Newbie here. I installed Openwrt on the EA7300 along with WireGuard server. This is not the main router but connected to Deco X60 which is connected to BWG-210 gateway with IP Passthru. When EA7300 is setup as a router then WG works fine. But when I change the EA7300 to bridge mode, LAN-to-LAN connection to deco X60, wireguard stops working. The reason for bridge mode is to have access to all deco connected devices, mainly cameras.
Q1. Is there a way to get access to devices connected to Deco when EA7300 is set in router mode.
Deco 192.168.68.1. DHCP 192.168.68.100 to 250
EA7300 192.168.68.2. DHCP 192.168.68.10 to 99
Q2. Is it possible to get WG working with EA7300 in bridge mode.
Will post those soon. ATT gateway modem BWG-210 provides Internet, connected via Ethernet to Deco X60 which is the main router. Deco gets the public IP since BWG-210 is set to Ip Passthru and all routing, wireless firewall disabled on the ATT BWG210.
Then from Deco EA 7300 is connected with a Ethernet
LAN - WAN when EA7300 is set as router and LAN to LAN when EA7300 is set as Bridge. EA7300 wireless is not enabled. And Only a computer is connected to EA 7300.
DEco X60 has all WiFi devices, NVR, IOT..
Hope this clarifies
What you want to do can be achieved fairly easily.... there are two ways to do it:
Use masquerading on the OpenWrt upstream connection
or
if your deco supports static routes, we can use that and not enable masquerading.
Option 1 is the easiest and requires only adjustments to OpenWrt. We only need the network and firewall files to be able to help resolve the issues (it would also be useful to see a remote peer device's config).
Also, you'll need to make sure that your deco is port forwarding properly to your OpenWrt device.
Ok it clearer.
As the Deco X60 is the main router, than the EA7300 would simply act as an AP.
You must connect the EA7300 with a LAN port to the switch. DHCP should me managed by the X60 only.
Wireguard can be managed by the EA7300, but you must add some firewall rules.
Assign wireguard interface to a new zone (VPN in this example)
config zone
option name 'VPN'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'Wireguard'
option masq '1'
config forwarding
option src 'lan'
option dest 'VPN'
config forwarding
option src 'VPN'
option dest 'lan'
As noted, masq needs to be only on the lan zone and not the vpn zone. Then a vpn->lan connection will appear to come from the OpenWrt router's IP on the LAN. The LAN devices and main router do not need to be aware of the IP subnet(s) used on the VPN.
Forwarding from lan to VPN (where a LAN device can initiate a connection to a VPN device) is not going to work simply when masquerading is in place. It is the same situation as accepting incoming connections from the Internet when
"Use masquerading on the OpenWrt upstream connection"
How do i do this.
Port forwarding in Deco works as I can Switch to Router Mode on EA7300 and Wireguard lets me in.
The Bridge is the issue. I think the bridge will let me access other devices in the network, than router setup in EA 7300
Start by removing the masquerading on the vpn zone
config zone
option name 'vpn'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'test'
Then enable masquerading on the lan zone:
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option masq '1'
list network 'lan'
you can delete this:
If this doesn't solve the issue, please post the complete files:
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/firewall
I did not add the Gateway and DNS but it is Working Now. I simply turned off the EA7300 and turned it back on.
One change I see is the WG interface "test" is now RED instead of the usal Green. Can I delete the WAN and WAN6 Interface as it is not being used in Bridge Mode.
