Include all WIFI clients to VPN without static ip?

Installing and Using OpenWrt Network and Wireless Configuration
1

Hello,

Quick question please, any way to set up all AP clients to go through vpn ?

My ap's have 192.168.1.101 and 102. DHCP is of course disabled.

At the moment i'm using wireguard at 192.168.1.206 all others not, i'm wondering if there's a way to set up a rule in which anything that connects to WIFI goes through the vpn too without having to set them static?

Config is as follows, thanks in advance:

/root$ cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd6b:efbb:6bd9::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ipaddr '192.168.1.10'

config device
	option type '8021q'
	option ifname 'br-lan'
	option vid '2'
	option name 'br-lan.2'
	option mtu '1420'

config interface 'wan'
	option proto 'dhcp'
	option device 'br-lan.2'
	option force_link '1'
	option broadcast '1'
	option peerdns '0'
	list dns '1.1.1.1'
	list dns '1.0.0.1'

config interface 'wan6'
	option proto 'dhcpv6'
	option device 'br-lan.2'
	option force_link '1'
	option reqaddress 'force'
	option reqprefix 'auto'
	option peerdns '0'
	list dns '1.1.1.1'
	list dns '1.0.0.1'

config interface 'vpn'
	option proto 'wireguard'
	option private_key '0000000000000000000000
	list addresses '10.2.0.2/32'
	option peerdns '0'
	list dns '10.2.0.1'

config wireguard_vpn
	option description 'NL_1.conf'
	option public_key '000000000000000000
	list allowed_ips '0.0.0.0/0'
	option endpoint_host '62.112.9.164'
	option endpoint_port '51820'
	option persistent_keepalive '25'

config route
	option interface 'vpn'
	option target '0.0.0.0/0'
	option table '100'

config rule
	option src '192.168.1.206/32'
	option lookup '100'
	option priority '2'

config route
	option interface 'wan'
	option target '192.168.0.192/24'
	option table '200'

config rule
	option src '192.168.1.10/32'
	option lookup '200'
	option priority '1'
2

Possible, yes - but not with a "quick" answer…

You will have to sever your AP interfaces out of the 'normal' lan bridge and connect them to a new interface(-bridge), with its own firewall rules and then apply policy based routing.

2 Likes
3

Gotcha that makes sense!!!

Thank you very much :slight_smile:

4

keep an eye on the other current thread to basically the same topic: WireGuard on dumb ap

1 Like