Trying and failing to add working wireguard/mullvad tunnel to vlan segmented network using managed switch

Installing and Using OpenWrt Network and Wireless Configuration
1

I have been trying to get this to work for several days now. I created the vlan, the firewall zones/rules, the tunnel interface...I load the configuration, get a handshake...there is a trickle of packets/data going through the tunnel but I can't get all of my vlan's data to travel through the wireguard tunnel.

{
        "kernel": "6.6.110",
        "hostname": "OpenWrt",
        "system": "ARMv8 Processor rev 4",
        "model": "GL.iNet GL-MT6000",
        "board_name": "glinet,gl-mt6000",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "24.10.4",
                "revision": "r28959-29397011cc",
                "target": "mediatek/filogic",
                "description": "OpenWrt 24.10.4 r28959-29397011cc",
                "builddate": "1760891865"
        }
}
root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix ''
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        list ports 'lan5'

config interface 'lan'
        option device 'br-lan.1'
        option proto 'static'
        option ipaddr 'xxx.xxx.xxx.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'eth1'
        option proto 'dhcp'
        option macaddr ''
        option peerdns '0'
        option dns '0.0.0.0'

config interface 'wan6'
        option device 'eth1'
        option proto 'dhcpv6'
        option dns '::'
        option peerdns '0'

config device
        option type '8021q'
        option ifname 'br-lan'
        option vid '10'
        option name 'br-lan.10'

config interface 'lan10'
        option proto 'static'
        option device 'br-lan.10'
        option force_link '0'
        option ipaddr 'xxx.xxx.xxx.1'
        option netmask '255.255.255.0'

config bridge-vlan
        option device 'br-lan'
        option vlan '10'
        list ports 'lan3:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '1'
        list ports 'lan2:u*'
        list ports 'lan3:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '30'
        list ports 'lan3:t'

config interface 'lan30'
        option proto 'static'
        option device 'br-lan.30'
        option ipaddr 'xxx.xxx.xxx.1'
        option netmask '255.255.255.0'
        option force_link '0'

config bridge-vlan
        option device 'br-lan'
        option vlan '70'
        list ports 'lan3:t'

config interface 'lan70'
        option proto 'static'
        option device 'br-lan.70'
        option force_link '0'
        option ipaddr 'xxx.xxx.xxx.1'
        option netmask '255.255.255.0'

config bridge-vlan
        option device 'br-lan'
        option vlan '60'
        list ports 'lan3:t'

config interface 'lan60'
        option proto 'static'
        option device 'br-lan.60'
        option force_link '0'
        option ipaddr 'xxx.xxx.xxx.1'
        option netmask '255.255.255.0'

config bridge-vlan
        option device 'br-lan'
        option vlan '50'
        list ports 'lan3:t'

config interface 'lan50'
        option proto 'none'
        option device 'br-lan.50'

config bridge-vlan
        option device 'br-lan'
        option vlan '20'
        list ports 'lan3:t'

config interface 'lan20'
        option proto 'static'
        option device 'br-lan.20'
        option force_link '0'
        option ipaddr 'xxx.xxx.xxx.1'
        option netmask '255.255.255.0'

config bridge-vlan
        option device 'br-lan'
        option vlan '99'
        list ports 'lan3:t'

config interface 'lan99'
        option device 'br-lan.99'
        option proto 'static'
        option ipaddr 'xxx.xxx.xxx.1'
        option netmask '255.255.255.0'
        option force_link '0'
        option type 'bridge'

config interface 'wg_mullvad'
        option proto 'wireguard'
        option private_key ''
        list addresses 'xxx.xxx.xxx.254/32'

config wireguard_wg_mullvad
        option description 'Imported peer configuration'
        option public_key ''
        list allowed_ips '0.0.0.0/0'
        list allowed_ips '::0/0'
        option endpoint_host '1xx.xxx.xxx.78'
        option endpoint_port '51820'
        option persistent_keepalive '25'

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option band '2g'
        option channel 'auto'
        option htmode 'HT40'
        option country 'US'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'Hxxx-xx1'
        option encryption 'psk2+psk3'
        option key ''

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi+1'
        option band '5g'
        option channel 'auto'
        option htmode 'HE160'
        option country 'US'
        option cell_density '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'Hxxx-xx2'
        option encryption 'psk2+psk3'
        option key ''

config wifi-iface 'wifinet2'
        option device 'radio1'
        option mode 'ap'
        option ssid 'Hxxx-xx3'
        option encryption 'psk2'
        option key ''
        option network 'lan10'

config wifi-iface 'wifinet3'
        option device 'radio1'
        option mode 'ap'
        option ssid ' **Mxxxx-xx2**'
        option encryption 'psk2'
        option key ''
        option network 'lan30'

config wifi-iface 'wifinet4'
        option device 'radio1'
        option mode 'ap'
        option ssid '**Oxx-xxA**'
        option encryption 'psk2'
        option key ''
        option network 'lan70'

config wifi-iface 'wifinet5'
        option device 'radio1'
        option mode 'ap'
        option ssid '**Dxxx-xxxx-xF**'
        option encryption 'psk2'
        option isolate '1'
        option key ''
        option network 'lan60'

config wifi-iface 'wifinet6'
        option device 'radio0'
        option mode 'ap'
        option ssid '**Oxx-xxB**'
        option encryption 'psk2'
        option key ''
        option network 'lan70'

config wifi-iface 'wifinet7'
        option device 'radio1'
        option mode 'ap'
        option ssid '**Hxxx-xx2**'
        option encryption 'psk2'
        option key ''
        option network 'lan20'

