How to avoid using guest wifi for wireguard?

L1so · August 15, 2024, 3:10pm

Hello, I came back to this forum to followup from my previous question, where I struggled with wireguard settings to make IP cam accessible, below is the linked thread.

Currently, I have setup two SSIDs, one for daily usage and one for IP Cam:

ppv: subnet 192.168.16.0/24 (daily usage)
ptv: subnet 192.168.30.0/24 (IP Cam)
So what I do is I connect the IP Camera to ptv ssid and the router will assign the camera an IP Address in 192.168.30.0/24 subnet, and this IP Address is reocgnized by my vps and able to ping it as well.

But now I want to remove ptv ssid and make the camera connect directly to ppv, thus the camera will have 192.168.16.0/24 subnet as IP Address, but I can't seem to get the VPS to recognize this IP subnet, I have tried to route but still can't.

This seems to be easy task, I tried tinkering with firewall to no avail, any suggestion will be much appreciated, don't hesitate to ask any config or anything that will helps me achieve this config.

ubus call system board:

{
        "kernel": "5.15.150",
        "hostname": "OpenWrt",
        "system": "MediaTek MT7620A ver:2 eco:6",
        "model": "Xiaomi MiWiFi Mini",
        "board_name": "xiaomi,miwifi-mini",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.3",
                "revision": "r23809-234f1a2efa",
                "target": "ramips/mt7620",
                "description": "OpenWrt 23.05.3 r23809-234f1a2efa"
        }
}

cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd37:341e:0469::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config device
        option name 'eth0.1'
        option macaddr 'ZZZZ:f0'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.16.1'
        option delegate '0'

config device
        option name 'eth0.2'
        option macaddr 'ZZZZ:ef'

config interface 'wan'
        option device 'eth0.2'
        option proto 'dhcp'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0 1 2 3 6t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '4 6t'

config interface 'wwan'
        option proto 'dhcp'

config interface 'WG0'
        option proto 'wireguard'
        option delegate '0'
        option private_key 'XX'
        list addresses '10.7.0.3/24'
        list addresses 'fddd:2c4:2c4:2c4::3/64'
        list dns '1.1.1.1'
        list dns '1.0.0.1'

config wireguard_WG0
        option route_allowed_ips '1'
        option persistent_keepalive '25'
        list allowed_ips '10.7.0.0/24'
        list allowed_ips '192.168.0.0/16'
        option description 'motioneye'
        option endpoint_host 'XX.XX.XX.XX'
        option endpoint_port '1111'
        option public_key 'XX'
        option preshared_key 'XX'

config interface 'cctv'
        option proto 'static'
        list dns '8.8.8.8'
        list dns '1.1.1.1'
        list ipaddr '192.168.30.1/24'
        list ipaddr '192.168.0.0/16'

config route
        option interface 'cctv'
        option target '192.168.20.0/24'

config route
        option interface 'cctv'
        option target '192.168.30.0/24'

cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/10180000.wmac'
        option band '2g'
        option htmode 'HT20'
        option cell_density '0'
        option country 'ID'
        option channel '1'

config wifi-iface 'wifinet3'
        option device 'radio0'
        option mode 'ap'
        option ssid 'ptv'
        option encryption 'psk2'
        option key 'XXX2'
        option network 'cctv'

config wifi-iface 'wifinet4'
        option device 'radio0'
        option mode 'ap'
        option ssid 'ppv'
        option encryption 'psk2'
        option key 'XXX1'
        option network 'lan'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'pci0000:00/0000:00:00.0/0000:01:00.0'
        option channel '44'
        option band '5g'
        option htmode 'VHT80'
        option cell_density '0'

config wifi-iface 'wifinet5'
        option device 'radio1'
        option mode 'sta'
        option network 'wwan'
        option ssid 'Raiden_5G'
        option encryption 'psk2'
        option key 'XXX44'

cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'
        option doh_backup_noresolv '-1'
        option noresolv '1'
        list doh_backup_server ''
        list server '/mask.icloud.com/'
        list server '/mask-h2.icloud.com/'
        list server '/use-application-dns.net/'
        list server '127.0.0.1#5053'
        list server '127.0.0.1#5054'
        list doh_server '127.0.0.1#5053'
        list doh_server '127.0.0.1#5054'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'cctv'
        option interface 'cctv'
        option start '100'
        option leasetime '12h'
        option limit '15'

config host
        option name 'dgiot'
        option ip '192.168.30.106'
        option leasetime 'infinite'
        list mac 'XXX:EF'

cat /etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wwan'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'cctv'
        option forward 'REJECT'
        option input 'REJECT'
        option output 'ACCEPT'
        list network 'cctv'

config forwarding
        option src 'cctv'
        option dest 'wan'

config zone
        option name 'wireguard'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        list network 'WG0'

config forwarding
        option src 'wireguard'
        option dest 'cctv'

config forwarding
        option src 'lan'
        option dest 'cctv'

egc · August 15, 2024, 3:33pm

I took a quick look at the other thread and your whole setup is different then what I would do.
Actually @mk24 already said how to setup : Remotely access IP Camera behind OpenWrt router - #2 by mk24

Another example 192.168.0.0/16 encompasses your local subnets, luckily the local subnet is smaller otherwise you would have locked yourself out, not good practice to setup like this

L1so:

config wireguard_WG0
        option route_allowed_ips '1'
        option persistent_keepalive '25'
        list allowed_ips '10.7.0.0/24'
        list allowed_ips '192.168.0.0/16'
        option description 'motioneye'
        option endpoint_host 'XX.XX.XX.XX'
        option endpoint_port '1111'
        option public_key 'XX'
        option preshared_key 'XX'

L1so · August 15, 2024, 3:55pm

I have not opened any port forward in home router, and I can access/ping the camera directly from CLI of the vps, with the condition the camera is connected to ptv ssid.

Should I change the allowed ips to the subnet which camera uses then?

egc · August 15, 2024, 4:09pm

I would not change anything your setup might be a house of cards for all I know.

In my opinion you already had good advice to set this up like a site-to-site setup so not NAT, as Allowed IPs the subnets of the other side and Allowing traffic from each side (basically add WG interface to LAN zone)

That is what I would do, you chose differently which is fine of course and if it works do not change anything