Stop connecting to internet if wireguard service is stopped/not working

Hi fine folks of this forum, I'm just getting started with openwrt, and very new to networking.
However, I was able to setup what I wanted - going through the forums and online, and I would appreciate some help with the following.

I have used the following guide to setup
https://www.reddit.com/r/openwrt/comments/yyhm7i/one_router_one_wireguard_vpn_two_ssids/

Setup:
Router having 2 SSID's - one with regular connection and the other connecting via wireguard VPN
SSID1: OpenWrt - Regular Connection
SSID2: VPNSSID - wireguard VPN (ex: surfshark, nordvpn etc)

Issue:
The setup is working as expected, but when I'm connected to the VPN SSID and I stop the wireguard service, it's rolling back to the regular internet.
The goal is stop all traffic while I'm connected to the VPNSSID, if the wireguard service is down or is not functioning. So that It wouldn't connect to the internet and leak my IP address (and any other recommended settings that I should consider for my setup)

My Config:


Relevant Info

/etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'xxxx:0061:xxxx::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'wan'
        option proto 'pppoe'
        option username 'user@broadband.com'
        option password 'password'
        option ipv6 'auto'
        option peerdns '0'
        list dns '103.86.96.100'
        list dns '103.86.99.100'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config interface 'wg0'
        option proto 'wireguard'
        option private_key 'EF5Lc7C3gX3jbzL+mxxxxxxxxxxxxxxxx'
        list addresses '10.12.0.20/32'
        list dns '103.86.96.100'
        list dns '103.86.99.100'
        option delegate '0'
        option nohostroute '1'

config wireguard_wg0
        option description 'peer123'
        option public_key 'U3dKnkOJY5P9pxxxxxxxxxxx'
        option private_key 'EF5Lc7C3gX3jbzxxxxxxxxxxxxxx'
        list allowed_ips '0.0.0.0/0'
        list allowed_ips '::0/0'
        option endpoint_host 'subdomain.vpn.com'
        option endpoint_port '51820'
        option persistent_keepalive '25'

config device
        option type 'bridge'
        option name 'brvpn'
        option bridge_empty '1'

config interface 'vpnlan'
        option proto 'static'
        option device 'brvpn'
        option ipaddr '192.168.3.1'
        option netmask '255.255.255.0'

config route
        option interface 'wg0'
        option target '0.0.0.0/0'
        option table '3'

config rule
        option src '192.168.3.0/24'
        option lookup '3'
/etc/config/firewall
config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        list network 'vpnlan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'
        list network 'wg0'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'
/etc/config/wireless
config wifi-device 'radio0'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
        option channel '1'
        option band '2g'
        option htmode 'HT20'
        option disabled '1'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'OpenWrt'
        option encryption 'none'

config wifi-device 'radio1'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
        option channel '36'
        option band '5g'
        option htmode 'VHT80'
        option cell_density '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'OpenWrt'
        option encryption 'none'

config wifi-iface 'wifinet2'
        option device 'radio1'
        option mode 'ap'
        option ssid 'vpnssid'
        option encryption 'none'
        option network 'vpnlan'

Please let me know, if you need any further information.

The keyword to search the wiki would be "kill-switch".

1 Like

create separate firewall zones for your VPNLAN and wg0 interface.

There is some kind of routing fallback logic happening between multiple outgoing interfaces of the same zone. And also sharing the zones conflicts with your segregation concept anyway.

I have never tested this failover purposely, so I do not know the exact failover behavior details. But outline is: don‘t share zones for different outgoing interfaces, if you want to avoid this simple failover behavior.
(anyone reading this and triggering on „failover“: To get predictable failover of multiple WAN interfaces, rather use mwan3)

2 Likes

kill-switch is the magic word indeed.

To elaborate a bit more make a separate firewall zone e.g. vpnlan with same settings as the lan zone and place the network vpnlan in this zone.

Make a separate firewall zone e.g. vpnwg with same settings as the wan zone and place network wg0 in this zone.

Now only forward from vpnlan to vpnwg.

As you are not forwarding from vpnlan to wan like you are doing now but only to vpnwg there is no way out via the wan.

Edit: @Pico was ahead of me

2 Likes

My 5 cents, as methodological conclusion.

Where have you read to add another interface in wan-zone, instead of creating separate one?

It is in the WG wiki :slight_smile:

Hi @egc thanks for the quick reply.

I'm not sure if I'm missing something here, as it's connecting to the internet, after I stop the wireguard interface.
Here are the changes.

Original firewall config

/etc/config/firewall
config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        list network 'vpnlan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'
        list network 'wg0'

config forwarding
        option src 'lan'
        option dest 'wan'

Updated firewall config.

/etc/config/firewall
config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        list network 'vpnlan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'
        list network 'wg0'

config forwarding
        option src 'lan'
        option dest 'wan'

config zone
        option name 'vpnlan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'vpnlan'

config zone
        option name 'vpnwg'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        list network 'wg0'

config forwarding
        option src 'vpnlan'
        option dest 'vpnwg'




OK, thank you. Please, correct it with separate zone, the purpose is to give user instrument, but not to correct him in further discussion.

1 Like

You should create SEPARATE zone for 'vpnlan', not TO UNIFY lan, and vpnlan!

1 Like

The idea is to create separate zones, and configure forwarding independently for them! Please, try to understand idea, not to implement it formally.

1 Like

You are moving in the right direction.

But as @ulmwind stated, you have to remove network vpnlan from the lan zone and remove network wg0 from the wan zone.

Furthermore enable mss clamping (mtu fix) on the vpnwg zone.

Reboot afterwards

1 Like

Thank you for being so patient and coherent in answering my queries @ulmwind @Pico @egc
Your assistance is hugely appreciated!

It took me a while to wrap my head around but I have made the above changes and everything works as expected :smiley:

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.