This is the router:
ubus call system board
{
"kernel": "6.6.73",
"hostname": "OpenWrt",
"system": "ARMv8 Processor rev 3",
"model": "Raspberry Pi 4 Model B Rev 1.1",
"board_name": "raspberrypi,4-model-b",
"rootfs_type": "ext4",
"release": {
"distribution": "OpenWrt",
"version": "24.10.0",
"revision": "r28427-6df0e3d02a",
"target": "bcm27xx/bcm2711",
"description": "OpenWrt 24.10.0 r28427-6df0e3d02a",
"builddate": "1738624177"
/etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.10.1'
option netmask '255.255.255.0'
option ip6assign '60'
option ipv6 '0'
option delegate '0'
list dns '10.2.0.1'
config interface 'WAN'
option proto 'dhcp'
option device 'eth1'
option peerdns '0'
list dns '10.64.0.1'
option ipv6 '0'
config interface 'wg0'
option proto 'wireguard'
option private_key '****'
list addresses '**/32'
list dns '***'
option auto '0'
config wireguard_wg0
option description 'Imported peer configuration'
option public_key '***'
list allowed_ips '0.0.0.0/0'
option endpoint_host '***'
option endpoint_port '51820'
option route_allowed_ips '1'
config interface 'wg1'
option proto 'wireguard'
option private_key '***'
list addresses ''***'/32'
list dns ''***''
option mtu '1400'
config wireguard_wg1
option description 'Imported peer configuration'
option public_key ''***''
list allowed_ips '0.0.0.0/0'
option endpoint_host ''***''
option endpoint_port '51820'
option route_allowed_ips '1'
config interface 'wg2'
option proto 'wireguard'
option private_key ''***''
list addresses ''***'/32'
list dns ''***''
option disabled '1'
option auto '0'
config wireguard_wg2
option description 'Imported peer configuration'
option public_key ''***''
list allowed_ips '0.0.0.0/0'
option endpoint_host ''***''
option endpoint_port '51820'
option route_allowed_ips '1'
config interface 'wg3'
option proto 'wireguard'
option private_key ''***''
list addresses ''***'/32'
list dns ''***''
option delegate '0'
config wireguard_wg3
option description 'Imported peer configuration'
option public_key ''***''
list allowed_ips '0.0.0.0/0'
option endpoint_host ''***''
option endpoint_port '51820'
config route
option interface 'WAN'
option target '***'
option netmask '255.255.255.255'
config route
option interface 'WAN'
option target '***'
option netmask '255.255.255.255'
config route
option interface 'WAN'
option target '***/32'
(side question: I didn't create all these routes, did the system create them?
/etc/config/wireless
config wifi-device 'radio0'
option type 'mac80211'
option path 'platform/soc/fe300000.mmcnr/mmc_host/mmc1/mmc1:0001/mmc1:0001:1'
option band '5g'
option channel 'auto'
option htmode 'VHT80'
option cell_density '0'
option disabled '1'
config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'asdf_nomap'
option encryption 'psk2'
option hidden '1'
option key 'asdfasdf'
option disabled '1'
config wifi-iface 'wifinet1'
option device 'radio0'
option mode 'sta'
option ssid 'Wl-pxtk'
option encryption 'psk2'
option key 'asdfasdf'
option disabled '1'
cat /etc/config/dhcp
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option localservice '1'
option ednspacket_max '1232'
option logfacility '/tmp/dnsmasq.log'
option quietdhcp '1'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
config host
option name 'switch'
list mac '***'
option ip '192.168.10.9'
option leasetime 'infinite'
list match_tag 'known'
/etc/config/firewall
config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
option flow_offloading '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
option log '1'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
list network 'WAN'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config zone
option name 'vpn'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wg0'
list network 'wg1'
list network 'wg2'
list network 'wg3'
config forwarding
option src 'lan'
option dest 'vpn'
config zone
option name 'lan2'
option input 'REJECT'
option output 'ACCEPT'
option forward 'ACCEPT'
config forwarding
option src 'lan2'
option dest 'wan'
config rule
option name 'TPLink-Switch-to-VPN'
option src 'lan'
list src_ip '192.168.10.206'
list src_ip '192.168.10.9'
option dest 'vpn'
option target 'REJECT'
config rule
option name 'TPLink-Switch-to-WAN'
option src 'lan'
list src_ip '192.168.10.206'
list src_ip '192.168.10.9'
option dest 'wan'
option target 'REJECT'