Wireguard acting as a bridge of lan

Installing and Using OpenWrt
1

I have OpenWrt running a WireGuard VPN server. I want the Android peer, when connected, to access the LAN as if it were directly connected, like using the local DNS server, seeing all the devices on the network, exactly as if it were plugged into the LAN.

Another thing: the endpoint is a public web address ( orelhao.dynv6.net ), and I also want the Android device to connect normally when it’s inside the LAN (router hostname is openwrt). The idea is to keep my Android connected (and with all connections outside VPN blocked) all the time, and it will behave the same whether I’m on the LAN or on the internet.

Here are the configuration files I’m using:
network

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fda2:7021:2afc::/48'
option packet_steering '1'

config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'
list ports 'eth1'
list ports 'eth2'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.120.1'
option netmask '255.255.255.0'
option ip6assign '64'

config interface 'wan'
option device 'eth3'
option proto 'dhcp'
option peerdns '0'
list dns '127.0.0.1'

config interface 'wan6'
option device 'eth3'
option proto 'dhcpv6'
option force_link '1'
option reqaddress 'force'
option reqprefix '56'
option norelease '1'
option peerdns '0'
list dns '::1'
option ip6assign '64'

config interface 'wg0'
option proto 'wireguard'
option listen_port '1234'
option delegate '0'
list addresses '10.14.0.1/24'
list addresses 'fd00:9::1/64'
list dns '127.0.0.1'

config wireguard_wg0
option route_allowed_ips '1'
option persistent_keepalive '25'
option description 'Android'
list allowed_ips '10.14.0.3/32'
list allowed_ips 'fd00:9::3/128'

config wireguard_wg0
option description 'WGRouter'
option route_allowed_ips '1'
list allowed_ips '10.14.0.4/32'
list allowed_ips 'fd00:9::4/128'
option persistent_keepalive '25'

config interface 'ProtonVPN'
option proto 'wireguard'
list addresses '10.2.0.2/32'
option metric '20'

config wireguard_ProtonVPN
list allowed_ips '0.0.0.0/0'
list allowed_ips '::/0'
option endpoint_host '138.199.53.242'
option persistent_keepalive '25'
option description 'ProtonVPN'
option route_allowed_ips '1'

firewall

config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
option flow_offloading '1'

config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'

config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'

config forwarding
option src 'lan'
option dest 'wan'

config rule
option src 'wan'
option name 'Allow Wireguard'
list proto 'udp'
option dest_port '1234'
option target 'ACCEPT'

config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'

config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'

config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'

config redirect
option dest 'lan'
option target 'DNAT'
option name 'DNAT Xbox'
option src 'wan'
option src_dport '49621'
option dest_ip '192.168.120.20'

config redirect 'adblock_lan53'
option name 'Adblock DNS (lan, 53)'
option src 'lan'
option proto 'tcp udp'
option src_dport '53'
option dest_port '53'
option target 'DNAT'
option family 'any'

config rule 'adblock_lan853'
option name 'Adblock DNS (lan, 853)'
option src 'lan'
option proto 'tcp udp'
option dest_port '853'
option target 'REJECT'
option dest '*'

config rule 'adblock_lan5353'
option name 'Adblock DNS (lan, 5353)'
option src 'lan'
option proto 'tcp udp'
option dest_port '5353'
option target 'REJECT'
option dest '*'

config zone
option name 'VPN'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'ProtonVPN'

config forwarding
option src 'lan'
option dest 'VPN'

config zone
option name 'wireguard'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option masq '1'
list network 'wg0'

config forwarding
option src 'wireguard'
option dest 'lan'

config forwarding
option src 'lan'
option dest 'wireguard'

dns

config dnsmasq
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option dnssec '1'
option localservice '1'
option ednspacket_max '1232'
list server '/pool.ntp.org/8.8.8.8'
list server '/mask.icloud.com/'
list server '/mask-h2.icloud.com/'
list server '/use-application-dns.net/'
list server '127.0.0.1#5053'
list server '127.0.0.1#5054'
list interface 'lan'
list interface 'wg0'
list addnmount '/var/run/pbr.dnsmasq'
option domainneeded '1'
option doh_backup_noresolv '-1'
option noresolv '1'
list doh_backup_server '/pool.ntp.org/8.8.8.8'
list doh_backup_server '/mask.icloud.com/'
list doh_backup_server '/mask-h2.icloud.com/'
list doh_backup_server '/use-application-dns.net/'
list doh_backup_server '127.0.0.1#5053'
list doh_backup_server '127.0.0.1#5054'
list doh_server '127.0.0.1#5053'
list doh_server '127.0.0.1#5054'

config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '24h'

config dhcp 'wan'
option interface 'wan'
option ignore '1'

config cname
option cname 'orelhao.dynv6.net'
option target 'openwrt'
2

remove masquerading from here:

You'll want to add a rule to allow the inbound wireguard tunnel to get to the internet -- this is accomplished by either forwarding to the wan or to the VPN (proton) zone.

If you don't already have it, you're going to need Policy Based Routing to enable the inbound connections on your wan to be properly routed. This is because you have the proton vpn tunnel which constitutes your default route.