Please help me to separate vpn and wan traffic via two different ethernet ports

[bulat]

@vgaetera

uci set network.@switch_vlan[1].vid="2" uci set network.@switch_vlan[2].vid="3" uci commit network service network restart

my Wireguard vpn interface is still down

[ulmwind]

OK, what is your question?
You can create VLANs in GUI. See, what happens with contents of the file /etc/config/network. In your configuration WAN is member of tagged 3 VLAN, remember it in configuring interfaces.

[vgaetera]

@bulat

my Wireguard vpn interface is still down

Check this thread:

Wireguard interface not working properly after reboot

I have wireguard successfully setup and working on my device in a "full vpn" style mode (allowed ips 0.0.0.0/0, and route allowed ips checked). Everything works until a reboot (which unfortunately happens often with power outages in my area). After reboot, the wg interface is up yet the RX always shows 0 bytes. I can ping the wg endpoint directly, so the internet is working. I've also tried restarting the network (via /etc/init.d/network) and bringing the wg iface down/up with luci and ip. No …

[simon_b]

Thanks heaps for this advice @vgaetera! I was able to achieve a similar setup with two separate WLANs.

I did so with the use of these two resources:

• Configure a guest WLAN using the Luci web-interface
• VPN Policy-Based Routing (applying a policy routed to WAN for the second subnet / WLAN)

@bulat I'm sure you could achieve something similar for your use case.

[bulat]

It was my mistake. While I was configuring the new VLAN interface, I entered the default gateway. After removing gateway, vpn began to work again.

[bulat]

I used following solution to get internet working on my second vlan. ip route add default via 10.10.1.1 table 10 ip rule add from 192.168.1.187 table 10
https://forum.openwrt.org/t/solved-2-vlans-and-no-internet-on-1-vlan/8591/9?u=bulat

Could you please explain to my how to add it to startup section?

Also when I tried to enter whole subnet ip rule add from 192.168.1.0/24 table 10, my console hang and Luci didn’t respond.

Should I use solution mention above or use policy based solution?

[bulat]

Thank you!!! this solution does work!!!

[bulat]

@vgaetera

uci set network.@switch_vlan[1].vid="2" uci set network.@switch_vlan[2].vid="3" uci commit network service network restart

I didn't apply these commands, Do I need to use them for better performance?

[vgaetera]

It seems not necessary unless you have issues binding port IDs to VLANs.

[bulat]

@vgaetera

Try this way:

uci set network.wg.ip4table="10"
uci set network.wg.ip6table="10"
uci set network.lan.ip4table="10"
uci set network.lan.ip6table="10"
uci commit network
service network restart

It should isolate your wg and lan interfaces to a separate routing table.

Oh, it drives me crazy. I am truing to replicate my configuration from scratch, but for some reason it doesn’t work anymore.

Can you explain to me what does it exactly do? What does this uci set network.lan.ip4table="10" line do? Does network.lan correspond to my lan interface? And I assume that lan interface is the interface connected to vpn server.

[vgaetera]

@bulat

Can you explain to me what does it exactly do?

It should create a separate routing table and a set of rules to utilize it for the mentioned interfaces.

[bulat]

I tried and tried but, I can get it woking using uci set network.wg.ip4table="10" uci set network.wg.ip6table="10" uci set network.lan.ip4table="10" uci set network.lan.ip6table="10" uci commit network service network restart

probably I was connected to wifi, and I got confused.

[bulat]

Could you please tell me how to run following commands at startup?
ip route add default via 10.10.1.1 table 10, ip rule add from 192.168.1.187 table 10

[vgaetera]

uci set network.route1="route"
uci set network.route1.target="0.0.0.0/0"
uci set network.route1.gateway="10.10.1.1"
uci set network.route1.table="100"
uci set network.rule1="rule"
uci set network.rule1.src="192.168.1.187"
uci set network.rule1.lookup="100"
uci commit network
/etc/init.d/network restart

You can also configure it via web interface.

[ulmwind]

I think, vgaetera's answer it too complicated. I answer much simpler.
You should add 'route' and 'rule' in /etc/config/network Add sections and see, what happens with routing table. vgaetera gave you uci-commands, I think, it is too complicated. In any case result of uci-commands is modifying of /etc/config/network I recommend you modify it by hands.

https://openwrt.org/docs/guide-user/network/routes_configuration
https://openwrt.org/docs/guide-user/network/ip_rules

[bulat]

I added

ip route add default via 10.10.1.1 table 10 up rule add from 192.168.1.187 table 10

to /etc/rc.local.

Now my setup is fully functional.
But can you tell my how to add the whole subnet except one ip(192.178.1.1)?

[bulat]

@vgaetera

uci set network.route1="route"
uci set network.route1.target="0.0.0.0/0"
uci set network.route1.gateway="10.10.1.1"
uci set network.route1.table="10"
uci set network.rule1="rule"
uci set network.rule1.src="192.168.1.187"
uci set network.rule1.lookup="10"
uci commit network
service network restart

I don’t know why, but it didn’t work for me.

[bulat]

Unfortunately my solution is not as elegant as vgaetera’s, but it works.

[vgaetera]

@bulat

I added [...] to /etc/rc.local .

Note, that /etc/rc.local doesn't interact with network service properly, so any sort of race condition as well as network interface or service restart will break the configuration.

@bulat

But can you tell my how to add the whole subnet except one ip(192.178.1.1)?

The only way to exclude it is to override the current configuration with another route or rule.

[ulmwind]

Try to use 'filter' by 'network', not by 'ip':
https://openwrt.org/docs/guide-user/network/ip_rules
config rule
option in 'lan'
option lookup '10'
Also it could be done via command, but I don't know, how to specify interface in OpenWRT-implementation (iif maybe, but it is device, not name of interface).