Openwrt as a virtual router

hello,
i am a newbie and trying so hard to learn in my own. anyway i have been learning on my own all these years.
i just installed an ubuntu server to host an openwrt virtual machine.
the installation did go through successfully but here is my challenge.
the virtual router will do the routing between the wan and lan but the physical network cards are connected to the host machine .( ubuntu)
how do i configure the virtual router (openwrt) to use the 2 physical interface on the host machine or is there a way this can be done. should i use vlan? if yes how do i go about cobnfiguring the vlan to pass the traffic from the physical network care to the virtual. do i create virtual network interface? help will be highly appreciated.

You'd probably want to ask around in a virtualization related forum rather than openwrt. In any case, openwrt works well for more complicated virtual network setups. If all you want to do is have a virtual private lan that virtual hosts can communicate on, then the default nat bridge provided by libvirt, for example, will work fine and you don't actually need openwrt for routing or NAT duties. dnsmasq runs on the host and serves as the dns and dhcp source for the software bridge that all the virtual hosts are attached to. Again no need for a virtual router for a simple use case. But if you want to route all the virtual traffic through a VPN or something like that, then openwrt could be useful.

If you start running multiple VM servers, then a VLAN is useful to extend the virtual network between them all. In that case you'd want something like openwrt to perform routing duties between VLANs and your WAN. You also need a managed switch but you could use openwrt on a cheap router (with a built-in vlan capable switch chip) to act as a small one. You could virtualize the gw, of course, and some people like to do that, but I'm not exactly sure why. I find it preferable to run a physical gateway router. There are plenty of cheap, low power options for routing at gigabit speeds so there's really no need to run it virtual.

Same applies for Ubuntu host.

There's also mutiple threads to search on the topic.

Hope this helps.

I think OP is using ubuntu so he's better off following a guide for ubuntu than a virtual box guide.

To bridge virtual interfaces in ubuntu you would first use network manager to create a bridge, then add your physical lan device to that bridge, and then setup ipv4/ipv6 parameters for the bridge interface. The bridge interface is now your ubuntu host's LAN interface.

Then you create a host-only network bridge in network manager but don't bind any physical interfaces to it. Also, be sure the bridge has ipv4/ipv6 turned off.

Assign bridged virtual nics from both the host-only bridge and the LAN bridge to your openwrt VM. The virtual nic on your LAN bridge is openwrt's WAN interface. The host-only bridge virtual nic is the lan side from openwrt's perspective.

Each new VM you create from then on gets a virtual nic on the host-only bridge. Your virtual openwrt is the gateway for all the hosts attached to the host-bridge.

This setup is useful if you just want to play with it or use features like a VPN for all your virtual hosts. Its not strictly necessary (as I described earlier) as the default nat bridge will already do ip assignment and NAT for your VMs attached to that bridge. You only need the GW vm if you want to do something special with the traffic like encrypt it.

I run a setup similar to this but I have multiple host servers and a couple of VLANs dedicated to virtual machines. I run a mix of fully virtualized machines using virtmanager and some containerized instances using lxd. I dont actually use openwrt any more as my gateway, preferring instead to extend my VLANs to my main gateway/router running pfSense. In one case, I do have a virtual network gateway machine with a pure virtual lan behind it but the gateway just runs ubuntu and I configure it with the cli and network manager.

FYI - you don't have to bridge on hosts, you can also do virtually in the OpenWrt.

Nonetheless, the same information applies for any VM Host Software: VMWare player, ESXi, etc.

Depending on how you setup the host, etc. you can also VLAN tag - depending on use case.

The non-bridging option is to use macvlan virtual nics and I wouldn't suggest that can of worms for the OP given their experience level. Another non-bridging option is PCI pass thru of dedicated NICs but thats more of an advanced topic with a lot of caveats. So, yes, on linux you do need to create a bridge on the ubuntu server for every network that you want to expose inside a VM. It works a little differently in windows w/ virtual box or vmware where you can bridge a virtual nic to your lan device without actually having to create a bridge on the host first.

What hypervisor are you running on your Ubuntu server? Some native capability? KVM? Virtual Box? VMware Workstation? Something else?

The nature of your chosen hypervisor may help with determining the configuration required to get connectivity working from guest to host and beyond.

thank you all for your reply.

i am using KVM. i have setup network config using netplan. created a bridge using one NIC on the ubuntu and gave it an ip address from my lan. this is working as expected.
i have created the virtual router (openwrt) created the bridge using virsh (kvm) then attached the router to the bridge network created (hot-bridge). i am about testing if i should add a second bridge using the second NIC card in ubuntu or can the i use one bridge for the 2 NIC.

if using one bridge will work, how then is traffic going out of my host to the internet and from the lan to my host.

the virtual router is intended for physical machines in my office.

please i dont want to install openwrt as the native os. i want to learn the hard way.

thank you.

below is my netplan config

network:
version: 2
renderer: NetworkManager
ethernets:
enp1s0:
dhcp4: false
dhcp6: false

bridges:
br0:
interfaces:
- enp1s0
addresses:
- 10.78.16.90/22
nameservers:
addresses:
- 10.78.16.21
- 8.8.8.8
routes:
- to: default
via: 10.78.19.10

enp2s0:
  addresses:
    - 10.78.16.91/22
  nameservers:
    addresses:
    - 10.78.16.21
    - 8.8.8.8

quicka@qkrouters:~$ virsh net-list
Name State Autostart Persistent

default active yes yes
host-bridge active yes yes

lastly openwrt network config

root@OpenWrt:/# cat /etc/config/network

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fda0:a8c3:30e0::/48'

config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'

openwrt ip add show command output
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br-lan state UP qlen 1000
link/ether 52:54:00:b9:ff:58 brd ff:ff:ff:ff:ff:ff
3: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
link/ether 52:54:00:b9:ff:58 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
valid_lft forever preferred_lft forever
inet6 fda0:a8c3:30e0::1/60 scope global noprefixroute
valid_lft forever preferred_lft forever
inet6 fe80::5054:ff:feb9:ff58/64 scope link
valid_lft forever preferred_lft forever
4: eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
link/ether 52:54:00:20:f3:b1 brd ff:ff:ff:ff:ff:ff

please can someone explain why the 2 interfaces are not showing in /etc/config/network but show in ip add show (eth0 and eth1)

thank you

Good for you! I approve of such an attitude. If only more people had a similar approach to learning new things.

However, while fully approving of your "because I want to" approach, unfortunately I know nothing about KVM, so can't advise directly on how to configure KVM networking. However, if your problem is confined solely to the OpenWRT guest, then I might be able to offer some advice. And even if I can't, there are plenty of smart, creative people on this forum who probably can.

By the way, would you mind editing your post to use code quotations clearly, please? You've got some extracts between working ``` blocks, but not not all of them.

ifconfig and ip addr show the interfaces that exist in your system.

/etc/config/network contains the details of how - or if - your interfaces are configured.

eth0 does appear in /etc/config/network. Look closer...

/etc/config/network defines a logical bridge device, using the real device eth0. This bridge is called br-lan.

In turn, br-lan is assigned an IP address (192.168.1.1). All traffic originating from or arriving at 192.168.1.1 can pass through every device linked to the bridge br-lan. In your case, that's only eth0. On many budget "routers" which people reflash with OpenWRT, the br-lan bridge usually links both eth0 and wlan0 (names may change depending on device), so that the same traffic to/from the LAN can traverse either the Ethernet connection or the wireless connection or both.

If you're only using a single interface, you don't need a bridge. For your config interface lan stanza, you could change the option device entry from br-lan to eth0.

For the purpose of bridge discussions, it's important to keep in mind the distinction between any bridge which might be configured on the host (Ubuntu) and any bridge which might be configured on the guest (OpenWRT).

While I was serious with my praise about wanting to do it the hard way, there are some other aspects you may wish to consider.

If it's your own network, for your own use, and you want to use everything as a learning exercise, then feel free to make it as simple or complex as you like. Knock yourself out. We learn by breaking things. Well, sometimes.

I know my own network is more complex than it probably needs to be, because I use it as my training ground for my day job where I do have to deal with some fairly complex networks.

However, if you're putting something in place for other people to use, then it'd be a good idea to consider making it as simple as possible. If you have a spare computer, it's simpler to install OpenWRT natively than to install a separate OS and then use virtualisation to host OpenWRT. In addition, there are fewer support and security challenges if you install the intended operating system natively.

You've piqued my curiosity, though. While I know VMware Workstation, VMware ESXi and Virtual Box very well, I don't know KVM. But I have a spare system running Ubuntu, so this might be an opportunity for me to learn. I'm already expecting delivery of a new toy to help out another member of the forum; this can get added to the list. I shall start here... https://duckduckgo.com/?q=linux+kvm+for+dummies

Hey @shegemarley. Did you get this running?

