Port Forwarding on Fritz!Box, two subnet, OpenWrt as a gateway?

Installing and Using OpenWrt Network and Wireless Configuration
1

I have a problem that I don't know how to solve:
I have a Fritz! Box as my main internet router and this is on the 192.168.1.X / 24 subnet, this is connected directly to an unmanaged switch, and there are a number of connected devices all belonging to the 192.168.1.X subnet.

I discovered later that there are connected to the same switch a series of devices, servers and video surveillance on a 10.0.3.X subnet, none of these devices have dual IPs on both subnets and there is no additional gateway router.

Here an image to better represent:

I have been asked to open some ports on the Fritz! Box to 10.0.3.X devices, but it is not possible because the Fritz! Box can only work on its subnet.

From the fritz! Box control panel I see that I can generate a static route to 10.0.3.0/24 through a gateway with an IP 192.168.1.X.
So I was hoping to be able to install an inexpensive router with OpenWrt and assign two IPs to ETH0 and configure it so that it can act as a gateway between the two subnets.

I wanted to do this: https://ibb.co/TrwZLcB

I tried to configure it like this:
config interface 'lan'

  • option type 'bridge'*
  • option ifname 'eth0'*
  • option proto 'static'*
  • option ipaddr '192.168.1.2'*
  • option netmask '255.255.255.0'*

config interface 'lan2'

  • option type 'bridge'*
  • option ifname 'eth0'*
  • option proto 'static'*
  • option ipaddr '10.0.3.1'*
  • option netmask '255.255.255.0'*

But it doesn't seem to work, the OpenWrt router only responds to the IP 192.168.1.2 and I don't know if once configured so it allows communication between the two subnets.

Is there anyone who has any advice on this?

2

It works, I have the same kind solution as you, only I use two subnets in the 192.168 range.

But your 192.168.1.2 openwrt should be connected using the WAN port, with static 192.168.1.2 IP or dhcp client, and use the 10. subnet on the LAN side.

3

A physical port (eth0) can only be in one bridge.

You can assign two IP addresses to the same bridge with the @lan1 notation for lan2, or if you're running 21.02 or trunk, the new network config syntax where bridges are defined separately from layer 3 networks.

Note that there is no security here since a camera or other device can easily change its IP address and become part of the more privileged network.