I am very new to OpenWrt and networking in general.
I have setup WireGuard VPN client on my edgerouter x(openwrt 18.06.4).
I would like to use two ethernet ports(1,2) for vpn traffic and the other ethernet ports(3,4) for general internet traffic.
At the moment I get vpn traffic on all ethernet ports.
I spent a week trying different solutions from this forum, but without any success.
root@OpenWrt:~# cat /etc/config/firewall
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option network 'lan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'wan wan6'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config zone
option name 'wgzone'
option forward 'REJECT'
option output 'ACCEPT'
option network 'wg'
option input 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option dest 'wgzone'
option src 'lan'
ip route:
root@OpenWrt:~# ip route list
default dev wg proto static scope link
10.10.1.0/24 dev eth0.2 proto kernel scope link src 10.10.1.104
85.40.41.16 via 10.10.1.1 dev eth0.2 proto static
192.168.1.0/24 dev br-lan proto kernel scope link src 192.168.1.1
Could you please help me to solve this problem!
Many thanks
Yes, I tested it on my router using the commands on the second link.
Not blindly, of course.
Your port numbers should be adjusted to the switch configuration.
Check the switch config:
swconfig list; swconfig dev switch0 show
Then plug in the cable, check the config again and see which port becomes up.
In general case, port IDs don't match port numbers printed on the router.
Can’t I just create new vlan, interface and firewall rules for it using Luci? (It seems easier to do it via web interface)
I actually already created new interface. When I apply firewall rules to my new vlan/interface, my wg(WireGuard) interface dropping connection to my vpn sever.
before creating new vlan interface
root@OpenWrt:~# route:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default * 0.0.0.0 U 0 0 0 wg
10.10.1.0 * 255.255.255.0 U 0 0 0 eth0.3
85.40.41.16 10.10.1.1 255.255.255.255 UGH 0 0 0 eth0.3
192.168.1.0 * 255.255.255.0 U 0 0 0 br-lan
root@OpenWrt:~# ip route list:
default dev wg proto static scope link
10.10.1.0/24 dev eth0.3 proto kernel scope link src 10.10.1.128
85.40.41.16 via 10.10.1.1 dev eth0.3 proto static
192.168.1.0/24 dev br-lan proto kernel scope link src 192.168.1.1
and after crating vlan interface
root@OpenWrt:~# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 10.10.1.1 0.0.0.0 UG 0 0 0 eth0.3
10.10.1.0 * 255.255.255.0 U 0 0 0 eth0.3
85.40.41.16 OpenWrt.lan 255.255.255.255 UGH 0 0 0 eth0.2
192.168.1.0 * 255.255.255.0 U 0 0 0 br-lan
192.168.2.0 * 255.255.255.0 U 0 0 0 eth0.2
root@OpenWrt:~# ip route list:
default via 10.10.1.1 dev eth0.3 proto static src 10.10.1.128
10.10.1.0/24 dev eth0.3 proto kernel scope link src 10.10.1.128
85.40.41.16 via 192.168.2.1 dev eth0.2 proto static
192.168.1.0/24 dev br-lan proto kernel scope link src 192.168.1.1
192.168.2.0/24 dev eth0.2 proto kernel scope link src 192.168.2.1
It creates VLANs with tags 2 and 3 (tag 1 already presents). Numbers in square brackets are just "indices" of virtual array, containing elements - sections of config.
I didn't test the situation when vlan doesn't match vid or when vlan matches vid from another switch_vlan section.
No idea, whether that works properly or not, so either make them math or remove vid from all switch_vlan sections.
OK, what is your question?
You can create VLANs in GUI. See, what happens with contents of the file /etc/config/network. In your configuration WAN is member of tagged 3 VLAN, remember it in configuring interfaces.
