I would like to be able to connect to my home network when I am travelling. Unfortunately, my ISP router does not allow setting up a simple wireguard VPN on it so my only option at this point is to use a second router running openwrt. The ISP router (primary router) needs to be used because it gives functionality to TV boxes etc..I know I will have to port forward from the primary router to the secondary router (openwrt router).
The two routers will be connected this way: Primary router (LAN port) <--> Secondary router (WAN port) via an ethernet cable. If possible, I would like all the firewall functionality to be handled by the primary router as the secondary router is not going to have anything connected to it as it's only purpose is to work as a wireguard server. Or is it easier to have the firewall be handled by the secondary router when I am connected to it via wireguard?
The openwrt router is running 23.05.2. The primary router gateway is 192.168.1.1. I would assume the openwrt needs to be outside the subnet of the primary router, e.g. 192.168.2.1, right? I will be using DDNS on the secondary router to keep track of the ISP IP changes.
I have tried searching how to properly setup the openwrt to achieve my needed functionality but I keep getting confused since I am very new to openwrt.
Are there any instructions that can explain the steps to properly setup the openwrt router the way I needed?
Any help and advice on the best way to setup the openwrt router would be greatly appreciated.
This is really quite simple to accomplish, as long as your primary router allows you to setup port forwarding. and assuming that your primary router's wan has a proper public IP address. Please verify these two things before going any further.
Ideally, if the primary router also exposes the ability to add static routes, you can setup a route for your WG network rather than using masquerading on the OpenWrt device. But this is not a hard requirement.
After verifying the port forwarding and public IP on the primary router, you'll be setting up your OpenWrt router as a 'server' in the "road warrior context." Start from the default config and setup WG. From there, we can take your configs and make a few minor tweaks to get it to work exactly as you've described.
No, a static route is instructions about how to route networks that a router doesn't have a direct connection to...
So for example, if your OpenWrt router has an address (via the wan) 192.168.1.5, and behind it (the lan) 192.168.2.0/24, your upstream router has no idea about that 192.168.2.0/24 network. A static route allows us to tell the primary router where to send the data that is destined for the 2.0/24 network. They look like this:
192.168.2.0/24 via 192.168.1.5
This says send traffic for the 2.0/24 network via its gateway which has an address 192.168.1.5 and that device will take care of the rest.
Great explanation! I now understand what you meant.
Unfortunately, I am not sure the primary router allows static route. Also, the less configuration on the primary router i do the better because if i mess up its functionality i will never hear the emd of it from my wife. Is there another way without static routes? I was hoping port forwarding from the main router would be enough.
Okay here is where I am. I have connected the router this way (primary LAN to secondary router WAN). I have forwarded a port from the primary router to the secondary router (used port 443 UDP). When on my laptop, connected via wifi and Ethernet cable connected to secondary router, I can connect to both routers but their IP address (192.168.1.1 and 192.168.2.1).
I installed wireguard and created peers. But when I try to connect to the home network from my android phone (wifi is off) it does not work.
I have attached picture of my current setup. Are you able to help me to see where I messed up?
I can already see one potential issue, but let's see the text configs and I can gather more context:
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/firewall
config rule 'wg'
option name 'Allow-WireGuard'
option src 'wan'
option dest_port '51820'
option proto 'udp'
option target 'ACCEPT'
The port forward on the primary router should be forwarding port 51820 to the WAN address of the OpenWRT router (192.168.1.5 ?)
After making the changes reboot the router and try again, test from outside your network e.g. with your phone on cellular, the endpoint address should be the public WAN ip address of your ISP router (does it actually has a public WAN ip address?)
If that does not work enable wifi on your phone connect to the ISP router and use the WAN ip address of the OpenWRT router (192.168.1.5?) as endpoint.
Just changing the port forwarding from the primary router from 443 to 51820 fixed the issue. When on my android phone running on cellular connection I am able to see Rx Tx data working and I am to login to luci. I believe that means it is working, right?
There shouldn't be any issues with current configuration, right? Or do you think I will run into problems because of double NAT? Asking for anyone in the future who might find this thread and for myself as well
I didn't change the rules as recommended because I was in the middle of changing the port forwarding as recommended prior to seeing your explanation on the about changing the rules on LUCI. Should I still change the rule?
I will go ahead and create that rule as recommended. However, i do not see where to remove that rule you listed should be removed ( I have not created any rules as far as i know sonce i started this morning).
All done. As you can see I very new to openwrt. I am considering switching to it from ddwrt since i am having some issues after years of running successfully on my router. I just see that there is a much large learning curve.
I asked about the double nat because when doing research for what i was trying to do, everywhere it said that double nat would be an issue and that i wouldn't be able to connect to the primary router and vice versa but currently i am lol. Did i just get lucky?
You can always connect from downstream to upstream so from OpenWRT router you can connect to ISP router but only by IP address as there is no network discovery between subnets.
From upstream to downstream you need two things, open up the firewall of the OpenWRT router and set a static route either on the ISP router (the recommended way) or if that is not possible on the individual clients.
But if you are happy the way it works now then just be done with it and drink a beer (it is beer time in my home country (Netherlands))
OpenWRT is very versatile but indeed it has a learning curve.
Also, the same goes for masquerading.
