How to connect a device in another LAN

[openwrtlove]

The PBR software seemed to be working strangely, so I canceled Wireguard Server + Wireguard Client Scenario 2 and proceeded according to the following topic. (Modifying or applying the policy causes a forced reboot of the device or turning off the wireless.)

Wireguard setup: Mullvad Client + Server for Android

Please tell me if I should open a new ticket, since the original question was answered. Nevertheless it is with focus on my system now, described above. I found a new issue (might be the same as with the DNS things): when connected to my router with the new fancy setup of two VLANs and two tunnels I can not reach my nextcloud anymore. This is just a raspi with DynDNS and port forwarding. I connected it to the VLAN without Mullvad. Reaching it from outside (Phone LTE, no tunneling) works perfec…

To realize the following,
Mobile phone -> VPN Tunnel -> Home (NAS etc..) -> VPN Tunnel -> Mullvad VPN

As a result, it was possible to access the home network and to confirm that outgoing traffic was going well through the mullvad vpn server.

However, it was observed that the NAS of the internal network was not accessible on mobile phones. Looking at the access to the openwrt administrator page from the outside, it seems clear that you have normal access to the home wireguard server.

The subnet of the wireguard server interface is 192.168.99.1, and the subnet of the LAN2 interface is 192.168.178.1. When you ping from the outside to your mobile phone, it sends well on 192.168.1.1, but packets do not reach the device on 192.168.178.x.

I tried many other settings, but rather, I couldn't access other Internet or LAN2 devices.
I think I can achieve what I want by adding one rule, but I can't get the hang of it.

Next is my Settings,

/etc/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone 'lan'
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone 'wan'
        option name 'wan'
        option output 'ACCEPT'
        option mtu_fix '1'
        option input 'REJECT'
        option forward 'REJECT'
        list network 'wan'
        list network 'wan6'
        option masq '1'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'


config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Support-UDP-Traceroute'
        option src 'wan'
        option dest_port '33434:33689'
        option proto 'udp'
        option family 'ipv4'
        option target 'REJECT'
        option enabled '0'

config include
        option path '/etc/firewall.user'

config forwarding 'lan_wan'
        option src 'lan'
        option dest 'wan'

config rule 'wg'
        option name 'Allow-WireGuard'
        option src '*'
        option dest_port '61820'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'lan2'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'LAN2'
        list network 'vpn'

config zone
        option name 'mvvpn'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'VPNC'

config forwarding
        option src 'lan2'
        option dest 'mvvpn'

config forwarding
        option src 'lan2'
        option dest 'wan'

/etc/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'HIDE'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device
        option name 'eth0.2'
        option macaddr 'HIDE'

config interface 'wan'
        option device 'eth0.2'
        option proto 'dhcp'

config interface 'wan6'
        option device 'eth0.2'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option vid '1'
        option ports '0t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '0t 1'
        option vid '2'

config interface 'vpn'
        option proto 'wireguard'
        option private_key 'HIDE'
        option listen_port '61820'
        list addresses '192.168.99.1/24'
        option force_link '1'
        option peerdns '0'
        list dns '10.64.0.1'

config wireguard_vpn 'wgclient'
        option persistent_keepalive '25'
        option preshared_key 'HIDE'
        option public_key 'HIDE'
        list allowed_ips '192.168.99.3/32'
        option route_allowed_ips '1'

config interface 'VPNC'
        option proto 'wireguard'
        option private_key 'HIDE'
        list addresses 'HIDE'
        list addresses 'HIDE'
        option mtu '1420'
        option force_link '1'
        option listen_port '51820'
        option peerdns '0'
        list dns '10.64.0.1'

config wireguard_VPNC
        option description 'jp1'
        option public_key 'HIDE'
        option persistent_keepalive '25'
        option endpoint_host 'HIDE'
        option endpoint_port '51820'
        list allowed_ips '0.0.0.0/0'
        list allowed_ips '::0/0'

config rule
        option dest '0.0.0.0/0'
        option lookup '2'
        option in 'VPNS'
        option priority '3'

config wireguard_vpn
        option public_key 'HIDE'
        list allowed_ips '192.168.99.4/32'
        option route_allowed_ips '1'
        option persistent_keepalive '25'

config interface 'LAN2'
        option proto 'static'
        option device 'br-lan2'
        option ipaddr '192.168.178.1'
        option netmask '255.255.255.0'

config switch_vlan
        option device 'switch0'
        option vlan '3'
        option ports '0t 2 3 4 5'
        option vid '3'

config device
        option type 'bridge'
        option name 'br-lan2'
        list ports 'eth0.3'

config rule
        option in 'LAN2'
        option dest '0.0.0.0/0'
        option priority '3'
        option lookup '2'

config rule
        option in 'vpn'
        option dest '0.0.0.0/0'
        option priority '4'
        option lookup '2'

config rule
        option in 'LAN2'
        option dest '0.0.0.0/0'
        option priority '5'
        option lookup 'main'

config route
        option interface 'VPNC'
        option target '0.0.0.0'
        option netmask '0.0.0.0'
        option table '2'

Thank you