OpenVPN client on VLAN 20 only

Installing and Using OpenWrt Network and Wireless Configuration
1

I'm trying to have my OpenVPN client only go through VLAN20 since it will be used for port forwarding and I don't want other devices in the network exposed to it

I currently have the followings configs from attempting to follow https://forum.openwrt.org/t/configure-vpn-only-for-1-vlan/125134/6:


root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd54:d324:dfaa::/48'

config interface 'lan'
        option proto 'static'
        option ipaddr '192.168.10.1'
        option netmask '255.255.255.0'
        option device 'eth0.10'

config interface 'wan'
        option proto 'dhcp'
        option device 'eth1'

config interface 'vlan20'
        option proto 'static'
        option ipaddr '192.168.20.1'
        option netmask '255.255.255.0'
        option device 'eth0.20'

config interface 'vlan30'
        option proto 'static'
        option ipaddr '192.168.30.1'
        option netmask '255.255.255.0'
        option device 'eth0.30'

config device
        option name 'br-lan'
        option type 'bridge'

config interface 'openvpn'
        option proto 'none'
        option device 'tun0'

config rule
        option in 'lan'
        option lookup '100'

config rule
        option in 'vlan30'
        option lookup '100'

config route
        option interface 'wan'
        option target '0.0.0.0'
        option netmask '0.0.0.0'
        option metric '200'
        option table '100'
root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'

config dhcp 'lan'
        option interface 'lan'
        option start '2'
        option limit '50'
        option leasetime '48h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'
        option force '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'vlan20'
        option interface 'vlan20'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option force '1'

config dhcp 'vlan30'
        option interface 'vlan30'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option force '1'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'vlan20'
        option input 'ACCEPT'
        option output 'ACCEPT'
        list network 'vlan20'
        option forward 'ACCEPT'

config zone
        option name 'vlan30'
        option input 'ACCEPT'
        option output 'ACCEPT'
        list network 'vlan30'
        option forward 'ACCEPT'

config forwarding
        option src 'vlan20'
        option dest 'wan'

config forwarding
        option src 'vlan30'
        option dest 'wan'

config zone
        option name 'vpnfirewall'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'openvpn'

config forwarding
        option src 'vlan20'
        option dest 'vpnfirewall'

When I connect to VLAN20 I have a public IP address from the VPN server but when I connect to VLAN10 or 30 I am unable to get any internet connection (able to access router still)

Would anyone be able to help point out what I'm doing wrong? Thank you!

2

You might also need this for vlan10 and vlan30?

3

I'm not exactly sure if I do - if I want just VLAN20 on the VPN network wouldn't that be the only one on the VPN firewall, then the rest on WAN? Correct me if I'm wrong on that, all of these rules are new to me

I tried setting it for VLAN10, changing my PC port to VLAN10 and rebooting, saw no change

4

My bad I thought you wanted to route those via the VPN.

You mention vlan10 but I only see lan, vlan20 and vlan30

It looks like you want lan and vlan30 via the WAN.

I think making a table for WAN needs a gateway e.g.:

config route
	option interface 'wan'
	option target '0.0.0.0/0'
	option table '100'
	option gateway '192.168.0.1'

But your gateway will be different, you can get the gateway with:
ifstatus wan | grep nexthop | awk '{print $2}'

But it is often easier to turn it around e.g. make WAN the default by adding in the VPN config:
pull-filter ignore "redirect-gateway"

Then you make a table with the VPN as default and that does not need a gateway as it is a point-to-point connection.

See: https://openwrt.org/docs/guide-user/network/routing/pbr_netifd#route_lan_to_openvpn

5

After setting the gateway I am able to get public IP from WAN on VLAN10 (LAN interface) and VLAN30 and VPN IP from VLAN20

Thanks for the help!

1 Like
6

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.