How to create a second access point with WireGuard

[lleachii]

@K14M

I don't understand console commands at all.

It isn't a console command. Please take time to review the Wiki. If looking at the configurations bother you, this can also be don't in the LuCI web GUI.

@K14M

Where and how can I then check that the command was applied?

Console:

ip -4 route

Web GUI:

@K14M

Check everything through the console? I can't

Then don't.

@K14M

What does this team do?

What team are you referring to?

[K14M]

So LuCI web GUI is useless?

@lleachii

Please take time to review the Wiki

If the wiki was translated into my native language, I would do so.

[K14M]

@lleachii

What team are you referring to?

About this option in '<interface_name>'
Is it really not clear? They wrote me a command, I ask what it does and they tell me that there is no command. What were you smoking?

[lleachii]

@K14M

So LuCI web GUI is useless?

I don't understand the question. I just provided details on the LuCI web GUI.

@K14M

If the wiki was translated into my native language

Routes: https://openwrt-org.translate.goog/docs/guide-user/network/routing/routes_configuration?_x_tr_sl=auto&_x_tr_tl=ru&_x_tr_hl=en-US&_x_tr_pto=wapp

Rules: https://openwrt-org.translate.goog/docs/guide-user/network/routing/ip_rules?_x_tr_sl=auto&_x_tr_tl=ru&_x_tr_hl=en-US&_x_tr_pto=wapp

or feel free to use your own translator.

@K14M

About this option in '<interface_name>'
Is it really not clear? They wrote me a command, I ask what it does and they tell me that there is no command.

Again:

@lleachii

It isn't a console command. Please take time to review the Wiki.

See Wiki:

@K14M

What were you smoking?

The same thing you are?

[K14M]

@lleachii

I don't understand the question. I just provided details on the LuCI web GUI.

What have you given me? For what purpose did I create this topic? I want to create a second wireless access point and configure WireGuard on it. Following the tips of another user, I created a second access point, but both provide Internet access directly, without WireGuard.

How do I enable WireGuard for a second access point? This is my question. And I haven’t yet read the answer “where to go” and “what to click” to do this.

@lleachii

Routes: https://openwrt-org.translate.goog/docs/guide-user/network/routing/routes_configuration?_x_tr_sl=auto&_x_tr_tl=ru&_x_tr_hl=en-US&_x_tr_pto=wapp

Rules: https://openwrt-org.translate.goog/docs/guide-user/network/routing/ip_rules?_x_tr_sl=auto&_x_tr_tl=ru&_x_tr_hl=en-US&_x_tr_pto=wapp

And what should I understand from this?

config route 'route_example_1'
         option interface 'lan'
         option target '172.16.123.0'
         option netmask '255.255.255.0'
         option gateway '172.16.123.100'
config rule
option mark '0xFF'
         option in 'lan'
option dest '172.16.0.0/16'
option lookup '100'

What's this? Where is it? Where should I look for such settings?

@lleachii

See Wiki:

I don't see anything similar to your wiki here

[lleachii]

@K14M

How do I enable WireGuard for a second access point? This is my question. And I haven’t yet read the answer “where to go” and “what to click” to do this.

Please review again:

@lleachii

You can manually create IP Routes and IP Rules without installing the PBR package.

@lleachii

this can also be don't in the LuCI web GUI.

If it wasn't clear, you:

• Browse to Network > Routing
• For Routes, click "Static IPv4 Routes"
• For Rules, click "IPv4 Rules"

@K14M

Where and how can I then check that the command was applied?

@lleachii

Web GUI:

• You browse to Status > Routing

@K14M

How can I change or cancel this command?

You delete them and then Save/Apply the config. To be clear again, it's not a command.

[lleachii]

@mk24

Then use PBR with the rule based on source interface instead of source IP.

@K14M

How do I enable WireGuard for a second access point?

@lleachii

Per the Wiki, an IP Rule based on SRC interface needs:

option in '<interface_name>'

As discussed by you and mk24 - you would select VPN - assuming that's the Interface you wish to use Wireguard.

[K14M]

@lleachii

Web GUI:

You sent the wrong screenshot

Is that right? I don't think it works

[lleachii]

@K14M

You sent the wrong screenshot

No, I did not.

The screenshot I posted answered your question:

@K14M

Where and how can I then check that the command was applied?

