Good. Iām not an expert on Mqtt, but is the vpn working properly (handshakes and data transfer in general)? This will be the first thing to make sure is working.
Research a site-to-site setup.
Your openwrt router becomes an 'extension' of your VPS.
So you can connect to your VPS either with another wireguard client e.g. you phone on cellular or port forward from your VPS to your openwrt lan.
The Solar Assistant needs to have a known constant IP on your LAN. If you can't configure the appliance for static IP, you should still be able to give it a DHCP reservation in your home router.
When you have forwarded the whole house to the VPS then forwarding a port backward to the appliance starts with a DNAT rule inside the VPS. Implementing that will depend on the OS running there. If you're using symmetric routing (the VPS is aware of your home LAN and routes directly to it, which is recommended), you don't need to DNAT twice. But you do have to set your OpenWrt home router firewall so that vpn->lan is allowed for the IP and port of the appliance, if you're not allowing all vpn->lan by default.
This deployment will allow anyone on the Internet to hit the port on your Solar Assistant. I assume that is what you want, and it is not a security issue. If you want it for your use only you should do what @egc said and have authorized users make their own VPN connection to the VPS.
That is not what I meant and (I think also not what @mk24 meant)
I would first setup your WG client as a site-to-site setup:
Put the WG interface in the LAN zone so that you open up your firewall
Open the Firewall for the WG port (it is just as you are setting up a WG server).
On Allowed IPs of the client set the WG address of the VPS and the subnet of the VPS.
On Allowed IPs of the VPS for this client set the WG address and the subnet of the WG client (=your owrt router)
Basically you should now be able to reach clients on your home network when logged in to the VPS (and the other way around).
(I am doing it off the top of my head so I might have forgotten something)
The only thing you have to do is set a port forward on your VPS to your client on the home LAN as traffic from your VPS has a route to your home LAN.
[quote="egc, post:10, topic:173144"] On Allowed IPs of the VPS for this client set the WG address and the subnet of the WG client (=your owrt router)
[/quote]
The VPS WG server is 10.66.66.1
The Openwrt client is 10.66.66.2
10.66.66.2 is already in the Allowed IPs section of the VPS (WG Server)
You can simply delete the VPN zone and add the WG interface (wg0) to the LAN zone.
For opening port 51820 (/etc/config/firewall):
config rule 'wg'
option name 'Allow-WireGuard'
option src 'wan'
option dest_port '51820'
option proto 'udp'
option target 'ACCEPT'
In the WG interface setup make sure to specify 51820 as listen port.
In the WG client(Peer section) specify 10.66.66.0/24 and the subnet of the the VPS under allowed IPs, make sure to enable route allowed IPs
little explanation not important to read
(By using 10.66.66.0/24 instead of 10.66.66.1/32 I make sure that if you have more WG clients attaching to your VPS those can reach owrt router, alternatively and my preferred solution is using /24 as netmask for the wg address)
If it does not work, Please copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
