Seeking Advice on Directly Passing WAN IP to LAN without Using NAT on OpenWRT Device

For Developers
1

Hello,

I have implemented a network auto-switching device using OpenWRT and have configured it to switch between various WANs conditionally using mwan3.

However, I am looking to add an additional configuration but am unsure how to proceed.

Currently, with two WANs connected (wan1, wan2), my device allows communication with the LAN through only one of the WANs at a time.

I am wondering if there's a way to pass the WAN's IP directly to the LAN, instead of using internal IPs.

For instance, if we have:

  • wan1: 333.333.333.x
  • wan2: 777.777.777.x

The connection through the WANs is currently processed to 192.168.1.X via NAT.

I would like to output using the selected WAN's IP, for example, have the LAN go down as 333.333.333.x for wan1.

The reason for this setup is that my device only selects the WAN, and there's another network device below it serving as a firewall.

If you have any good ideas or methods, please let me know.

Thank you.

image
image701×103 1.8 KB

2

What are the conditional criteria?

In general, if the criteria is network connectivity based, the part shown as "my project" needs a way to get network connectivity to test that criteria. Generally, the only way it can do that is by actually using the IP address from the wan, unless you have some other proposed method.

Why not make your project the main router/firewall as well as providing the mwan3 service?

1 Like
3

Thank you for your response. It seems that incorporating firewall functionality into this project would be the best solution. However, in this network, the role of my project is limited to network switching only, and the firewall is managed by a separate project. This arrangement cannot be changed.

Therefore, the method involves aligning the settings between the firewall project and my network switching device, but even this is not possible.

The firewall project expects our project to pass the WAN's IP without any conditions. T.T

4

You stated earlier:

What are those conditions?
Then...

This contradicts your earlier statement.

Please clarify.

1 Like
5
  1. I have configured the policy in mwan3. I adjusted the metrics and weight values for wan1 and wan2, resulting in wan1 being used preferentially when both wan1 and wan2 are available.
  2. It seems to be a translation error. ^^; The firewall has a fixed IP entered, which is the IP of the WAN.

I apologize for any errors in my translation due to my limited English proficiency. Thank you for your understanding.

I am looking for a solution to this problem. Please help me.

6

What is the IP address (or the desired IP) on the wan of the router/firewall? Is it an RFC1918 address (i.e. 192.168.1.x) or is it supposed to be the actual wan address (i.e. 333.333.333.x in your example)?

1 Like
7

The firewall wants to receive the 333.333.333.x! It desires to obtain the actual WAN IP and then convert it to an internal IP within the firewall.

8

I think this is going to be very challenging, if not impossible.

But, just to flesh this out a bit more...
Let's say 333.333.333.x goes down... your "my project" would then failover to send 777.777.777.x to the downstream router.

How does the downstream router know to change its IP address? If it doesn't change the address, it won't work. So the downstream wan address needs to be changed by some mechanism. How does that happen?