Hi,
I want to exclude my lan network from VPN, also I want to configure one more VPN and both VPN i want to use via wifi, VPN-1 for Wifi-1 and VPN-2 for WiFi-2. If this is possible, please suggest the configuration.
Thanks 
Remove the config for routes/rules you made here.
(It took a long thread to assist you, now it seems as you if you either no longer want the config, changed your mind, etc. - remember to be considerate of the time other others here.)
- Create it
(Also, you provide the purpose of these 2 additional VPNs.) 
- You want your WiFi to connect to another VPN company?
- Is this related to inbound remote access mentioned in your other thread?
(I ask - because I previously suggested it be done next so you're not confused.) 
- You would setup the routes/rules for them - just as you did for the first VPN you setup
- You provide no information
- Not yet possible - as VPN-1 and VPN-2 have not yet been created
Removed.
Created.
Not actually. Problem is I have another wrap plus connection with Cloudflare, also I have torrent client hosted on OpenWrt which has speed concern, I don't want VPN for Lan.
WiFi-1: I have connected home devices which will secure.
WiFI-2: Just for location change purpose. anonymous web surfing.
Required a sample, no idea
VPN-1 as wg0 and VPN as wg1 created as below
config interface 'wg0'
option proto 'wireguard'
option private_key 'U<private_key>='
list addresses '172.16.0.2/32'
config interface 'wg1'
option proto 'wireguard'
option private_key 'a<private_key>='
list addresses '10.2.0.2/32'
Can anybody provide me a tutorial according to my requirement?
- create multiple networks with different subnets and assign them all to a new firewall zone called vpn
- Create multiple ssids wifi-1, wifi-2 and attach the before created networks to it (each separately)
- Install policy based routing (pbr) and openvpn
- In openvpn setup 2 different vpns with 2 different tun interfaces (for example tun0 and tun1)
- Assign yor tun interfaces to your firewall zone vpn
- In pbr you can choose whatever port, ip or subnet you want over a specific interface
With pbr if you don’t want a vpn to be your default gateway you can just use the option:
list pull_filter 'ignore "redirect-gateway"'
Then all your traffic will default go over your wan and as i said you can specifically choose whatever port, ip or subnet you want over vpn via pbr
1 Like
Is openvpn is mandatory? i have already setup 2 VPNwith Wireguard and both are working fine
No you can also use wireguard
Thanks for your instruction but this is totally new to me, could you please share a guide so I can implement step by step.
- You really should use 1 thread for 1 issue
- See (the example uses 9.9.9.9):
Also, from your deleted post, I see you started using the PBR app and failed to otherwise mention that, so you'll need to translate my instructions to PBR-compatiable rules.
1 Like
Thanks for your reply @lleachii ,
I've checked your suggested link and tried to understand and apply this. for now I am still unable to use the my Wireguard VPN with any device using pbr, the current situation is below
Please suggest, what is missing
As I noted before and in other threads refrenceed, I don't use the PBR app (I make manual IP Routes and IP Rules). I'm completely unfamiliar with your screenshot and what it means.
Perhaps others can assist.
Had a quick look at your screenshot and your deleted configs and it looks like wan is your default gateway. So without any rules every traffic will go over wan which is probably what you want…
The first rule looks like you defined 192.168.1.2 as your dest address - should probably be source….
Did you have a look at the pbr docs?
What’s actually not working right now?
1 Like
Yes, default will be wan if no rules,
Currently i have 2 rules for testing, but according to rules i am not getting results. Trafic should be from vpn in this case.
Also i have removed below from vpn config
option route_allowed_ips '1'
If i apply this vpn is default, i want to use this by rules.
For now i have single IP range for all network, please suggest if i need to do modify it
Thanks a lot for your help 
I don’t know if it makes any difference but
option route_allowed_ips '1'
should be set to ‘0’ and not be removed… at least according to the pbr docs…
What do you mean exactly with that?
