Configuring as access point, openvpn and guestmode

[earth08]

I have successfully fully installed miwifi nahi on my miwifi 3c router as there is no firmware available for it.
I would like to see my openwrt miwi 3c as below

1. as access point/repeater which is connected to my main router with wire.
2. guest wifi
   3.installing and using vpn/openvpn for guest wifi
3. control connections like to block, limit over different connection connected through this device.

Please someone guide,
Thanks

[trendy]

Do I understand correctly that you have flashed your router with a third party firmware, not official OpenWrt?

[earth08]

I have flashed miwifi nano with breed bootloader and flashed openwrt available for miwifi nano.

[trendy]

For 1 and 2 the guest guide on a dumbAP.
For OpenVPN follow the guide to connect to some VPN.
With that configuration, guest hosts will use VPN connection and lan hosts will use the ISP.
If you want further control of which connection to use, you can setup VPN PBR.

[earth08]

Thanks for your reply,
I have to firstly set my router to wired connected repeater mode

[earth08]

I have made through it,
Now if I want to limit speed for some connections on openvpn and lan, how should I do.
Right now I have 2 wifi one connected to lan and another to guest which is connected to openvpn

Please guide.
Thanks

[trendy]

You can either go for SQM which takes care of the underlying issue of buffebloat when a link is saturated, or do micromanagement on the bandwidth allocated to each device with luci-app-nft-qos

[earth08]

i have install sqm,
one thing
i cannot connect to AdGuardHome DNS connected to second router from my main router connected device, which makes my ssid from 1st router with dns to device attached to second router doesnt connect to internet

one more thing, as i have stated earlier i have installed miwifi nano snap 19.072 on my miwifi 3c.

Support for Xiaomi MiWiFi 3C

one problem is, it works slow on openwrt device as compared to stock, and padavan. I am using it as wire connected repeater. one more problem dont know, it might be because of interchanged wan lan or my settings, I cant connect to my devices connected to second router ( repeater- miwifi 3c -openwrt installed).

I have my config as
firewall

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'
        option network 'lan'
        list device 'tun0'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        option network 'wan wan6'
        list device 'tun0'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config include
        option path '/etc/firewall.user'

config zone
        option network 'guest'
        option forward 'REJECT'
        option name 'guest'
        option output 'ACCEPT'
        option input 'REJECT'
        list device 'tun0'
        option log '1'

config rule
        option name 'Diable Guest LAN Access'
        option dest 'lan'
        option dest_ip '192.168.11.0/24'
        option target 'DROP'
        option proto 'all'
        option src 'guest'

config rule
        option dest_port '67-68'
        option src 'guest'
        option name 'Guest DHCP'
        option target 'ACCEPT'
        option proto 'udp'

config rule
        option dest_port '53'
        option src 'guest'
        option name 'Guest DNS'
        option target 'ACCEPT'
        option proto 'tcp udp'

config forwarding
        option dest 'lan'
        option src 'guest'

/etc/config/network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd0f:6435:080b::/48'

config interface 'lan'
        option type 'bridge'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option delegate '0'
        option ipaddr '192.168.11.3'
        option gateway '192.168.11.1'
        list dns '192.168.11.1'
        option ifname 'eth0.1 eth0.2'

config device 'lan_eth0_1_dev'
        option name 'eth0.1'
        option macaddr 'f6:7c:94:98:78:22'

config interface 'wan'
        option ifname 'eth0.2'
        option proto 'dhcp'

config device 'wan_eth0_2_dev'
        option name 'eth0.2'
        option macaddr 'f6:7c:94:98:78:23'

config interface 'wan6'
        option ifname 'eth0.2'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0 2 4 6t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '1 6t'

config switch_vlan
        option device 'switch0'
        option vlan '3'
        option ports '3 6t'

config switch_vlan
        option device 'switch0'
        option ports '6t'
        option vlan '4'

config interface 'guest'
        option proto 'static'
        option netmask '255.255.255.0'
        option delegate '0'
        option ipaddr '192.168.2.1'

config interface 'tun0'
        option ifname 'tun0'
        option proto 'none'

/etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'

config dhcp 'lan'
        option interface 'lan'
        option ignore '1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'guest'
        option start '100'
        option interface 'guest'
        option limit '25'
        option leasetime '12h'

/etc/config/sqm

config queue 'eth1'
        option qdisc_advanced '0'
        option linklayer 'none'
        option download '45000'
        option upload '45000'
        option debug_logging '0'
        option verbosity '5'
        option qdisc 'cake'
        option script 'piece_of_cake.qos'
        option enabled '1'
        option interface 'br-lan'

can u please guide,
thanks