Dumb AP mode but one LAN port to Wireguard tunnel

Installing and Using OpenWrt
1

This is kind of a very niche usecase.

I currently have a OpenWRT as dumb AP behind a ISP modem/router. On the OpenWRT, I have Wireguard client set up, now I'm trying to figure out how to make only one of the LAN ports uses the Wireguard tunnel, but all other stuff go through the normal ISP router.

I have created a new bridge devide br-lan_vpn, assgined lan4 to it and removed from the default br-lan, created a new firewall zone lan_vpn and assigned br-lan_vpn to that zone. lan_vpn zone have "accept" for input, output and forward.

Wireguard client interface is in its own firewall zone unsafegway, allowed br-lan_vpn to be forwarded to unsafegway, enabled masquerading.

Currently, curl http://ipinfo.io/json --interface br-lan_vpn is still failing, but curl http://ipinfo.io/json --interface unsafegateway is working as expected, so I'm still missing something.

/etc/config/network:

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdb7:33d7:725a::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'

config device
	option name 'lan1'
	option macaddr '<shhh>'

config device
	option name 'lan2'
	option macaddr '<shhh>'

config device
	option name 'lan3'
	option macaddr '<shhh>'

config device
	option name 'lan4'
	option macaddr '<shhh>'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.0.2'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option gateway '192.168.0.1'

config device
	option name 'wan'
	option macaddr '<shhh>'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

config interface 'vpn'
	option proto 'wireguard'
	option private_key '<shhh>'
	option listen_port '51820'
	list addresses '10.10.36.1/24'
	list addresses 'fdee:36::1/32'

config wireguard_vpn 'wgclient_2'
	option public_key '<shhh>'
	option preshared_key '<shhh>'
	list allowed_ips 'fdee:36::2/128'
	list allowed_ips '10.10.36.2/32'

config interface 'lan_vpn'
	option proto 'static'
	option device 'br-lan_vpn'
	option ipaddr '192.168.1.2'
	option netmask '255.255.255.0'
	option gateway '10.10.254.2'

config device
	option type 'bridge'
	option name 'br-lan_vpn'
	list ports 'lan4'
	option ipv6 '0'

config interface 'unsafegateway'
	option proto 'wireguard'
	option private_key '<shhh>'
	list addresses '10.10.254.2/24'
	list addresses 'fdef:2::1/32'

config wireguard_unsafegateway 'unsafegatewayserver'
	option public_key '<shhh>'
	option endpoint_host '<shhh>'
	option endpoint_port '51830'
	option persistent_keepalive '25'
	list allowed_ips '0.0.0.0/0'
	list allowed_ips '::/0'

/etc/config/firewall:

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'
	option flow_offloading '1'

config zone 'lan'
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone 'wan'
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'vpn'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'vpn'

config forwarding
	option src 'vpn'
	option dest 'lan'

config forwarding
	option src 'lan'
	option dest 'vpn'

config forwarding
	option src 'vpn'
	option dest 'wan'

config rule 'wg'
	option name 'Allow-WireGuard'
	option src 'wan'
	option dest_port '51820'
	option proto 'udp'
	option target 'ACCEPT'

config nat
	option name 'vpn to lan snat'
	list proto 'all'
	option src 'lan'
	option src_ip '10.10.36.0/24'
	option target 'SNAT'
	option snat_ip '192.168.0.2'

config zone
	option name 'lan_vpn'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan_vpn'
	list device 'br-lan_vpn'
	option family 'ipv4'

config zone
	option name 'unsafegway'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option masq6 '1'
	list network 'unsafegateway'

config forwarding
	option src 'lan_vpn'
	option dest 'unsafegway'

Note that there is also another Wireguard interface named vpn in there, that is working fine and not related to this topic, I have just included the irrelevant configs here so that if there's a conflict it's easier to find. The relevant interfaces/devices/zones are named br-lan_vpn / lan_vpn / unsafegway / unsafegateway and the likes.

2

I'm not entirely clear as to what your issue is, but we'll start with this:

I think that using the underscores _ could cause parsing issues. I'd recommend getting rid of those.

Next, remove the gateway from the network interface.

And you mentioned that the VPN will be used on port lan4, but you didn't say if it would also be connected to an SSID -- is that part of the goal here?

The above appears to be an inbound/'server' VPN configuration - is this still needed?

Obviously this is the 'client' wireguard config... is it working? What is the output of wg show?

If you want the routing to happen automatically here, you'll want to add route allowed_ips '1' to the peer section of the 'client' config.

Masquerading is needed on the lan since this is a dumb AP configuration, unless you have static routes enabled upstream.

These next two rules can be deleted because you're not using the wan interface/zone.

Since we enabled masquerading on the lan firewall zone, we shouldn't need this:

3

It is admittedly a little confusing. At first the device is configured as dumb AP with LuCI following this guide, the ISP router IP is 192.168.0.1, and the dumb AP is 192.168.0.2. Then, I followed this guide to set up a Wireguard server (subnet 10.10.36.0/24, interface vpn) with one client (wgclient_2). With that guide, the client is unable to access the Internet, so I added the SNAT rule vpn to lan snat. Up until this everything is working as expected and I intend to keep these.

After this, I added another Wireguard interface unsafegateway as Wireguard client, subnet 10.10.254.0/24, the server for this interface is a VPS, and it is working (tested with curl http://ipinfo.io/json --interface unsafegateway). The intention is to route some devices from interface lan through unsafegateway instead of the ISP router 192.168.0.1.

Yes, it is the next step after I figure how to forward the lan_vpn zone to use unsafegateway. So the ultimate goal is that lan4 and wireless clients connected to one of the SSID will have the external IP of unsafegatewayserver, all other clients will have the external IP of the ISP router. The plan is to assign lan4 and a SSID to the new firewall zone br-lan_vpn.

Won't enabling this make all clients go through the tunnel?

The ISP router is in the same subnet as all clients connected to the dumb AP, so no masquerading needed, since the clients can communicate with the ISP router without NAT, right?

I noted your remarks about underscores, I'll change them in my config, but for clarity's sake let's keep using the underscores in this thread.

4

All router clients. Those that are connecting to the wifi ssid that is part of the dumb ap will not be affected.

You will want policy based routing to prevent the wireguard server from being routed over the tunnel.

Masquerading is indeed not necessary for the dumb ap operation. However, it makes it possible for a different routed network to function. That said, it may not be necessary after all.