How do I allow Router 2 to connect to the server hosted in Router 1?

Hello,

I had been trying to figure out if there is a way to achieve this without using a bridge, while making sure both routers use their own dhcp server, aren't making anything available to the internet, and while being on a separate subnet. I am trying to make it so I can access the syncthing and pihole admin interfaces while being connected to router 2 and viceversa.

Is this possible?

Router 2 is an openwrt router that I can carry anywhere tunnels all traffic through my wireguard vpn. It is directly connected to my computer and provides a wireless signal to my mobile device. It's also directly connected to a raspberry pi. Router 2's subnet is 192.168.2.1
Router 1 is also an openwrt router that doesn't have a vpn installed. It's located at home and it's directly connected to a raspberry pi. It broadcasts a wireless signal for many devices to connect to, with one of them being router 2. Router 1's subnet is 192.168.1.1
Router 2 is wirelessly connected to router 1. It's not possible to use a wire to connect it to router 1

I had made this image to more clearly show what I am trying to do and what my network looks like.


The red lines show the kind of connections I want to make. I want my phone on router 2 to have access to the server on my other network.

Here's the configuration files for router 2.
/etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'CF:5C:26:D2::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth1.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.2.1'
        list dns '192.168.2.15'
        list dns '192.168.1.96'

config interface 'wan'
        option device 'eth0.2'
        option proto 'dhcp'

config interface 'wan6'
        option device 'eth0.2'
        option proto 'dhcpv6'
        option auto '0'
        option reqaddress 'try'
        option reqprefix 'auto'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '2 3 4 5 0t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '1 6t'

config interface 'wgclient'
        option proto 'wireguard'
        option private_key 'Ca5rzz5zUoj'
        list addresses '100.120.156.107/32'
        list dns '192.168.2.15'
        list dns '192.168.1.96'

config wireguard_wgclient
        option public_key 'APBj9Ukk3Y'
        option preshared_key 'CLHkKo2RIt'
        option endpoint_host 'www.random.org'
        option endpoint_port '1194'
        option route_allowed_ips '1'
        option description 'Alaska'
        list allowed_ips '0.0.0.0/0'
        list allowed_ips '::/0'
        option persistent_keepalive '25'

/etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option output 'ACCEPT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'
        list network 'wwan'
        option input 'REJECT'
        option forward 'REJECT'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'wgclient'
        option output 'ACCEPT'
        option masq '1'
        list network 'wgclient'
        option input 'REJECT'
        option forward 'REJECT'

config forwarding
        option src 'lan'
        option dest 'wgclient'

config redirect 'dns_int'
        option src 'lan'
        option src_dport '53'
        option proto 'tcp udp'
        option target 'DNAT'
        option family 'any'
        option src_mac '!58:34:3C:8A:B3:34'
        option name 'Redirect-DNS'
        option src_ip '!192.168.2.15'
        option dest_ip '192.168.2.15'

config ipset 'doh'
        option name 'doh'
        option family 'ipv4'
        option match 'net'
        option loadfile '/var/ipset-doh'

config rule 'doh_fwd'
        option name 'Deny-DoH'
        option src 'lan'
        option dest 'wan'
        option dest_port '443'
        option proto 'tcp udp'
        option family 'ipv4'
        option ipset 'doh dest'
        option target 'REJECT'

config ipset 'doh6'
        option name 'doh6'
        option family 'ipv6'
        option match 'net'
        option loadfile '/var/ipset-doh6'

config rule 'doh6_fwd'
        option name 'Deny-DoH'
        option src 'lan'
        option dest 'wan'
        option dest_port '443'
        option proto 'tcp udp'
        option family 'ipv6'
        option ipset 'doh6 dest'
        option target 'REJECT'

config rule 'dot_fwd'
        option name 'Deny-DoT'
        option src 'lan'
        option dest 'wan'
        option dest_port '853'
        option proto 'tcp udp'
        option target 'REJECT'

config nat 'dns_masq'
        option name 'Masquerade-DNS'
        option src 'lan'
        option dest_ip '192.168.2.15'
        option dest_port '53'
        option proto 'tcp udp'
        option target 'MASQUERADE'

/etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'
        list server '192.168.2.15'
        list server '192.168.1.96'
        list server '192.168.2.16'
        option strictorder '1'

config dhcp 'lan'
        option interface 'lan'
        option dhcpv4 'server'
        option start '0'
        option limit '20'
        option leasetime '6h'
        list dhcp_option '6,192.168.2.15,192.168.1.96,192.168.2.16'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

Router 1 partial configuration files
/etc/config/network

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        list dns '192.168.1.96'
        list dns '192.168.2.16'

config interface 'wwan'
        option proto 'dhcp'
        option peerdns '0'
        list dns '192.168.1.96'

/etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option synflood_protect '1'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'
        list network 'wwan'

config forwarding
        option src 'lan'
        option dest 'wan'


config redirect 'dns_int'
        option src 'lan'
        option src_dport '53'
        option proto 'tcp udp'
        option target 'DNAT'
        option family 'any'
        option name 'Redirect-DNS1'
        option src_ip '!192.168.1.96'
        option dest_ip '192.168.1.96'
        list src_mac '!00:E0:4C:36:00:61'
        option dest 'lan'
        option dest_port '53'

config nat 'dns_masq'
        option name 'Masquerade-DNS1'
        option src 'lan'
        option dest_ip '192.168.1.96'
        option dest_port '53'
        option proto 'tcp udp'
        option target 'MASQUERADE'
        option src_ip '192.168.1.1/24'

/etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'
        list server '192.168.1.96'

config dhcp 'lan'
        option interface 'lan'
        option leasetime '12h'
        option dhcpv4 'server'
        option start '0'
        option limit '99'
        list dhcp_option '6,192.168.1.96'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config host
        option name 'Server1'
        option dns '1'
        option mac '00:00:00:00'
        option ip '192.168.1.96'

config host
        option dns '1'
        option mac '00:00:00:00'
        option ip '192.168.1.64'
        option name 'Router2'

This might be totally wrong, but couldn't you just connect router2 via wifi to router1 and isolate that specific wifi connection ?

what do you mean by isolating the wifi connection? how would I do that?

There is an option under WIFI called "Isolate Clients" which prevents client-to-client communication. However as I see it now, this would be applied to all of them. Not one specific client :frowning:

the goal should be to allow client-to-client communication instead of preventing it

For my understanding, Router 2 is a client of router 1?
Meaning router 2 has a WAN ip address of 192.168.1.x?

If so traffic should already be possible from router 2 and its clients to router 1 and its clients but not the other way around.

To have traffic from router 1 to router 2, you have to do 2 things:

  1. Make a static route on Router 1 e.g. route 192.168.2.0/24 to WAN IP address of Router 2
  2. Open up the firewall of Router 2 to allow traffic from 192.168.1.0/24

Create an interface in Router 2 for the wifi client. This interface will have a static IP in Router 1's LAN such as 192.168.1.2/24. If you trust everything in both networks you can place this interface in the lan firewall zone. Forwarding within the lan zone is allowed in the default configuration.

Then install static routes. Note that the creation of the link interface in router 2 has established a route to router 1's lan already. So the only route that needs to be defined explicitly is in router 1: 192.168.2.0/24 via 192.168.1.2

1 Like

This worked really well! I can now access the server in router 1 while being connected to router 2. Because of the link interface, I assume this should had also given me access to the servers in router 2 while being connected to router 1, but that doesn't seem to be working. Here's the relevant configuration files

Router 2
/etc/config/network

config interface 'Link'
85         option proto 'static'
86         list ipaddr '192.168.1.2/24'

/etc/config/firewall

config zone
         option name 'lan'
         option input 'ACCEPT'
         option output 'ACCEPT'
         option forward 'ACCEPT'
         list network 'lan'
         list network 'Link'

Router 1
/etc/config/network

config route
        option target '192.168.2.0/24'
        option gateway '192.168.1.2'

I tried to replicate the steps by replacing router 1 with router 2, and that didn't work

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.