Hello LEDE-Forum,
It would be great if you could help me with this problem.
My router is the TP-Link Archer C7.
It runs a OpenVPN Client connection to a paid remote VPN service. It does work without problems.
Addtionially i created a guest wifi network which should not be routed through my VPN connection. I was not able to configure this (long unsuccessful hours with iptables, ip route and ip rule).
My network configuration for openvpn:
uci set network.VPNProvider=interface
uci set network.VPNProvider.proto='none'
uci set network.VPNProvider.ifname='tun_pty'
uci set network.VPNProvider.delegate='0'
My firewall configuration for openvpn:
uci add firewall zone
uci set firewall.@zone[-1].forward='REJECT'
uci set firewall.@zone[-1].output='ACCEPT'
uci set firewall.@zone[-1].name='VPNZone'
uci set firewall.@zone[-1].input='REJECT'
uci set firewall.@zone[-1].masq='1'
uci set firewall.@zone[-1].mtu_fix='1'
uci set firewall.@zone[-1].network='VPNProvider'
uci add firewall forwarding
uci set firewall.@forwarding[-1].dest='VPNZone'
uci set firewall.@forwarding[-1].src='lan'
The configuration of the guest network:
uci set network.guest=interface
uci set network.guest.proto="static"
uci set network.guest.ipaddr="192.168.10.1"
uci set network.guest.netmask="255.255.255.0"
The firewall zone configuration of the guest network:
uci add firewall zone
uci set firewall.@zone[-1].name="guest"
uci set firewall.@zone[-1].network="guest"
uci set firewall.@zone[-1].input="REJECT"
uci set firewall.@zone[-1].forward="REJECT"
uci set firewall.@zone[-1].output="ACCEPT"
The firewall forwarding configuration of the guest network:
uci add firewall forwarding
uci set firewall.@forwarding[-1].src="guest"
uci set firewall.@forwarding[-1].dest="wan"
As long the OpenVPN client is not active the guest-network does work as intended (it is isolated to my lan and routing without VPN) but when the OpenVPN client is active I need to add this Firewall Forwarding because the network packets are send to VPNZone (What I do not understand...):
uci add firewall forwarding
uci set firewall.@forwarding[-1].src="guest"
uci set firewall.@forwarding[-1].dest="VPNZone"
If any information is missing, I will complete it.