OpenWrt 25.12.2 as WiFi Extender with Relayd - no internet on tun0

Installing and Using OpenWrt Network and Wireless Configuration
1

Hello,

I’ve configured my OpenWrt 25.12.2 router to be used as WiFi Extender with Relayd using instruction on https://openwrt.org/docs/guide-user/network/wifi/relay_configuration#wi-fi_extenderrepeater_with_relayd and it works.
I also have an OpenVPN server on this router and it worked correctly in my previous configuration, where my router was a simple Access Point with cable internet,
But after changing it to WiFi Extender (I only can connect the router using WiFi), when I connect with OpenVPN, there is no internet on the tun0 device.
My routing table looks like this:

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 192.168.1.1 0.0.0.0 UG 0 0 0 phy1-sta0
192.168.1.0 * 255.255.255.0 U 0 0 0 phy1-sta0
192.168.2.0 * 255.255.255.0 U 0 0 0 br-lan
192.168.9.0 * 255.255.255.0 U 0 0 0 tun0

Can You, please, help me to configure my router, so that the vpn connection will work correctly again?

Regards,
Tomek

2

Here are my network and firewall configs:

cat /etc/config/network

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option packet_steering '1'
option ula_prefix 'fdc5:1bbf:f7c7::/48'
option dhcp_default_duid '000408c076a646504225a443c30eb8213dfa'

config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
list ports 'wan'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.2.1'
option netmask '255.255.255.0'
option ip6assign '60'
option multipath 'off'

config interface 'wwan'
option proto 'static'
option ipaddr '192.168.1.30'
option netmask '255.255.255.0'
option gateway '192.168.1.1'
list dns '192.168.1.1'
option multipath 'off'

config interface 'repeater_bridge'
option proto 'relay'
option ipaddr '192.168.1.30'
list network 'lan'
list network 'wwan'
option multipath 'off'

# cat /etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone 'lan'
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        list network 'wwan'

config include
        option path '/etc/firewall.user'
3
  • you don't really provide any context about the OpenVPN setup
    • running OpenVPN on a wireless extender is 'possible', but rarely a good idea
      • in terms of how your extender sits on the network
      • its routing (uplink/ downlink
      • and the stability of this wireless connection
  • there is no indication about your wireless config
  • I don't see relayd being (correctly) configured here
    • if you don't have to use relayd, don't - prefer WDS/ 4addr (only possible if your uplink router runs OpenWrt)
  • wwan and repeater_bridge are conflicting, and neither of them would be in line with relayd

(this is merely a 10'000 ft overview, I haven't done a detailed analysis).

I do recommend to factory reset the device and to start slowly from scratch again, don't even attempt the OpenVPN until you have the repeater (preferably using WDS/ 4addr, with OpenVPN maybe as a routed client, relayd really is the least favourable option, it is broken by design and only hangs on by thread).

4

Hello,

My hardware configuration is as follows:

  1. Fiberhost with optical fiber that connects using RJ45 to 2. to its WAN 2.5G port.
  2. ZTE H6645P V2 - router from my cable provider connects with 1.
  3. ASUS RT-AC57U v1 using OpenWrt 25.12.2. Properly configured as Extender using Relayd.

Before this I had other configuration:

  1. Cable Modem that connects using RJ45 to 2. to its WAN port
  2. ASUS RT-AC57U v1 using OpenWrt 25.12.2. Configured as an Access Point with working OpenVPN Server using https://openwrt.org/docs/guide-user/services/vpn/openvpn/server

So after changing the configuration to Fiberhost,I’ve decided to use ASUS router as an Extender. But because the ZTE router is not running OpenWrt, as I understand, I must use the Relayd configuration to have working extended network. So that’s what I did and the Internet is working properly via Wi-Fi from both routers.

My main problem is the OpenVPN Server, which no longer works in this new configuration.

To sum it up:

  • I have working configuration with Extender using Relayd
  • OpenVPN needs to be configured differently, but sadly I don’t know how.

Regards,
Tomek

5

Hello,

I’ve updated to version 25.12.3 without keeping the configuration and I’ve configured from scratch the https://openwrt.org/docs/guide-user/network/wifi/relay_configuration#wi-fi_extenderrepeater_with_relayd .

My extended network is properly working (I have a printer connected to ZTE and I can print from the extended network).

So my main question is: how can I configure on this setup the vpn server? It must be configured on OpenWrt. My server.conf from previous configuration (taken from buckup) looks like this:

user nobody
group nogroup
dev tun
port 27416
proto tcp
server 192.168.9.0 255.255.255.0
topology subnet
client-to-client
keepalive 10 60
persist-tun
persist-key
push "dhcp-option DNS 192.168.9.1"
push "dhcp-option DOMAIN lan"
push "redirect-gateway def1"
push "persist-tun"
push "persist-key"

Regards,

Tomek

6

Better use proto tcp-server

I am missing the certificate and keys, it is easier nowadays to set those inline
DH key is not necessary just use

dh none
ecdh-curve secp384r1

Did you configure the firewall?

What does the openvpn log show?
Do you see an interface (tun1) with ifconfig

I have never done this on a wifi extender with relayd, I would avoid that like the plague. Consider using a different solution, if an ethernet cable is not possible use powerline or moca adapters and if that is not feasible research another means of wireless connection like WDS.

Do you have a Public IPv4 address on the main router?
Did you set a port forward on the main router?

Note if you want to have internet access from connected openvpn clients you have to masquerade the openVPN traffic on the lan interface or set a static route on the main router for the return traffic