Access of a VPN client to exactly one IP address in a second LAN

[iplaywithtoys]

@hz123

option dest 'lan2'

You don't appear to have a lan2 zone defined in your firewall configuration.

@hz123

option dest_ip '192.168.12.100'

In addition, you don't appear to have the subnet 192.168.12.0/24 represented in your network configuration.

[mk24]

@hz123

Both networks are physically connected with eth0.

That does not segregate the networks and there is no security. You need to use separate ports, or VLANs on the same port "trunked" to a managed switch to direct the two networks to their separate devices.

The configuration you posted is even further broken as the router won't be able to route anything from the VPN to the .12 network because you have not assigned a .12 IP in any router interface. The router doesn't even know there are devices with .12 IPs.

[hz123]

Yes. This are my problems.
Hou have I to define the lan2 zone if I have only one physikal interface?
I dont know too how have I to define the subnet without a seckond internal lan interface. After my trys I nedded ma backup.
What can I take from your example above? I see there are two internal LAN adapters planned. I only have one.

[iplaywithtoys]

@hz123

how have I to define the subnet without a seckond internal lan interface.

Using VLANs.

VLAN (Virtual LAN)

[hz123]

Do I need a second device, a managed switch, or can I do this with the configuration in the openWRT router?

[iplaywithtoys]

Here's another example diagram using two VLAN subinterfaces for the LAN segments:

[iplaywithtoys]

If the router has only two Ethernet sockets (one for WAN, one for LAN) then, in addition to the router, you'll also need a switch which is capable of VLAN segregation. A bog-standard unmanaged switch won't cut it. Alternately, several routers are available with multiple Ethernet sockets, built-in switches, and are supported by OpenWRT.

Fortunately, just this very afternoon someone resurrected an old thread in which several choices of VLAN-capable switch are discussed:

HOWTO: EdgeRouter X (ERX) as managed DSA switch for a router-on-a-stick

Documenting my adventures with EdgeRouter X (ERX), which was originally used as the main router on my home network, but ended up being a managed switch for a "router-on-a-stick" Mini-PC. Both the Mini-PC router and the ERX run under OpenWrt. The original problem I had with my ERX is that it was often freezing while running under OpenWrt 19.07.0x, which seems to be a common issue with ERX. I did try troubleshooting it but to no avail. I then repurposed a spare x86 Mini PC as a "router-on-a-stic…

[iplaywithtoys]

On further reflection, a bog-standard unmanaged switch might be suitable, if you don't care about security between LAN1 and LAN2 and if the unmanaged switch doesn't mangle any VLAN tags. If all you care about is layer 3 routing, but not isolating the layer 2 detail, you might be able to achieve your objective.

However, I would not recommend this approach, on the assumption that you want discrete subnets for a reason. I further assume that the reason is security, especially given your original question about controlling access for certain hosts.

[hz123]

Thanks. I think I understand. The security between the LAN networks is important to me. Now I have bought a Fritzbox 7362SL. It has 4 LAN ports. Thanks for the support.