I have OpenWrt configured on my router to bridge wan and lan - works fine, and I can access the GUI (web interface) from the wan side, just like I want (it's not a security issue, this is all behind my network gateway, internal to my home lan).
But - I can't seem to bridge wwan to that same bridge. I can assign wwan to the same firewall zone as wan, and that's fine, but I want to bridge them => access the GUI from wwan. Is there an easy way to do this?
This is not directly possible because the 802.11 standards do not account for a wifi > wired bridge (only wired > wifi).
You can use an upstream wifi network and route to a downstream network (which will necessarily be a different subnet), but bridging (same subnet) is not possible.
That said, there are two ways to do this:
if both devices (main router/AP and wireless-bridge device) run OpenWrt, you can use WDS -- this works best if both devices use the same wifi chipset.
If the upstream device is not running OpenWrt, you'll use relayd to achieve this goal.
Why not? Just curious. They are both network interfaces, on the same subnet (wwan and wan I mean) - just slightly confused. I can access the GUI on wan, because it's bridged to lan, but not wwan.
Makes sense! But I can also just open the firewall (Traffic Rule), to allow http (port 80) on wwan, agreed? Not a big deal, again was just curious - and figured just bridging them would make it simple.
It has to do with the way that MAC addresses are implemented in the 802.11 standards.
I'm not exactly sure what you mean here. But accessing the router/AP itself is not the issue, it's the 'downlink' (ethernet and/or wifi) that doesn't work unless you use an alternate method (i.e. WDS/4addr, relayd, or even 802.11s mesh).
If you're talking about accessing the device itself, sure. In fact, if your upstream network is fully trusted, you can set the wan zone input rule to accept.
It's possible we're getting our wires crossed bit, though, and I may be answering things that aren't directly related to your question/issue. Can you elaborate on what it is that you are hoping to achieve (end goal)?
I want to take an old AP / router I have around, use it as a NUT UPS monitor ... but where it will be, there is only Wi-Fi, no hard wire => so upstream (from the router) is wireless, but still want to be able to connect to the OpenWrt web UI - thinking the best way is to allow port 80 through, on the wan / wwan side, agreed?
Ah... that helps! Thank you. I very much misunderstood what you were trying to do (and this was likely my fault -- skimming too quickly)
I did exactly this! Except I did mine with ethernet.
Actually, because you aren't trying to bridge wifi > ethernet or wifi > wifi, you don't need to make this a wwan at all -- it can be a wlan client. This would make sense because you said that your upstream network is fully trusted.
I can help you make that change...
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
Now, remove the device br-lan from the lan interface:
remove wwan and wan from the wifi network (leaving only lan):
Then reboot the device and it should get an address via DHCP from your network on its lan... you'll have full access to administer the device since the link is with the lan (and not the wan which would be firewalled).
Brilliant! Thanks so much. And that makes sense ... assign wireless to lan (as a client), it doesn't need to be wwan. I couldn't see the forest for the trees . That works perfectly, appreciate it!
Just one last question - if I were to connect a device to one of the lan switch ports then - disable DHCP on the lan interface, so then it is sent upstream?
Thanks again!
FYE, side note - but I still have some VLAN settings in place. I can't remember if they were there by default or not, so I'm not messing with them. Just in case .
This won't work at all. In other words, the ethernet ports will probably appear dead. This is the context I was talking about with the wifi > wired bridge that is not (directly) possible. You'd need to implement something like WDS or relayd.
We can clean them up if you want, but no pressing need, IMO.
If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Thanks!