@lleachii

You browse to Status > Routing

@K14M

@lleachii

Web GUI:

I did not provide a screeshot on how to access the Routes page. You asked for written instructions on how to browse to the page:

@K14M

I haven’t yet read the answer “where to go” and “what to click” to do this.

@lleachii

If it wasn't clear, you:

• Browse to Network > Routing
• For Routes, click "Static IPv4 Routes"
• For Rules, click "IPv4 Rules"

@K14M

That would be this image.

Please don't confuse making the config and checking the config was applied.

[K14M]

I still don't understand what I need to do

[lleachii]

@K14M

I still don't understand what I need to

@K14M

How do I enable WireGuard for a second access point?

@K14M

How can you do without PBR?

Without using PBR - Browse to Network > Routing:

Static IPv4 Routes

1. Add Route

• General Settings
  • Interface: WARP
  • Route type do not change Unicast
  • Target: 0.0.0.0/0
• Advanced settings
  • Table: 1
  • (do not change other settings)

IPv4 Rules

2. Add Rule

• Incoming interface : VPN
• Destination 0.0.0.0/0
• Table :1

Save/Apply

3. Click "Save & Apply"

Check configuration applied

4. Browse to Status > Routing

@lleachii

@K14M

How can I change or cancel this command?

You delete them and then Save/Apply the config.

[K14M]

@lleachii

1. Add Route

• Advanced settings
  • Table: 1

I do not have that

@lleachii

IPv4 Rules

2. Add Rule

• Table :1

I do not have that

Should I create Table :1 myself?

[lleachii]

@K14M

I do not have that

Yes you do:

@K14M

Should I create Table :1 myself?

Yes, you will be creating a new table for your WARP route to the Internet, which is noted as 0.0.0.0/0 (reviewing the Wiki and Linux manual on routing tables would be helpful in this process if you have questions).

EDIT:

After creating the route, the rule tells traffic entering VPN interface to use table 1 for routing.

(FYI - I should note that the PBR package would have done this for you. It may be an option for those who are easily confused by making routes/rules.)

[K14M]

@lleachii

Yes you do

Progress. WireGuard is working. I was able to log into YouTube from my phone without launching VPN on my phone. BUT. I noticed that WireGuard works for both access points. Something is not set up right. But what?

Amendment. WireGuard connected even for a PC connected via cable. This definitely shouldn't happen

[lleachii]

@K14M

BUT. I noticed that WireGuard works for both access points.

Both of these?

This is expected, as you specified interface VPN.

---

Or both of these?

@K14M

WireGuard connected even for a PC connected via cable. This definitely shouldn't happen

Then create a different, non-VPN interface, or use IP instead, etc.

[K14M]

@lleachii

Both of these?

@lleachii

Or both of these?

Both of them all. It doesn’t matter whether you are connected to the first access point, connected to the second, or connected via cable. WireGuard works everywhere. Why did I give the second access point the address 192.168.2.1 if WireGuard works for everything?

[lleachii]

@K14M

Both of them all.

Please be clear - I see 4 APs

AP x2 - LAN (not WARP)
AP x2 - VPN (WARP configured)

Are you saying that WARP is working on LAN machines too?

@K14M

Why did I give the second access point the address 192.168.2.1 if WireGuard works for everything?

Are you saying you now wish to use SRC IP instead of SRC Interface?

[K14M]

@lleachii

Please be clear - I see 4 APs

Where did you get 4 access points? There are only 2 of them. K14M and K14M VPN

@lleachii

Are you saying that WARP is working on LAN machines too?

I want to say that WARP works for ALL devices connected to the router. But you need WARP to work only for devices connected via the K14M VPN wireless access point. Second wireless access point (K14M) and wired connections should work without WARP
​

[lleachii]

@K14M

Second wireless access point (K14M) and wired connections should work without WARP

• Click "Edit"
• Show screenshot

1. We need to verify that K14M is using LAN interface.
2. Please verify wired devices are being connected to LAN

[K14M]

@lleachii

Are you saying you now wish to use SRC IP instead of SRC Interface?

In what sense is "now"? From the very beginning I wrote that I wanted to make two wireless access points, one with VPN and the other without. If I need to use VPN on my smartphone, I will connect to K14M VPN, if I don’t need VPN, I will connect to K14M. On a PC connected via cable, VPN is not needed at all.