How to ssh in to OpenWrt when it is a Wifi Client

Installing and Using OpenWrt Network and Wireless Configuration
1

I have OpenWrt on a Pi 4 snapshot Nov firmware.
Currently the Pi is connected as another host in my LAN.
I have set up OpenWrt as a Wifi client to the main wan side router/gateway.

/etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option hwmode '11g'
        option path 'platform/soc/fe300000.mmcnr/mmc_host/mmc1/mmc1:0001/mmc1:0001:1'
        option htmode 'HT20'
        option country 'IE'
        option channel '7'

config wifi-iface 'iface1'
        option device 'radio0'
        option mode 'sta'
        option network 'wwan'
        option ssid 'eir77597326-5G'
        option encryption 'psk2'
        option key 'password'

/etc/config/network

config interface 'wan'
        option ifname 'eth1'
        option proto 'dhcp'

config interface 'lan'
        option ifname 'eth0'
        option proto 'dhcp'
        option type 'bridge'

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config interface 'wwan'
        option proto 'dhcp'

The OpenWrt Pi connects to the main home router which gives it an ip address... I can ping that ip address from my laptop. I tested from LuCi and the OpenWrt Pi is connecting to the internet.

However, I cannot ssh in to that OpenWrt Pi. I though I could ssh to the ip address the main router gives to its wifi connection to the OpenWrt Pi? Instead the putty connection never connects and times out.

What do I need to change so I can ssh to the Pi even when it's network cable is disconnected and it is connected to the main outer as a wifi client?

Cheers,

Flex

2

The firewall may block the connection. Which firewall zone did you assign to wwan? Maybe it should be in the lan zone, which allows incoming connections to openwrt (the INPUT setting in the zone config).

2 Likes
3

I had done nothing to the firewall. I looked just now and wwan was in Zone wan.

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        option network 'wan wan6 wwan'

Which I changed to:

config zone
        option name 'wan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'
        option mtu_fix '1'
        option network 'wan wwan'

Now I can ssh in to the ip address of that wwan interface. Great.

However, when I test by plugging out the network cable to the Pi running OpenWrt I can no longer access the LuCi Web interface from my laptop. I tried the ip of the wwan but Chrome says: "Site cannot be reached. Refused to connect".

Maybe I should put wwan in the lan zone instead?

Cheers,

Flex

4

It should work the same for http or ssh since you've set the default to accept input on all ports.
If you are using the correct IP and it is a firewall problem you would get "Connection refused".

Note that most browsers if http does not work they immediately try https and stick with it-- you need to edit the URL in the bar to try http again.

2 Likes
5

Great... I can get to the LuCI Web Interface now via the wwan interface. I had cleared browsing data several times and typed in http://192.168.1.6 but it still wasn't working... then I rebooted the Pi and it worked..

Thanks alot,

Flex

6

When you need to have access from the WWAN, it's probably better practice to have it in a separate zone rather than accept all traffic from WAN. This can come useful in case you come at a later time of not using the device and connect its WAN port directly to a modem.

That's generally speaking, but it's understood that this is more likely to happen with a regular router than with a Pi

1 Like
7

Thanks a lot for that advice.. yes my next step is to make the Pi the home router so better not to have all those ACCEPTs in the wan zone.

config zone
        option name 'wwan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        #option masq '1'
        #option mtu_fix '1'
        option network 'wwan'

Not sure if I need the masq and mtu_fix options? It seems to work without them..

I also put this in /etc/config/firewall but don't think it was needed either?

config forwarding
        option src 'lan'
        option dest 'wwan'

Flex

8

Well, if you are going to make it the home router, connected by cable to the modem, then you shouldn't need the wwan interface. It should just be a regular AP-mode network.

What you need to consider, however, is how you are going to access the RPi by cable if you needed to. There are few options for the RPi:

  • Using a USB Ethernet adapter for the WAN and on-board Ethernet port for the LAN (it's better that way, so if something wrong happens with the USB adapter, you can still access the Pi.
  • Using a VLAN-capable switch, trunk both WAN and LAN on the on-obard Ethernet port.
  • Just do with the WiFi alone for the LAN access. If you keep an updated backup of your settings, when something goes wrong with the RPi you could just reslash the Micro SD card.
  • Just do with the WiFi alone for the LAN access, but carefully allow SSH access from the WAN side. There are risks involved, but can be minimised with proper precautions.
9

Yes.. I just wanted to see the Wifi client and AP modes in action and understand how to configure them. But I will connect the Pi/OpenWrt to the Modem by ethernet.

Well I definately want to cable the OpenWrt router to the LAN... I just realised the VLAN option is available to me as I have a TP-Link TL-SG105E.

But first I'm going to try a Linksys USB/Eth adapter, it seems less complicated!

Cheers,

Flex

10

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.