Hello, i have been trying to figure out how to configure Wireguard at home. First, my objective is to tunnel all requests through my KeepSolid Unlimited VPN account. To achieve that I am using and old Raspberry Pi (Model 1 B+) to test before upgrading the hardware.
I was able to configure OpenWRT to connect to the internet by installing an USB Ethernet adaptar and routing as the schema:
ISP Router -> Raspberry Pi with OpenWRT -> Google Wifi -> all computers
by configuring two interfaces:
However, I have been struggling to make WireGuard work within this configuration. LAN (br-lan) is bridging between eth0 (LAN) and eth1 (WAN).
I have followed using KeepSolid tutorial: https://www.vpnunlimitedapp.com/help/manuals/open-wrt-wireguard-setup, but with no success, IPs keep going outside through normal ISP connection. I am pretty sure I am a missing a routing or something alike, but haven't been able to find what config I missed.
If you bridge the eth0 and eth1 then all lan hosts will be able to access the ISP router.
You'll need to have lan as eth0 and wan as eth1.
Then create the vpn interface and either force everything via that, or do policy routing and selectively route hosts via the vpn.
Nope, the opposite. You must not bridge the interfaces to be able to police the traffic. lan -> eth0 , wan -> eth1, and one more for the vpn. Then one firewall zone per interface.
Hey @trendy, sorry the delay, had a crazy week around here.
I guess I am missing something. My Firewall Zones are like this:
To get here I followed this tutorial on my original post, but I think since I configured the interface to bridge between LAN and WAN, I missed some configurations. When I remove the bridge just with the Zones forwarding, i lose connection and since the GUI wont reload it reverts the configuration.
Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have
ubus call system board; \
uci export network; \
uci export dhcp; uci export firewall; \
head -n -0 /etc/firewall.user; \
iptables-save -c; \
ip -4 addr ; ip -4 ro li tab all ; ip -4 ru
Hey @krazeh, here is the output you requested. I think one think worth saying is that I am using and old RPI to test everything and if it works I will get an RPI4 to change.
{
"kernel": "4.14.195",
"hostname": "OpenWrt",
"system": "ARMv6-compatible processor rev 7 (v6l)",
"model": "Raspberry Pi Model B Rev 2",
"board_name": "raspberrypi,model-b",
"release": {
"distribution": "OpenWrt",
"version": "19.07.4",
"revision": "r11208-ce6496d796",
"target": "brcm2708/bcm2708",
"description": "OpenWrt 19.07.4 r11208-ce6496d796"
}
}
package network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fdad:522e:110a::/48'
config interface 'lan'
option proto 'dhcp'
option ip6assign '60'
option ifname 'eth0 eth1'
option type 'bridge'
config interface 'wan'
option ifname 'eth1'
option proto 'dhcp'
option ip6assign '60'
option peerdns '0'
list dns 'x.x.x.x'
config interface 'VPNUnlimited'
option proto 'wireguard'
option private_key 'xxxxxxxx'
option listen_port 'xxxxx'
list addresses 'X.X.X.X/32'
option force_link '1'
config wireguard_VPNUnlimited
option public_key 'xxxxxxx'
option preshared_key 'xxxxxxxx'
option endpoint_host 'x.x.x.x'
option endpoint_port 'xxxxxxx'
option persistent_keepalive '25'
list allowed_ips '0.0.0.0/0'
list allowed_ips '::/0'
list allowed_ips '0.0.0.0/1'
list allowed_ips '128.0.0.0/1'
config rule
option in 'lan'
option lookup '100'
config route
option interface 'VPNUnlimited'
option target '0.0.0.0'
option netmask '0.0.0.0'
option table '100'
package dhcp
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.auto'
option localservice '1'
list server '10.100.0.1'
option strictorder '1'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv6 'server'
option ra 'server'
option ra_management '1'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
package firewall
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option network 'lan'
config zone
option name 'wan'
option output 'ACCEPT'
option masq '1'
option mtu_fix '1'
option input 'REJECT'
option forward 'REJECT'
option network 'wan6 wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config zone
option name 'WireGuard'
option output 'ACCEPT'
option masq '1'
option mtu_fix '1'
option network 'VPNUnlimited'
option input 'REJECT'
option forward 'REJECT'
config forwarding
option src 'lan'
option dest 'WireGuard'
config rule
option name 'Allow-Lan-Device'
list proto 'all'
option src 'lan'
option target 'ACCEPT'
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.
# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.
# Generated by iptables-save v1.8.3 on Sat Dec 12 13:01:33 2020
*nat
:PREROUTING ACCEPT [79:21174]
:INPUT ACCEPT [20:1280]
:OUTPUT ACCEPT [19:1405]
:POSTROUTING ACCEPT [19:1405]
:postrouting_WireGuard_rule - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_WireGuard_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_WireGuard_postrouting - [0:0]
:zone_WireGuard_prerouting - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
[79:21174] -A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
[79:21174] -A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
[0:0] -A PREROUTING -i eth1 -m comment --comment "!fw3" -j zone_wan_prerouting
[0:0] -A PREROUTING -i VPNUnlimited -m comment --comment "!fw3" -j zone_WireGuard_prerouting
[19:1405] -A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
[6:456] -A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
[0:0] -A POSTROUTING -o eth1 -m comment --comment "!fw3" -j zone_wan_postrouting
[0:0] -A POSTROUTING -o VPNUnlimited -m comment --comment "!fw3" -j zone_WireGuard_postrouting
[0:0] -A zone_WireGuard_postrouting -m comment --comment "!fw3: Custom WireGuard postrouting rule chain" -j postrouting_WireGuard_rule
[0:0] -A zone_WireGuard_postrouting -m comment --comment "!fw3" -j MASQUERADE
[0:0] -A zone_WireGuard_prerouting -m comment --comment "!fw3: Custom WireGuard prerouting rule chain" -j prerouting_WireGuard_rule
[6:456] -A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
[79:21174] -A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
[0:0] -A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
[0:0] -A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
[0:0] -A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
COMMIT
# Completed on Sat Dec 12 13:01:33 2020
# Generated by iptables-save v1.8.3 on Sat Dec 12 13:01:33 2020
*mangle
:PREROUTING ACCEPT [628:94452]
:INPUT ACCEPT [547:67166]
:FORWARD ACCEPT [22:7392]
:OUTPUT ACCEPT [548:241887]
:POSTROUTING ACCEPT [570:249279]
[0:0] -A FORWARD -o eth1 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
[0:0] -A FORWARD -i eth1 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
[0:0] -A FORWARD -o VPNUnlimited -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone WireGuard MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
[0:0] -A FORWARD -i VPNUnlimited -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone WireGuard MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Sat Dec 12 13:01:33 2020
# Generated by iptables-save v1.8.3 on Sat Dec 12 13:01:33 2020
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:forwarding_WireGuard_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_WireGuard_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_WireGuard_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_WireGuard_dest_ACCEPT - [0:0]
:zone_WireGuard_dest_REJECT - [0:0]
:zone_WireGuard_forward - [0:0]
:zone_WireGuard_input - [0:0]
:zone_WireGuard_output - [0:0]
:zone_WireGuard_src_REJECT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
[78:5616] -A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
[472:61706] -A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
[452:60426] -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
[20:1280] -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
[20:1280] -A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
[0:0] -A INPUT -i eth1 -m comment --comment "!fw3" -j zone_wan_input
[0:0] -A INPUT -i VPNUnlimited -m comment --comment "!fw3" -j zone_WireGuard_input
[22:7392] -A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
[0:0] -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
[22:7392] -A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
[0:0] -A FORWARD -i eth1 -m comment --comment "!fw3" -j zone_wan_forward
[0:0] -A FORWARD -i VPNUnlimited -m comment --comment "!fw3" -j zone_WireGuard_forward
[0:0] -A FORWARD -m comment --comment "!fw3" -j reject
[78:5616] -A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
[473:237163] -A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
[467:236707] -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
[6:456] -A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
[0:0] -A OUTPUT -o eth1 -m comment --comment "!fw3" -j zone_wan_output
[0:0] -A OUTPUT -o VPNUnlimited -m comment --comment "!fw3" -j zone_WireGuard_output
[0:0] -A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
[0:0] -A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
