Yes. But make sure the SSID is different than your upstream netowrk.
No, leave it as it is by default (192.168.1.1/24)
No, connect the wan port of the OpenWrt router (that you are configuring now) to the lan port of your upstream router.
Yes.
if i leave it as default ip it is not in my network range and my openwrt device is a pi4 so it only has 1 ethernet
Ah... I didn't know that you were using a Pi4.
Here's the summary of the problem.
- your lan devices are going to use your main router as their gateway. they won't even be aware of the OpenWrt VPN configuration running on the Pi4.
- You need to tell the lan devices to use the Pi4 as the gateway. This can be achieved in a few ways, but it is critical to know more about your goals.
Do you want all devices to use the VPN tunnel?
What is your main router (is it running OpenWrt)?
my main router dose not run openwrt and i can not access its control pannel and what i want from openwrt router is to use it as an accesspoint with a vpn
Ok... so a big caveat here -- the Pi's wifi is terrible. You'll have miserable performance here. But here's what you'll need to do.
- Reset to defaults
- Configure your lan (192.168.254.90/24, gateway 192.168.254.254 and dns either the same or a public DNS as desired).
- Create a new network - you can call it
vpnlanon a new subnet (for example, 192.168.5.1/24) or whatever you want and setup a DHCP server for this network. - Create a new firewall zone for this new network, and set the zone input/output/forward to ACCEPT.
- Allow forwarding from the new zone > lan zone
- Associate the new vpnlan with the wifi.
- enable masquerading on the lan zone
- Test the connectivity of the new network.
so i am at this part Create a new network - you can call it vpnlan, for this do i just follow this tutorial https://www.youtube.com/watch?v=i33nJ1clybE&t=102s
?
I'd recommend following the relevant parts of the Guest Wifi on a dumb AP tutorial.
Your SSID should be associated only with vpnlan.
so only vpn lan in that box
remove the lan from the wifi network.
leave it as unspecified.
No, vpnlan must have a different subnet.
Set it to 192.168.5.1 and remove the gateway.
Yes. That is correct.
Go into the DHCP server and enable that, too
i just did that
Let's take a look at your configuration
Please copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall