[Solved]Access Point with Wireguard VPN via Wifi

Installing and Using OpenWrt Network and Wireless Configuration
1

Hi all.
I apologize for my English, I use a translator to create a message. I created an access point using the instructions, I will leave the links at the end, everything works well, but at the moment I have created an additional WireguardVPN interface, and deleted all interfaces and rules related to the Wan. I need the devices to use a VPN when using wi-fi with the name SSID: Wireguard5G.Please tell me how this can be done and what needs to be changed in the configuration?
I used instructions to set up:
bridgedap
guestwifi_dumbap
Here's my config files below:

**root@OpenWrt:/etc/config# cat network**

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd32:543a:9d0a::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.0.251'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option gateway '192.168.0.1'
        list dns '192.168.0.1'

config device
        option name 'eth0.2'
        option macaddr 'b0:be:76:e0:b6:57'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '1 2 3 4 6t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '0 6t'

config interface 'wg0'
        option proto 'wireguard'
        option private_key '***'
        list addresses '10.0.0.2/32'
        option mtu '1420'
        list dns '1.1.1.1'
        list dns '1.0.0.1'

config wireguard_wg0
        option description '***'
        option public_key '***'
        option private_key '***'
        list allowed_ips '0.0.0.0/0'
        option endpoint_host '***'
        option endpoint_port '***'
        option persistent_keepalive '25'

config device
        option type 'bridge'
        option name 'br-vpn'
        option bridge_empty '1'
        option mtu '1500'

config interface 'VPN'
        option proto 'static'
        option device 'br-vpn'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'

config route
        option interface 'wg0'
        option target '0.0.0.0/0'
        option metric '0'
        option table '1'
        option disabled '1'

config rule
        option in 'VPN'
        option dest '0.0.0.0/0'
        option lookup '1'
        option out 'wg0'
        option disabled '1'

**root@OpenWrt:/etc/config# cat dhcp**

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'VPN'
        option interface 'VPN'
        option start '100'
        option limit '150'
        option leasetime '12h'

**root@OpenWrt:/etc/config# cat wireless**

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/10300000.wmac'
        option channel '1'
        option band '2g'
        option htmode 'HT20'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid '***'
        option encryption 'psk2'
        option key '***'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'pci0000:00/0000:00:00.0/0000:01:00.0'
        option cell_density '0'
        option htmode 'VHT80'
        option band '5g'
        option channel 'auto'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'VPN'
        option mode 'ap'
        option ssid '***'
        option encryption 'psk2'
        option key '***'

**root@OpenWrt:/etc/config# cat firewall**

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'
        list network 'lan'

config zone
        option name 'vpn'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'VPN'

config rule
        option name 'VPN_DHCP'
        list proto 'udp'
        option src 'vpn'
        option dest_port '67-68'
        option target 'ACCEPT'

config rule
        option name 'VPN_DNS'
        option src 'vpn'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'Block_VPN_from_Lan'
        list proto 'all'
        option src 'vpn'
        option dest 'lan'
        list dest_ip '192.168.0.1/24'
        option target 'REJECT'

config forwarding
        option src 'vpn'
        option dest 'lan'

Thank you in advance for your help.

2

Basically you do not have to do anything but setting up a guest wifi on a dumb AP and WireGuard client.

The Guest wifi will automatically take the default route via the VPN if setup properly.

You have to add: option route_allowed_ips '1' otherwise there is no default route

You can remove the following you should not need it:

For the firewall create a WG zone:

config zone
	option name 'wg_client'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wg0'

add forwarding:

config forwarding
	option src 'vpn'
	option dest 'wg_client'
2 Likes
3

Thanks a lot for the answer, I'll try to fix the configuration now.

1 Like
4

@egc
Thanks, everything is working.
I am very grateful to you!

1 Like
5

Great to hear it is working and that I could help

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Thanks! :slight_smile:

6

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.