Using ISP 4G backup with OpenWrt

Installing and Using OpenWrt
1

Hello

I've recently been trying to get my 4G backup built into my original ISP router (repurposed as a wifi AP) working with openwrt.. I've confirmed its working by creating a static route:

config route
        option interface 'lan'
        option target '0.0.0.0'
        option netmask '0.0.0.0'
        option gateway '192.168.1.40'
        option metric '100'

However after creating the static route, I lose access to my actual wan connection.. all I can use is the 4G backup.

My wan configuration is as follows:

config interface 'wan'
        option device 'eth0.10'
        option proto 'dhcp'
        option peerdns '0'
        list dns '1.1.1.1'
        list dns '1.0.0.1'
        option metric '20'

My lan connection is as follows:

config interface 'lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option device 'eth0'
        option force_link '0'
        list dns '1.1.1.1'
        list dns '1.0.0.1'
        option metric '100'

I'm also using wireguard with cloudflare warp.. not sure if its relevant but I'll also share the config:

config interface 'cf_warp'
        option proto 'wireguard'
        option private_key 'chocolateISNTgoodFORdogs'
        option peerdns '0'
        option mtu '1420'
        list addresses '172.16.0.2'
        list addresses 'fd01:5ca1:ab1e:81f0:b34d:d2bc:8c49:73c7'
        list dns '1.1.1.1'
        list dns '1.0.0.1'
        option metric '10'

config wireguard_cf_warp
        option public_key 'butYOUcanHAVEtheRESTofMYmilk'
        list allowed_ips '0.0.0.0/0'
        list allowed_ips '::/0'
        option endpoint_host 'engage.cloudflareclient.com'
        option endpoint_port '2408'
        option route_allowed_ips '1'
        option persistent_keepalive '0'

My desire is to have the 4G backup active only if the wan connection is down..

I did experiment with mwan3, however I was unable to figure out how to create "wanb" using my wifi AP (192.168.1.40).

Please excuse my ignornace if this is painfully obvious, I'm learning as I go along.

Thank you for taking the time and reading my post!

2

That would be correct - it actually sounded like what you desired, until you said you lost WAN connection.

Yep, it's relevant.

OK, you have 2 WANs - you wanna use 1 (regular ISP) as primary and the other (cellular 4G) as backup. Plus, you wanna run Wiregard over it, cool!

@trendy - any ideas?

:+1:

3

OK, you have 2 WANs - you wanna use 1 (regular ISP) as primary and the other (cellular 4G) as backup. Plus, you wanna run Wireguard over it, cool!

Exactly!

I would have thought the metric would have prevented the 4G backup being used.. however after reading your reply I had a thought, perhaps wireguard (metric: 10) is routing the 4G connection and overwriting the given metric (metric: 100)?

Perhaps if I prevent 192.168.1.40 being routed through wireguard my issue will be solved? Will that mean the clients connected through the wireless AP will also not be routed through wireguard?

I will give it a test tonight.. probably don't want the 4G backup routed through wireguard as its painfully slow most of the time.

4

If I understand you correctly, you could try this since you always run Wireguard:

config route
        option target '<ip_of_wireguard_peer>'
        option interface 'wan4g'

You simply add this when you want to use the 4G connection. FYI, setting up DNS requires some more finagling with DNS, so I just simply gave the DST IP for the example.

1 Like
5

mwan3 needs designated wan interfaces to work. I believe a Macvlan might help there, it is also proposed as a workaround in case of single interface devices which want to work with multiple interfaces.

6

Yes this should be automatic in the whole house VPN client use case. Wireguard installs a /32 route to the peer, but it may not choose the WAN interface that you want to use. With full diversion of all IPs to the VPN, the VPN server is the only destination IP your router accesses by sending a packet (encapsulated and encrypted) on the raw Internet through the modem.

No matter how the real Internet is connected, the virtual Internet for VPN users-- the 0.0.0.0 default route-- is always into the tunnel so that packets can be encrypted first. That creates new packets with a destination IP of the VPN server, and another routing is conducted to send them there.

I think that when Wireguard is told to route allowed IPs 0.0.0.0, it actually installs a split route 0.0.0.0/1 and 128.0.0.0/1. This leaves your original raw default route in place but inactive*. Should Wireguard be taken down and its routes removed, the original route works again.

Using route or ip route show will help understand this.

  • When two routes to the same IP exist, the more specific one will be used, regardless of its metric vs the less specific one.
2 Likes
7

Correct, rationale: Native IPv6 with 6in4 and Wireguard - issue/question - #6 by trendy

I've too experienced Wireguard not "selecting" the outbound network interface I prefer.

So, if I understood the OP, they can change the connection - and hence the whole-house VPN by changing the route to their WG endpoint.

1 Like
8

Unfortunately still struggling with this.. not entirely sure how to proceed.

The discussion above is a little over my head if I'm being honest.

I've been attempting to create a secondary wan connection using vlans, macvlans, static addresses etc. in hopes that I can get mwan3 configured.. but I've had no luck.

I've only managed to gain access to the 4G AP by using a static route.

Might have to just settle with manually creating the route in the event of a failure..

9

You can then have a scrpt check periodically and run it with cron. If down, change the route.

10

I decided to give this another try over the weekend, managed to get my ISP router configured as "wanb"... Just finished testing, appears to actually be working.. kinda!

Not sure if there is any issue with the way I've configured the following:

config device
	option type 'macvlan'
	option ifname 'eth0'
	option name 'veth1'
	option mtu '1500'
	option ipv6 '0'
	option mode 'vepa'

config interface 'wanb'
	option proto 'static'
	option ipaddr '192.168.1.39'
	option netmask '255.255.255.0'
	option gateway '192.168.1.40'
	option metric '30'
	option device 'veth1'
	list dns '1.1.1.1'
	list dns '1.0.0.1'
	option force_link '0'

I have noticed I need to manually stop the wan interface for the 4G interface to kick in, otherwise I just get timeouts on my clients not sure if this is normal behaviour? I've been monitoring mwan3, I can see the policy being updated during my testing so not sure why the manual stop is required.
Edit: I no longer have to manually stop the interface when using the mwan3.user script.

Also currently things are working without wireguard, the next thing I need to do is reconfigure wireguard to only route connections from the main wan.. @lleachii not sure if you can assist with this? I've disabled "route allowed ip's" for the time being.

Edit: I've come up with a solution that seems to be working really well, I'm using the /etc/mwan3.user script to disable the wireguard interface when wan goes down.. I'm open to any suggestions if this can be done in a cleaner/simpler manner however:

if [ "${ACTION}" = "ifup" ] && [ "${INTERFACE}" = "wan" ] ; then
   ifup cf_warp
fi

if [ "${ACTION}" = "ifdown" ] && [ "${INTERFACE}" = "wan" ] ; then
   ifdown cf_warp
fi

if [ "${ACTION}" = "connected" ] && [ "${INTERFACE}" = "wan" ] ; then
   ifup cf_warp
fi

if [ "${ACTION}" = "disconnected" ] && [ "${INTERFACE}" = "wan" ] ; then
   ifdown cf_warp
fi

Also I was using vpn-policy-routing to stop a single client being routed to the VPN.. I don't believe vpn-policy-routing is compatible with mwan3. So I'll need to figure out an alternative way to do this also.
Edit: turns out I can configure a mwan3 policy to do this!

Bit of progress! Finally the end is near!

11

Paul is the journey completed. If so could your post a summation of your work so other's can benefit form work?