'checks'

config forwarding
        option src 'checks'
        option dest 'wan'

config zone
        option name 'IoT'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'IoT'

config forwarding
        option src 'IoT'
        option dest 'wan'

Thanks!

2

There could be a few ways to accomplish this, but I think it is worth asking this:

  • Why do you have cascaded routers? What is the intent or goal of cascading routers instead of the preferred approach of setting all VLANs on the primary router (which then allows you to easily control all inter-vlan routing).
3

Learning is the first reason.

Also still not really sure what I want to keep separately or how I want to structure my network. I might even go back to use VLAN from the main router but this doesn't work at the moment either :smiley: as I mentioned in the other thread.

But I also like the idea, to have another firewall after the main router. I've also a pfsense device which I might put between the main router and the fibre box (ISP). But only for IDS/IPS. The main router or the openwrt-one box is too slow for that. Anyhow, just mucking around a bit to learn new things.

The third router should be seen such as a device. I use it on events and travel. The main router is in a cupboard and the other devices are in my office. So it's connected on the openwrt-one (actually on a switch) because it's just handy.

So yeah, just learning possibilities.

4

Ok... so the cascaded routers isn't exactly the route I'd recommend, but it can work.

The best way to accomplish your goal is to setup symmetric routing. That is:

  1. Add the appropriate routes to each of the upstream (relative) routers.
    a. On the main OpenWrt router, you'll add the following routes
    • 192.168.55.0/14 via 192.168.50.x where x is the address on the OpenWrt One's wan interface.
    • 192.168.1.0/24 via 192.168.50.x wherex is again the OpenWrt One wan address.
  • b. On the OpenWrt One, you'll add:
    • 192.168.1.0/24 via 192.168.55.y wherey is the OpenWrt-Third wan address.
  1. Disable masquerading on the wan firewall zone for the One and Third devices
  2. Set input to ACCEPT on the wan firewall zones for the One and Third devices.
  3. Optionally -- if you wish to access the networks behind the respective One and Third routers, add forward statements to allow wan > lan (or whatver their networks are named).

If you have any other subnets/VLANs on the One and Third devices, you'll need to add those routes, too.

And, for what it's worth, your use of VLANs here isn't really correct. I mean, functionally it seems to work, but what you're really doing is cascading the routers, so VLANs aren't actually necessary since (at least in the diagram) it seems to be a simple wan/lan for each router.

5

Why isn't that what you recommend?

What I see here, it messes up already the openwrt third. Which I don't want. Probably that is one of the reason? =)

6

Because it's much easier and cleaner to manage all the VLANs on the primary router.

It shouldn't, but yes, this is part of the reason I don't recommend your topology -- it makes it significantly more complex to administer. You need to set the routes properly on the 2 upstream OpenWrt routers in order for the 3rd router to work in this manner.

If you go with the recommended approach, you'll set all the VLANs on the primary router, then you can trunk them through to the additional devices and then all the inter-vlan routing (and firewalling) is handled at the top layer.

That being said, the OpenWrt One -- a 2-port device -- is not an ideal device for the 'middle' of the network topology insofar as you don't have extra ports to setup as access ports. The only real value it has in the middle is as a wifi AP. I'd argue that the One should be at the top of the topology, and then the others (which presumably have more ports) downstream so they can work as both AP and managed switches at the same time.

7

Unless you're -literally- dealing with campus-size networks, trying to meet the orthogonal requirements of different departments (and giving them limited autonomy for their subnets/ subdomains), the orthodox answer would be to keep things simple (K.I.S.S.). That means only one central router making policy decisions (routing, subnetting, VLANs, static DHCP leases, local DNS, etc. pp.), everything else should be dumbed down to mindlessly executing the policies set by the central router, in the sense of managed switches just being managed switches and distributing VLANs to access ports and AP just being bridged APs for multiple VLANs and BSSIDs. This makes things easier to manage, to keep secure (only one device needs to be audited with a fine comb) - and easy to change (e.g. subnet renumbering, it happens). Breakage (after config changes) usually remains confined to a single (now different) VLAN, easily found, easily fixed.

There are always reasons to divert from this pure concept (e.g. experimental lab networks, where you don't want to touch/ influence the 'normal' network), but those are typically 'obvious' in standing out.

