Setting up Wifi with openVPN splittunnel

Rudi · May 21, 2020, 4:40pm

Hello together, I´m new here to this Forum and also new to OpenWrt and kinda stuck with my problem. After reading a lot of howto instructions without 100% success I decided to ask here for help.

My Problem:
I wanna use a VPN Server and tunnel all the traffic of one wifi through a vpn.
Later I would like to tunnel just specific devices in my home network but for now the route with all traffic would be enough.

Basically I was able to create a openVPN instance, run it and get an output "Initialization Sequence Completed" therefore I asume it went right.
Also created an interface for the vpn (which has a connection seems good can see RX and TX packages) and one LAN2 with a different subnet and which has a second bridge to my eth0.1. Here I have the first problem because it says

Error: Network device is not present

Then I adapt my firewall settings which I am really unsure if they are correct. Doesnt mater what I do, I still see no changes in location/IP address.
What did I forgot or which settings are wrong?

/etc/config/network

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd86:df51:9b96::/48'

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	option netmask '255.255.255.0'
	option ipaddr '192.168.178.37'
	option gateway '192.168.178.1'
	list dns '192.168.178.1'
	option ip6assign '60'

config interface 'wan'
	option ifname 'eth0.2'
	option proto 'dhcp'

config device 'wan_eth0_2_dev'
	option name 'eth0.2'
	option macaddr '50:d4:f7:82:57:35'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '2 3 4 5 0t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '1 0t'

config interface 'vpn'
	option ifname 'tun0'
	option proto 'none'

config interface 'LAN2'
	option type 'bridge'
	option proto 'static'
	option ipaddr '192.168.170.1'
	option ifname 'eth0.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

/etc/config/firewall

config defaults
	option syn_flood '1'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option network 'lan'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list device 'tun0'
	option network 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.user'

config zone
	option name 'vpn'
	option mtu_fix '1'
	option output 'ACCEPT'
	list device 'tun0'
	option forward 'REJECT'
	option masq '1'
	option network 'vpn'
	option input 'REJECT'

config forwarding
	option dest 'wan'
	option src 'lan'

config forwarding
	option dest 'vpn'
	option src 'lan'

config zone
	option input 'ACCEPT'
	option name 'lan2'
	option output 'ACCEPT'
	option network 'LAN2'
	option forward 'ACCEPT'

config forwarding
	option dest 'vpn'
	option src 'lan2'

config forwarding
	option dest 'wan'
	option src 'lan2'

If you need more output and informations, let me know. Thank you!

lleachii · May 21, 2020, 4:57pm

@Rudi, welcome to the community!

(same applies for OpenVPN)

Rudi · May 21, 2020, 5:38pm

Update: I could connect now my LAN2 to the eth.2 and also created the route and rules recommended from @lleachii. New output.

network:

 config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd86:df51:9b96::/48'

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	option netmask '255.255.255.0'
	option ipaddr '192.168.178.37'
	option gateway '192.168.178.1'
	list dns '192.168.178.1'
	option ip6assign '60'

config interface 'wan'
	option ifname 'eth0.2'
	option proto 'dhcp'

config device 'wan_eth0_2_dev'
	option name 'eth0.2'
	option macaddr '50:d4:f7:82:57:35'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '2 3 4 5 0t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '1 0t'

config interface 'vpn'
	option ifname 'tun0'
	option proto 'none'

config interface 'LAN2'
	option type 'bridge'
	option proto 'static'
	option ipaddr '192.168.170.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ifname 'eth0.2'

config route
	option target '0.0.0.0'
	option table '2'
	option netmask '0.0.0.0'
	option interface 'vpn'

config rule
	option in 'LAN2'
	option dest '0.0.0.0/0'
	option priority '10'
	option lookup '2'

Still no internet connection with the new wifi (OpenWrt). Are the firewall settings ok?


config defaults
	option syn_flood '1'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option network 'lan'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list device 'tun0'
	option network 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.user'

config zone
	option name 'vpn'
	option mtu_fix '1'
	option output 'ACCEPT'
	list device 'tun0'
	option forward 'REJECT'
	option masq '1'
	option network 'vpn'
	option input 'REJECT'

config forwarding
	option dest 'wan'
	option src 'lan'

config forwarding
	option dest 'vpn'
	option src 'lan'

config zone
	option input 'ACCEPT'
	option name 'lan2'
	option output 'ACCEPT'
	option network 'LAN2'
	option forward 'ACCEPT'

config forwarding
	option dest 'vpn'
	option src 'lan2'

config forwarding
	option dest 'wan'
	option src 'lan2'

wireless:

config wifi-iface 'wifinet2'
	option ssid 'OpenWrt'
	option encryption 'psk2'
	option device 'radio1'
	option mode 'ap'
	option network 'LAN2'
	option key 'xxxxxxx'

lleachii · May 21, 2020, 5:43pm

???

You need to make a new network/Interface - eth0.2 is your WAN!

Try eth0.3 (and connect it to a bridge to use WiFi).

Rudi · May 21, 2020, 6:01pm

eth0.3 worked. Great. Seems everthing fine now, thanks

system · May 31, 2020, 6:01pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.