Help with creating a dual-WiFi VPN and no VPN solution

Installing and Using OpenWrt Network and Wireless Configuration
1

Hey all! I'm somewhat experienced, but no means a power user, and found myself struggling to achieve a set-up using the latest OpenWRT (25.12.4) on a modern, sufficiently powerful and fully supported router.

In short, I'm looking to set up two separate Wi-Fi networks on the same router, one of which routes directly via the ISP, and another one that routes via a VPN through the router itself (the router acts as a VPN client for a VPN provider, basically, forwarding its VPN connection via the designated Wi-Fi network to Wi-Fi clients that connect to it).

The following things are necessary for this, beyond the obvious stuff:

  • The router's VPN connection must be fully "autostart" (turns on by itself after router start/reboot without any specific user action)
  • The VPN connection must be obfuscated with v2ray (VPN provider supported, and unobfuscated WG VPN connections do not work in my network environment)
  • The VPN connection must have a "killswitch", stopping all traffic if the VPN connection dies or is otherwise inactive for any reason
  • The two Wi-Fi networks, one clear and one with the VPN, must co-exist peacefully
  • The VPN connection must not interfere with any traffic not on that designated Wi-Fi network in any way

I tried setting this up, including with PBR and stuff like that per other posts on this forum, but ran into plenty of different issues I'm not entirely sure how to solve. On several occasions I got the two Wi-Fi networks set up and operating simultaneously, but I couldn't figure out how to only have one of them routing through the VPN connection.

What I'm looking for here from someone gracious enough is a clear, step-by-step guide ("for dummies" style heh) on how to achieve this kind of setup. I have everything I need from the VPN provider, including WG keys and such; it's actually making it all work together that is the problem. Ideally your solution should not require PBR, as I've found it to be weirdly unreliable for unknown reasons in some aspects, but if that's the only way then I'll make do with it.

I'll be sure to reply quickly in case there are any questions, too. Thank you!

2

For the extra wifi use this:

Cannot help you with v2ray

For PBR you can use the PBR app: https://docs.openwrt.melmac.ca/pbr/1.2.2/
Or do it Manually:
https://openwrt.org/docs/guide-user/network/routing/pbr_netifd
Or see:
OpenWRT Policy Based Routing (PBR)

3

This is probably what you need. You can configure interfaces, but I guess you want to route some sites/ip directly and some of them on via vpn

4

Not exactly; to be clear, my desired solution is to have two Wi-Fi networks, one of which routes everything directly, and the other one routes everything via the VPN. I'm not looking for any kind of "split tunnel" system, I just need two Wi-Fi networks where one acts as a VPN forwarder and the other one doesn't, that's it

5

You mean the normal kmod-wireguard/ luci-proto-wireguard ?

6

For your exact goal I’d keep it as interface-based routing, not site/IP based split tunneling: make a separate guest-style interface/firewall zone for the VPN SSID, then add one PBR rule matching that source subnet to the VPN interface. For the kill switch, don’t allow that zone to forward to wan at all; only to the VPN zone/interface. I’d get the v2ray/WG side stable first, then add PBR, because debugging both at once gets messy fast.

7

I think PBR is still the cleanest way, but only for one very simple rule: source = the VPN Wi-Fi subnet, output = the VPN tunnel. The part that makes it a real kill switch is the firewall, not PBR: put that SSID in its own zone and do not allow it to forward to wan, only to the VPN/tunnel zone. Then test with the VPN stopped before adding v2ray, so you know the “VPN Wi-Fi” clients fail closed instead of falling back to the ISP.