config wifi-iface 'wifinet8'
        option device 'radio1'
        option mode 'ap'
        option ssid '**Sxx-xxxx-xxE**'
        option encryption 'psk2'
        option key ''
        option network 'lan99'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '0'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option localservice '1'
        option ednspacket_max '1232'
        option noresolv '1'
        option port '5353'
        option dnsforwardmax '1024'
        list server '127.0.0.1#5xx5'
        list server '::1#5xx5'
        list server '1.1.1.1'
        list server '1.0.0.1'
        option logqueries '1'
        option logdhcp '1'
        list interface 'lan'
        list interface 'lan10'
        list interface 'lan20'
        list interface 'lan30'
        list interface 'lan50'
        list interface 'lan60'
        list interface 'lan70'
        list interface 'lan99'
        option interface_done '1'

config dhcp 'lan10'
        option interface 'lan10'
        option start '20'
        option limit '200'
        option leasetime '12h'
        list dhcp_option '6,xxx.xxx.xxx.1'

config dhcp 'lan20'
        option interface 'lan20'
        option start '20'
        option limit '200'
        option leasetime '12h'
        list dhcp_option '6,xxx.xxx.xxx.1'

config dhcp 'lan30'
        option interface 'lan30'
        option start '20'
        option limit '200'
        option leasetime '12h'
        list dhcp_option '6,xxx.xxx.xxx.1'

config dhcp 'lan60'
        option interface 'lan60'
        option start '20'
        option limit '200'
        option leasetime '12h'
        list dhcp_option '6,xxx.xxx.xxx.1'

config dhcp 'lan70'
        option interface 'lan70'
        option start '20'
        option limit '200'
        option leasetime '12h'
        list dhcp_option '6,xxx.xxx.xxx.1'

config dhcp 'lan99'
        option interface 'lan99'
        option start '20'
        option limit '200'
        option leasetime '12h'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '24h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'
        list dhcp_option '6,xxx.xxx.xxx.1'
        list dhcp_option '3,xxx.xxx.xxx.1'
        list dns '::1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'
        option piofolder '/tmp/odhcpd-piofolder'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        list network 'lan10'
        list network 'lan30'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'momnet'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option mtu_fix '1'
        list network 'lan70'

config forwarding
        option src 'momnet'
        option dest 'wan'

config zone
        option name 'Quarantine'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option mtu_fix '1'
        list network 'lan60'

config zone
        option name 'mgmt99'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'lan99'

config forwarding
        option src 'Quarantine'
        option dest 'wan'

config zone
        option name 'vpnsendtotunnel'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'lan20'

config zone
        option name 'vpnzone'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wg_mullvad'

config forwarding
        option src 'mgmt99'
        option dest 'wan'

config rule
        option name 'Allow-momnet-DNS'
        option src 'momnet'
        option proto 'tcp udp'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'Allow-momnet-DHCP'
        option src 'momnet'
        option proto 'udp'
        option dest_port '67-68'
        option target 'ACCEPT'

config rule
        option name 'Allow-Quarantine-DNS'
        option src 'Quarantine'
        option proto 'tcp udp'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'Allow-Quarantine-DHCP'
        option src 'Quarantine'
        option proto 'udp'
        option dest_port '67-68'
        option target 'ACCEPT'

config rule
        option name 'Allow-VPN20-DNS'
        option src 'vpnsendtotunnel'
        option proto 'tcp udp'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'Allow-VPN20-DHCP'
        option src 'vpnsendtotunnel'
        option proto 'udp'
        option dest_port '67-68'
        option target 'ACCEPT'

config rule
        option name 'Allow-mgmt99-DNS'
        option src 'mgmt99'
        option proto 'tcp udp'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'Allow-mgmt99-DHCP'
        option src 'mgmt99'
        option proto 'udp'
        option dest_port '67-68'
        option target 'ACCEPT'

config forwarding
        option src 'vpnsendtotunnel'
        option dest 'vpnzone'

config rule
        option name 'Allow-DHCP-lan20'
        option src 'vpnsendtotunnel'
        option dest '*'
        option proto 'udp'
        option src_port '68'
        option dest_port '67'
        option target 'ACCEPT'

config rule
        option name 'Allow-DNS-lan20'
        option src 'vpnsendtotunnel'
        option dest '*'
        option proto 'tcp udp'
        option dest_port '53'
        option target 'ACCEPT'

I can't seem to get the default route to be done correctly. The router has no route pointing traffic into the wireguard interface.

  • default via xxx.xxx.xxx.xxx dev eth1 (it's my isp ip)
  • uci get network.wg_mullvad.route_allowed_ips
    uci: entry not found
2

Are vlan IP addresses public addresses or 192.168.xxx ?

3

It is difficult to give proper support as you are redacting private RFC1918 ip addresses.

But just enable Route Allowed IPs on the WG peer config see:
WireGuard Client Setup Guide

1 Like
4

the vlan addresses are addresses I assigned.

5

I wasn't doing that at first under the peers section. I did that the other night and traffic started flowing through the tunnel but i ended up not being able to access the internet and the red icon on the wireguard interface icon still indicated the tunnel wasn't working properly. I will read through this setup guide and see if I'm doing something wrong....which addresses did you need to see?

6

Pretty meaningless, unless you share whether it is site to site or host to host vpn

7

my router is acting as a client for mullvad vpn. I'm trying to route one vlan through a mullvad tunnel. So i think the answer is site to host. It's not site to site.

8

What I'm noticing is every time i enable route allowed ip's in peer section or even when the config is loaded into openwrt, option nohostroute '1' is inserted and apparently blocks the installation of the default route. If I manually delete it, it just comes back after i enable route allowed ip's.