8

also @slh
Thanks for the info! I'm actually going to go with your advices.

main openwrt router (VLANS (tagged) - hallway) -> switch (16 ports - VLANS (tagged) - hallway) -> switch (5 ports - VLANS (untagged) - office) -> openwrt one (own VLAN (untagged) - office)

As I mentioned, the third openwrt is used for traveling and such. So I'll easily plug that into the switch with 5 ports if I have to change something. At the moment, the switch is connected behind the openwrt one router.

I could use the openwrt one as a AP but I dont actually need it here. Every now and then I would like to check a device for certain things and there comes the openwrt one in place where I can us it in another secure network "away" from the main router.

9

Coming back to this particular device...The way I handle my travel routers (for config changes, updates, etc.) is quite a bit more simplistic... I connect the travel router's wan to my lan. Then I connect my computer to the travel router. This replicates the way I use it when actually traveling. There's really no need to complicate your main network config with special routing rules for a device that's not usually connected/used, and you also are best keeping the travel router's configuration a bit more simple, especially on the uplink/wan connection (this should be kept in a state that is secure -- typically just a single network interface on the wan port; firewall prohibiting input from upstream), and you'll also want to keep masquerading enabled on the wan firewall zone.

What exactly do you mean by "away from the main router" -- is this when you're travelling or just somewhere else in your own home?

Meanwhile... typically, VLANs are used (in a home context) to provide things like isolated guest/iot networks relative to your trusted lan, among other things. It's not really clear to me what your goals are with the VLANs. If this thread has reached a point where you're getting the connectivity you want, great. But if not, maybe it would make sense to define the objectives so that we're working towards that more deliberately.

10

So, I've two OpenWrt One routers. One is called openwrt-public (travelling/events) and the other one is openwrt-one to check some certain devices which I don't want to have on the main network at all.

OpenWrt - Public

Coming back to this particular device...

Yeah, this device is straightforward. And I will probably do it the same way as you mentioned. At the moment I have ssh and port 443 open on wan to change the configs but it's very likely that forget to close when I take it with me.

Since I use it for events and traveling, do you have any suggestions regarding firewall? This openwrt-public connects to a hotspoot on the phone. It's not possible to add a 5G module to an OpenWrt One device right?

OpenWrt - One

At the moment the openwrt-one is connected to VLAN55 (checks) on the main router. I'm still not sure how I'm going to use it though. I bought myself a docking station with another ethernet port which I'm using on my desktop to directly connect to that device now as well. So no need to muck around with the firewall, VLAN etc.

I still plan to set up an IDS/IPS between the Internet service provider and the main router. The main router would therefore use one port on the IDS/IPS router, and the openwrt-one router would use another port on the IDS/IPS router. This way, it would be even physically separated from each other.

It's not really clear to me what your goals are with the VLANs.

Hehe, yeah, it's not for me either :wink:

11

Yes, reset the device to defaults and use the standard/default firewall configuration. No changes are necessary.

You may consider changing the lan subnet (something obscure/pseudo-random) so that it is unlikely to conflict with the upstream networks in your traveling locations.

Also consider things like TravelMate and possibly VPN features. That's really all you need for your travel router.

In that case, take it out of the equation or use it on the side to generally learn OpenWrt.

Two separate devices (IDS/IPS on a unique device relative to your main router) is not necessary and it is much more complicated than doing it all on one device.

Depending on your internet service speed, you may need something with more horsepower -- IDS/IPS is quite processor intensive.

You should set specific goals and then work to implement those. You learn a lot more and end up with a useful configuration when you consider what you specifically need/want from your network.

12

Thanks for the hints! TravelMate comes maybe very handy.

In that case, take it out of the equation or use it on the side to generally learn OpenWrt.

Yep, that's what I'm doing. I think this part is done yet.

Two separate devices (IDS/IPS on a unique device relative to your main router) is not necessary and it is much more complicated than doing it all on one device.

Depending on your internet service speed, you may need something with more horsepower -- IDS/IPS is quite processor intensive.

That's why the other device with pfsense will be part of the network. My OpenWrt Main router is too slow for that. Shouldn't be that hard to have that in front just for IDS/IPS.

You should set specific goals and then work to implement those. You learn a lot more and end up with a useful configuration when you consider what you specifically need/want from your network.

That's true, but sometimes you learn more along the way. For example, I tried snort on the main router, but as I said, the router is too slow. Maybe I'll replace the main router with the pfSense router, but then I'll have to reconfigure everything on it.
Or how good is IDS/IPS (snort) on OpenWrt? I could install openwrt on this device instead of pfsense. I'm very happy with openwrt though. On pfsense I would use suricata.