Are you sure your wg tunnels actually working properly? Did you verify that before starting to use pbr?
Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have
ubus call system board; \
uci export network; \
uci export dhcp; uci export firewall; uci export pbr; uci export wireless
1 Like
Yes, i have tested it, it's working as default connection, if i am using bellow
option route_allowed_ips '1'
Else wan is default
{
"kernel": "5.10.161",
"hostname": "OpenWrt",
"system": "MediaTek MT7621 ver:1 eco:3",
"model": "D-Link DIR-2640 A1",
"board_name": "dlink,dir-2640-a1",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "22.03.3",
"revision": "r20028-43d71ad93e",
"target": "ramips/mt7621",
"description": "OpenWrt 22.03.3 r20028-43d71ad93e"
}
}
Network:
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option packet_steering '1'
option ula_prefix '<ip_v6>/48'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option ipaddr '192.168.1.1'
config interface 'wan'
option device 'wan'
option proto 'dhcp'
config interface 'wan6'
option device 'wan'
option proto 'dhcpv6'
option reqaddress 'try'
option reqprefix 'auto'
config interface 'wg0'
option proto 'wireguard'
option private_key 'U<private_key>='
option peerdns '0'
list dns '1.1.1.1'
list addresses '<ip_v4>/32'
list addresses '<ip_v6>/128'
option force_link '1'
config interface 'wg1'
option proto 'wireguard'
option private_key 'a<private_key>='
list addresses '<ip>/32'
option peerdns '0'
list dns '1.1.1.1'
option force_link '1'
config wireguard_wg0
option description 'Cloudflare'
list allowed_ips '0.0.0.0/0'
list allowed_ips '::/0'
option endpoint_port '<port>'
option public_key 'b<public_key>='
option endpoint_host '<host_add>'
option route_allowed_ips '0'
config wireguard_wg1
option description 'Proton'
option public_key '+<public_key>='
list allowed_ips '0.0.0.0/1'
list allowed_ips '128.0.0.0/1'
option endpoint_host '<host_add>'
option endpoint_port '<port>'
option route_allowed_ips '0'
DHCP:
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
option confdir '/tmp/dnsmasq.d'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option ra 'server'
option dhcpv6 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
config host
option name 'real'
option dns '1'
option mac '<phone_mac_add>'
option ip '192.168.1.190'
config mac 'wg0'
option mac '<phone_mac_add>'
option networkid 'wg0'
list dhcp_option '6,8.8.8.8,8.8.4.4'
Firewall:
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
config rule
option name 'Allow-WG-Inbound'
option target 'ACCEPT'
option src '*'
option proto 'udp'
option dest_port '61820'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config include 'pbr'
option fw4_compatible '1'
option type 'script'
option path '/usr/share/pbr/pbr.firewall.include'
PBR:
config pbr 'config'
option verbosity '2'
option strict_enforcement '1'
option ipv6_enabled '0'
option boot_timeout '30'
option rule_create_option 'add'
option procd_reload_delay '1'
list webui_supported_protocol 'all'
list webui_supported_protocol 'tcp'
list webui_supported_protocol 'udp'
list webui_supported_protocol 'tcp udp'
list webui_supported_protocol 'icmp'
option enabled '1'
list ignored_interface 'vpnserver'
list ignored_interface 'wgserver'
option webui_show_ignore_target '0'
option resolver_set 'none'
config include
option path '/usr/share/pbr/pbr.user.aws'
option enabled '0'
config include
option path '/usr/share/pbr/pbr.user.netflix'
option enabled '0'
config policy
option name 'Plex/Emby Local Server'
option interface 'wan'
option src_port '8096 8920 32400'
option enabled '0'
config policy
option name 'Plex/Emby Remote Servers'
option interface 'wan'
option dest_addr 'plex.tv my.plexapp.com emby.media app.emby.media tv.emby.media'
option enabled '0'
config policy
option name 'default'
option dest_addr '192.168.1.2'
option interface 'wg0'
config policy
option name 'realmesk'
option src_addr '<phone_mac_add>'
option interface 'wg0'
Wireless:
config wifi-device 'radio0'
option type 'mac80211'
option path '1eXXXXXXXXXXXXXXXXX.0'
option channel '1'
option band '2g'
option htmode 'HT20'
option cell_density '0'
config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'Secure_24'
option encryption 'sae-mixed'
option key '<password>'
config wifi-device 'radio1'
option type 'mac80211'
option path '1eXXXXXXXXXXXXXXXXXXXXXX.0'
option channel '36'
option band '5g'
option htmode 'VHT80'
option cell_density '0'
option disabled '1'
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid 'Secure_5'
option encryption 'sae-mixed'
option key '<password>'
option disabled '1'
As I mentioned before change:
config policy
option name 'default'
option dest_addr '192.168.1.2'
option interface 'wg0'
to
config policy
option name 'default'
option src_addr '192.168.1.2'
option interface 'wg0'
and then try again...
