Lan1,2,3 and Wifi1 for Service provider, Lan4 and Wifi2 for VPN1

MatteoDXB · July 29, 2023, 8:59am

Hello to everyone and thank you in advance for the hints I am sure I will get. I have a Dlink 2640 (OpenWrt 22.03.5 r20134-5f15225c1e) and I would like to achieve the below:

LAN 1,2,3 ; Wifi 2.4 and Wifi5G (wlan1) to connect to regular service provider;
LAN 4 and Wifi5G (wlan1-1) to connect to openvpn server.

I did the same in DDWRT, but OpenWRT is not as easy, so I would kindly like to ask for your help. As below the configuration. I am reading multiple tutorials.,. but either I can browse with all devices / networks or with none....

**/etc/config/network**
config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option packet_steering '1'
        option ula_prefix 'fdd3:2413:161e::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config interface 'SwissVPN'
        option proto 'static'
        option device 'wlan1-1'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'
        list dns '1.1.1.1'

**/etc/config/dhcp**
config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        option ra_slaac '1'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'SwissVPN'
        option interface 'SwissVPN'
        option start '100'
        option limit '150'
        option leasetime '12h'

**/etc/config/firewall**
config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        list network 'SwissVPN'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list device 'tun0'
        list device 'tun+'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config include 'pbr'
        option fw4_compatible '1'
        option type 'script'
        option path '/usr/share/pbr/pbr.firewall.include'

MatteoDXB · July 30, 2023, 7:27am

I modified the configuration and to me seems, fine, however, even after having created the bridge, all traffic is routed via the VPN, that is not correct. There shall be the the interface LAN via the service provider and the interface intvpnswiss that routes via VPN.

Could someone please help me in getting where is the mistake? As below the configuration, I checked, but I can't fine the error:

Network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option packet_steering '1'
        option ula_prefix 'Edited'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config device
        option type 'bridge'
        option name 'br.vpn.swiss'
        list ports 'lan1'
        list ports 'wlan1-1'

config interface 'intvpnswiss'
        option proto 'static'
        option device 'br.vpn.swiss'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'
        option type 'bridge'

Firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        list subnet '192.168.1.1/24'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list device 'tun0'
        list device 'tun+'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'fwvpnsswiss'
        option input 'ACCEPT'
        option output 'ACCEPT'
        list network 'intvpnswiss'
        option forward 'ACCEPT'
        list subnet '192.168.2.1/24'
        option masq '1'
        option mtu_fix '1'
        list device 'tun0'

config forwarding
        option src 'fwvpnsswiss'
        option dest 'wan'

ulmwind · July 30, 2023, 8:32am

You should create separate interface for 'lan4':

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'

config device
        option name 'br-lanvpn'
        option type 'bridge'
        list ports 'lan4'

config interface 'lanvpn'
        option device 'br-lanvpn'
        option proto 'static'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

After that create separate zone in firewall, and edit wireless configuration.

Routing to VPN is configured via PBR - Policy Based Routing.

ulmwind · July 30, 2023, 8:34am

MatteoDXB:

config zone
        option name 'fwvpnsswiss'
        option input 'ACCEPT'
        option output 'ACCEPT'
        list network 'intvpnswiss'
        option forward 'ACCEPT'
        list subnet '192.168.2.1/24'
        option masq '1'
        option mtu_fix '1'
        list device 'tun0'

Remove 'list subnet '192.168.2.1/24'

ulmwind · July 30, 2023, 8:38am

MatteoDXB:

config interface 'intvpnswiss'
        option proto 'static'
        option device 'br.vpn.swiss'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'
        option type 'bridge'

It is also strange configuration, for classic OpenVPN the section is:

config interface 'intvpnswiss'
        option proto 'none'
        option ipv6 '0'
        option device 'tun0'

egc · July 30, 2023, 8:51am

@ulmwind check again it seems the OP already made the necessary extra bridge and added the LAN1 port

MatteoDXB:

config device
        option type 'bridge'
        option name 'br.vpn.swiss'
        list ports 'lan1'
        list ports 'wlan1-1'

config interface 'intvpnswiss'
        option proto 'static'
        option device 'br.vpn.swiss'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'
        option type 'bridge'

Furthermore the OP already added the tun+ device to the WAN zone which should take care of the necessary firewall settings

As the OP already stated that everything was working but only that everything was routed via the VPN the problem might be the PBR or better the lack of it.

Policy Based routing see: https://docs.openwrt.melmac.net/vpn-policy-routing

egc · July 30, 2023, 9:23am

To expand some more on the PBR, for the PBR to function it needs the interface which it gets with UCI.

So you have to create an interface in /etc/config/interface e.g.:

config interface 'tun0'
	option proto 'none'
	option device 'tun0'

Or from the wiki 4.1-a:

Click on Network in the top bar and then on Interfaces to open the interfaces configuration page.
Click on button Add new Interface...
Fill the form with the following values: Name = OpenVPN, Protocol = Unmanaged, Interface = tun0. Then click on Create Interface.
Edit the interface.
In panel General Settings: unselect the checkbox Bring up on boot.

If you do this you should see the PBR tables created with:
ip rule show

Now you can add PBR rules to route via the VPN and via the WAN

If you want the default routing table to not use the VPN add in the OpenVPN config:
pull-filter ignore "redirect-gateway"

MatteoDXB · July 30, 2023, 9:53am

All works fine, I have added the extra line to the VPN conf and also the extra interface. I set up the PBR basing on the ip (192.168.2.1/24 that goes to the new interface I have created for the eth0).

Question: in case I will need to use other VPNs, every VPN will need to have 1 interface containing the device (eg. wlan1-2), one interface for the tun (e.g. tun1), another firewall rule and then the pbr (like in this case on the ip class). Is the logic behind correct?

egc · July 30, 2023, 10:04am

Yes, I think so, the interface for tun seems necessary for the PBR package to know what routing tables to make.

About the firewall, if this is a simple VPN client adding it to the WAN zone like you did should be good.

If you have a working solution for your use case please mark that solution as solved:

MatteoDXB · July 30, 2023, 10:17am

In case it will be helpful for anyone else in the future, I paste the working configuration. In the PolicyRouting I have added as extrainterface the one about the tun0 and the configuration is based on the IP: whatever is coming from 192.168.2.1/24 is going to that interface, since in the OpenVPN configuration the pull-filter ignore "redirect-gateway" has been added.

Network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option packet_steering '1'
        option ula_prefix 'EDITED'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config device
        option type 'bridge'
        option name 'br.vpn.swiss'
        list ports 'lan1'
        list ports 'wlan1-1'

config interface 'intvpnswiss'
        option proto 'static'
        option device 'br.vpn.swiss'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'
        option type 'bridge'

config interface 'OpenVPNSwiss'
        option proto 'none'
        option device 'tun0'
        option auto '0'

Firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list device 'tun0'
        list device 'tun+'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'fwvpnsswiss'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'intvpnswiss'
        option masq '1'
        option mtu_fix '1'
        list device 'tun0'

config forwarding
        option src 'fwvpnsswiss'
        option dest 'wan'

system · August 9, 2023, 10:17am

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.