How to allow access to subnets only from VPN and not LAN or Guest AP?

Installing and Using OpenWrt
1

Hi,

I have two Proxmox servers with VMs on 192.168.100.0/24 and 192.168.101.0/24.

I want to be able to access those subnets from my Wireguard VPN on OpenWRT, but not from my LAN (192.168.1.0/24), nor my Guest network.

I added some routing and firewall rules, and now I can’t access from the Guest network, which is OK, but I still can from my LAN.

Here are my configuration informations :

root@OpenWrt:~# ubus call system board
{
        "kernel": "6.6.67",
        "hostname": "OpenWrt",
        "system": "ARMv8 Processor rev 4",
        "model": "Xiaomi Mi Router AX3000T (OpenWrt U-Boot layout)",
        "board_name": "xiaomi,mi-router-ax3000t-ubootmod",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "24.10.0-rc4",
                "revision": "r28211-d55754ce0d",
                "target": "mediatek/filogic",
                "description": "OpenWrt 24.10.0-rc4 r28211-d55754ce0d",
                "builddate": "1734915335"
        }
}




root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd80:86f9:aa6::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        list dns '192.168.1.2'
        list dns '192.168.1.254'
        option gateway '192.168.1.254'

config device
        option name 'wan'
        option macaddr '50:88:11:50:ed:46'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'
        option peerdns '0'
        list dns '192.168.1.2'
        list dns '192.168.1.254'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config interface 'vpn'
        option proto 'wireguard'
        option listen_port '51821'
        list addresses '192.168.9.1/24'
        list addresses 'fd00:9::1/64'
        option defaultroute '0'
        list dns '192.168.1.2'
        list dns '192.168.1.254'

config wireguard_vpn 'wgclient'
        option public_key 'XXX'
        list allowed_ips '192.168.9.2/32'
        option route_allowed_ips '1'
        option description 'Pixel 9'

config device
        option type 'bridge'
        option name 'br-guest'
        option bridge_empty '1'

config interface 'guest'
        option proto 'static'
        option device 'br-guest'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'

config route
        option interface 'lan'
        option target '192.168.101.0/24'
        option gateway '192.168.1.201'
        option disabled '1'

config route
        option interface 'lan'
        option target '192.168.100.0/24'
        option gateway '192.168.1.200'
        option disabled '1'

config route
        option interface 'vpn'
        option target '192.168.101.0/24'
        option gateway '192.168.1.201'

config route
        option interface 'vpn'
        option target '192.168.100.0/24'
        option gateway '192.168.1.200'

config wireguard_vpn
        option description 'Asus A17'
        option public_key 'XXX'
        option route_allowed_ips '1'
        option persistent_keepalive '25'
        list allowed_ips '192.168.9.3/32'



root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone 'lan'
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        option masq '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule 'wg'
        option name 'Allow-WireGuard'
        option src 'wan'
        option dest_port '51821'
        option proto 'udp'
        option target 'ACCEPT'

config zone 'wan'
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config zone
        option name 'vpn'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'vpn'

config forwarding
        option src 'vpn'
        option dest 'lan'

config zone
        option name 'guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'guest'

config rule
        option name 'Allow-DNS-Guest'
        option src 'guest'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCP-Guest'
        list proto 'udp'
        option src 'guest'
        option dest_port '67'
        option target 'ACCEPT'

config rule
        option name 'Block_Guest_from_LAN'
        option src 'guest'
        option dest 'lan'
        option target 'REJECT'
        list proto 'all'
        list dest_ip '192.168.1.0/24'
        list dest_ip '192.168.101.0/24'
        list dest_ip '192.168.100.0/24'

config forwarding
        option src 'guest'
        option dest 'lan'

config rule
        option name 'Allow_VPN_to_VMs'
        option src 'vpn'
        list dest_ip '192.168.100.0/24'
        list dest_ip '192.168.101.0/24'
        option target 'ACCEPT'

config rule
        option name 'Allow_VPN_to_VMs'
        option src 'lan'
        list dest_ip '192.168.100.0/24'
        list dest_ip '192.168.101.0/24'
        option target 'REJECT'

Thanks a lot for your help !

2

As I look at your config, it is clear that this is not your main router.

How is this device connected to the upstream network (which port on this device)? And can you provide a topology diagram that shows how this network is setup?

3

Hello,

Yes, it is not my main router, I have a Freebox before it. I’m using OpenWRT as a WiFi AP for all my devices.

Here is a description of my network :

Internet 
   ↓
Freebox (192.168.1.254/24) 
   ↓
OpenWRT (connected on LAN2) (192.168.1.1/24)
├Wireguard Server (192.168.9.0/24)
├WiFi AP (192.168.1.0/24)
├Guest WiFi AP (192.168.2.0/24))
                          ↓
        ┌─────────────────┴─────────────────┐
        ↓                                   ↓
   Proxmox 1 (192.168.1.200)        Proxmox 2 (192.168.1.201)
   ├─ VMs (192.168.100.0/24)        ├─ VMs (192.168.101.0/24)

Is it better for you ?

Thanks !

4

Please let me know if I've misunderstood anything here:

  • Based on your topology, the main lan is provided by the Freebox router.
  • OpenWrt is setup such that it is connected very much like a basic bridged AP (with guest wifi and wireguard added).
  • The proxmox servers are setup on the same subnet as the main lan.

Assuming the above is correct, the firewall on the OpenWrt router will never be involved for connections between the devices on the main lan and the Proxmox servers. That's because they're all on the same subnet, thus the traffic flow is simply switching (L2). The firewall is only active on L3 (routed) connections. As such, there is nothing you can do with the existing topology to prevent lan devices from reaching your proxmox servers.

Your options are:

  1. host-level firewall rules which may be possible on the proxmox host and/or supervisor.
  2. Setup another subnet such that the traffic must be routed and thus can be firewalled. In fact, beause you're masquerading the lan zone already, this NAT would make it essentially impossible for lan devices to reach anything on another subnet.