I read you are using netplan instead of network manager? Is netplan configured to output for systemd or network manager? If you are trying to learn how to do mass deploys on the cloud then that is fine but you would find network manager easier for initial setup. It has a gui that I find very handly, i.e. nm-connection-editor.

Once you have your kvm instance running and you think the virtual nics are assigned, post the output of "brctl show" to show what bridges you have configured and what nics/virt nics are assigned to them.

If traffic is not passing then you might be hitting firewall rules. I forget what ubuntu installs by default, if it even installs one at all. I usually lock things down with firewalld. You may have to install that. If ufw is installed, instead, remove that crap. Again, there is a gui for managing your firewall rules. Also, network manager and firewalld are integrated. When interfaces come online the firewall assigns the default zone for them and updates the nft tables for you automatically. You can also assign the desired firewall zone to an interface in network manager's config. For an intial setup set the zone to public on all your interfaces and bridges to remove the firewall as a reason for why packets are not getting through. Also check "journalctl -e" for any firewall messages.

Finally, what are you using openwrt for? Are you trying to use it as a gw for a virtual lan or or you trying to virtuallize your internet gateway router?

Dear Mith,
i have not got this fixed so i have decided to do a sketch of what i am trying to achieve and what i have done so far.

thank you

1 Like

I did create the bridge as instructed using one nic, what happens to the second nic.?

I am not doing a mass deploy. i just want to host virtual router to route traffic from lan device to the internet for a small office

Ok, sg.

What I'm hearing is that you want to virtualize an openwrt instance that will serve as a GW between your lan and your ISP. openwrt will provided dhcp services for your LAN, including your virtualization host. Correct?

So far, it sounds like you've been able to expose a lan interface in your openwrt instance but not a wan interface.

Perhaps you are trying to do this with virsh net-create? If so, that could be confusing you. You don't strictly need to create libvirt networks but they are a useful layer of abstraction when you want to migrate an instance between hosts. That doesn't sound like your situation, either.

So this is what I recommend you do.

Use network manger, not netplan, to create two bridges. Don't bother with libvirt's network definition features. They are useful for more advanced use cases. The network manager configuration is as follows.

  • Bridge - LAN

    • In nm-connection-editor, select the Plus button and create a bridge.
    • Set the connection name and interface name both to LAN
    • dhcp client for ip4/ip6 (Note you could statically configure this as well as your host wont get an IP unless openwrt is running)
    • set firewall zone to trusted
    • set to autostart
  • Ethernet - LAN port 1

    • This is added to LAN bridge. In nm-connection-edtitor you can create it straight from the page that configures your bridge when you select ADD.
    • set firewall zone to trusted
    • set to autostart
    • Note that if you are already using the physical interface you added to this port for another nm connection you will need to first remove that other connection.
  • Bridge - WAN

    • In nm-connection-editor, select the Plus button and create a bridge.
    • Set the connection name and interface name both to WAN
    • Set IP option to disabled for both IPV4 and IPV6. You do not want your host to grab an IP from your ISP as your openwrt vm will do that.
    • set firewall zone to trusted
    • set to autostart
  • Ethernet - WAN port 1

    • Add to WAN bridge
    • set firewall zone to trusted
    • set to autostart

Then in the virt-manager gui, edit your openwrt vm. I highly recommend using the gui to get started. You can switch to using xml and virsh when you get more comfortable with it.

  1. Delete existing nics.

  2. Add a nic for your WAN.
    a) Select Network Source to Bridge Device...
    b) Type in WAN for the bridge device (or whatever the name you defined the bridge to be. Verify with brctl show)
    c) Do select virtio for the device model. Dont know if x86 openwrt image includes the virtio drivers but I think it does.

  3. Add a nic for your LAN.
    a) Select Network Source to Bridge Device...
    b) Type in LAN(or whatever the bridge device is called) for the bridge device
    c) select virtio device model

When the vm starts verify that virtual networks have been added to the two bridges by running "brctl show"


Yet another option is to try passing through your physical wan device into the VM and not using a bridge for it at all. Its not difficult to do but depends on your hardware. Get the bridge configuration working first before you try pcie passthru.

thank you Mith
we try this and get back to you

thanks all for your quick response and support. for now, i have jettisoned the idea and decided to go ahead with proxmox. it was quite easier getthing openwrt installed and configured on proxmox.

thank you all for your responses