[Solved]Adding a Vlan for the VPN interface

Installing and Using OpenWrt Network and Wireless Configuration
1

Hi all.
I apologize for my English, I use a translator to create a message.
To continue the topic access-point-with-wireguard, I would like to ask you how to add a VLAN to the newly created 'VPN' interface. I want that when the cable is connected to port number 1, it is automatically added to the subnet 192.168.2.1 and also connected via VPN Wireguard. Please specify what needs to be changed in the configuration.

My configuration:

**root@OpenWrt:~# cat /etc/config/network**

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd32:543a:9d0a::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.0.251'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option gateway '192.168.0.1'
        list dns '192.168.0.1'

config device
        option name 'eth0.2'
        option macaddr 'b0:be:76:e0:b6:57'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '6t 2 3 4'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '6t 0'

config interface 'wg0'
        option proto 'wireguard'
        option private_key 'xxx'
        list addresses '10.0.0.2/32'
        option mtu '1420'
        list dns '1.1.1.1'
        list dns '1.0.0.1'

config wireguard_wg0
        option description 'xxx'
        option public_key 'xxx'
        option private_key 'xxx'
        list allowed_ips '0.0.0.0/0'
        option route_allowed_ips '1'
        option endpoint_host 'xxx'
        option endpoint_port 'xxx'
        option persistent_keepalive '25'

config device
        option type 'bridge'
        option name 'br-vpn'
        option bridge_empty '1'
        option mtu '1500'

config interface 'VPN'
        option proto 'static'
        option device 'br-vpn'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'

config device
        option type '8021q'
        option ifname 'br-lan'
        option vid '3'
        option name 'br-lan.3'

config interface 'VLAN3'
        option proto 'static'
        option device 'br-lan.3'
        list ipaddr '192.168.2.1'
        list dns '192.168.2.1'

config switch_vlan
        option device 'switch0'
        option ports '6t 1'
        option vlan '3'

**root@OpenWrt:~# cat /etc/config/dhcp**

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'VPN'
        option interface 'VPN'
        option start '100'
        option limit '150'
        option leasetime '12h'

config host
        option name 'Telek'
        list mac '00:51:ED:C6:D2:EC'
        option ip '192.168.2.194'
        option leasetime 'infinite'

config dhcp 'VLAN3'
        option interface 'VLAN3'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option ignore '1'

**root@OpenWrt:~# cat /etc/config/firewall**

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'
        list network 'lan'

config zone
        option name 'vpn'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'VPN'
        list network 'VLAN3'

config rule
        option name 'VPN_DHCP'
        list proto 'udp'
        option src 'vpn'
        option dest_port '67-68'
        option target 'ACCEPT'

config rule
        option name 'VPN_DNS'
        option src 'vpn'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'Block_VPN_from_Lan'
        list proto 'all'
        option src 'vpn'
        option dest 'lan'
        list dest_ip '192.168.0.1/24'
        option target 'REJECT'

config zone
        option name 'wg_client'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wg0'

config forwarding
        option src 'vpn'
        option dest 'wg_client'

Thank you for your help!

2

Remove this :point_up: and add eth0.3 to br-vpn.

config device
        option type 'bridge'
        option name 'br-vpn'
        list ports 'eth0.3'

config interface 'VPN'
        option proto 'static'
        option device 'br-vpn'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'

config switch_vlan
        option device 'switch0'
        option ports '6t 1'
        option vlan '3'

Make sure port 1 corresponds to physical port LAN1.
Sometimes the ports are numbered in reverse order.

1 Like
3

Thanks a lot for the quick response. The configuration is working!

1 Like
4

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.