Have you restarted the router since installing and setting up pbr?
Aslo... are you sure 192.168.1.2 is the right ip of the device you are testing your wg connection with pbr on? When looking at your dhcp config it appears that your dhcp range is from 100 – 150. So clearly the ip 192.168.1.2 is not managed by dhcp. You also don’t have a static lease configured for 192.168.1.2. This could mean you manually defined the ip on the client or the client is using a different ip…
1 Like
After apply this, No internet. as i can see no wg0 vpn handshake.
Yes, that's correct.
What is the output of
service pbr status
============================================================
pbr - environment
pbr 1.0.1-16 running on OpenWrt 22.03.3. WAN (IPv4): wan/wan/192.168.0.1.
============================================================
Dnsmasq version 2.86 Copyright (c) 2000-2021 Simon Kelley
Compile time options: IPv6 GNU-getopt no-DBus UBus no-i18n no-IDN DHCP no-DHCPv6 no-Lua TFTP no-conntrack no-ipset no-auth no-cryptohash no-DNSSEC no-ID loop-detect inotify dumpfile
============================================================
pbr chains - policies
chain pbr_forward {
}
chain pbr_input {
}
chain pbr_output {
}
chain pbr_prerouting {
ip saddr @pbr_wg0_4_src_ip_cfg066ff5 goto pbr_mark_0x020000 comment "default"
ether saddr @pbr_wg0_4_src_mac_cfg076ff5 goto pbr_mark_0x020000 comment "real"
}
chain pbr_postrouting {
}
============================================================
pbr chains - marking
chain pbr_mark_0x010000 {
counter packets 0 bytes 0 meta mark set meta mark & 0xff01ffff | 0x00010000
return
}
chain pbr_mark_0x020000 {
counter packets 198 bytes 22509 meta mark set meta mark & 0xff02ffff | 0x00020000
return
}
chain pbr_mark_0x030000 {
counter packets 0 bytes 0 meta mark set meta mark & 0xff03ffff | 0x00030000
return
}
============================================================
pbr nft sets
set pbr_wg0_4_src_ip_cfg066ff5 {
type ipv4_addr
flags interval
auto-merge
comment "default"
elements = { 192.168.1.2 }
}
set pbr_wg0_4_src_mac_cfg076ff5 {
type ether_addr
flags interval
auto-merge
comment "real"
elements = { <mac_add> }
}
============================================================
IPv4 table 256 route: default via 192.168.0.1 dev wan
IPv4 table 256 rule(s):
30000: from all fwmark 0x10000/0xff0000 lookup pbr_wan
IPv4 table 257 route: default via 172.16.0.2 dev wg0
IPv4 table 257 rule(s):
30001: from all fwmark 0x20000/0xff0000 lookup pbr_wg0
IPv4 table 258 route: default via 10.2.0.2 dev wg1
IPv4 table 258 rule(s):
30002: from all fwmark 0x30000/0xff0000 lookup pbr_wg1