[20:1280] -A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
[0:0] -A syn_flood -m comment --comment "!fw3" -j DROP
[0:0] -A zone_WireGuard_dest_ACCEPT -o VPNUnlimited -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
[22:7392] -A zone_WireGuard_dest_ACCEPT -o VPNUnlimited -m comment --comment "!fw3" -j ACCEPT
[0:0] -A zone_WireGuard_dest_REJECT -o VPNUnlimited -m comment --comment "!fw3" -j reject
[0:0] -A zone_WireGuard_forward -m comment --comment "!fw3: Custom WireGuard forwarding rule chain" -j forwarding_WireGuard_rule
[0:0] -A zone_WireGuard_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
[0:0] -A zone_WireGuard_forward -m comment --comment "!fw3" -j zone_WireGuard_dest_REJECT
[0:0] -A zone_WireGuard_input -m comment --comment "!fw3: Custom WireGuard input rule chain" -j input_WireGuard_rule
[0:0] -A zone_WireGuard_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
[0:0] -A zone_WireGuard_input -m comment --comment "!fw3" -j zone_WireGuard_src_REJECT
[0:0] -A zone_WireGuard_output -m comment --comment "!fw3: Custom WireGuard output rule chain" -j output_WireGuard_rule
[0:0] -A zone_WireGuard_output -m comment --comment "!fw3" -j zone_WireGuard_dest_ACCEPT
[0:0] -A zone_WireGuard_src_REJECT -i VPNUnlimited -m comment --comment "!fw3" -j reject
[6:456] -A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
[22:7392] -A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
[22:7392] -A zone_lan_forward -m comment --comment "!fw3: Zone lan to WireGuard forwarding policy" -j zone_WireGuard_dest_ACCEPT
[0:0] -A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
[0:0] -A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
[20:1280] -A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
[20:1280] -A zone_lan_input -m comment --comment "!fw3: Allow-Lan-Device" -j ACCEPT
[0:0] -A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
[0:0] -A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
[6:456] -A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
[6:456] -A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
[0:0] -A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
[0:0] -A zone_wan_dest_ACCEPT -o eth1 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
[0:0] -A zone_wan_dest_ACCEPT -o eth1 -m comment --comment "!fw3" -j ACCEPT
[0:0] -A zone_wan_dest_REJECT -o eth1 -m comment --comment "!fw3" -j reject
[0:0] -A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
[0:0] -A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
[0:0] -A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
[0:0] -A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
[0:0] -A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
[0:0] -A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
[0:0] -A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
[0:0] -A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
[0:0] -A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
[0:0] -A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
[0:0] -A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
[0:0] -A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
[0:0] -A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
[0:0] -A zone_wan_src_REJECT -i eth1 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Sat Dec 12 13:01:33 2020
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
4: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
inet 192.168.15.69/24 brd 192.168.15.255 scope global br-lan
valid_lft forever preferred_lft forever
6: VPNUnlimited: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
inet x.x.x.x/32 brd 255.255.255.255 scope global VPNUnlimited
valid_lft forever preferred_lft forever
7: tun0: <POINTOPOINT,MULTICAST,NOARP> mtu 1500 qdisc fq_codel state DOWN group default qlen 100
inet x.x.x.x peer x.x.x.x/32 scope global tun0
valid_lft forever preferred_lft forever
default dev VPNUnlimited table 100 proto static scope link
default via 192.168.15.1 dev br-lan proto static src 192.168.15.69
x.x.x.x via 192.168.15.1 dev br-lan proto static
x.x.x.x via 192.168.15.1 dev br-lan
192.168.15.0/24 dev br-lan proto kernel scope link src 192.168.15.69
local x.x.x.x dev VPNUnlimited table local proto kernel scope host src x.x.x.x
local x.x.x.x dev tun0 table local proto kernel scope host src x.x.x.x
broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1
broadcast 192.168.15.0 dev br-lan table local proto kernel scope link src 192.168.15.69
local 192.168.15.69 dev br-lan table local proto kernel scope host src 192.168.15.69
broadcast 192.168.15.255 dev br-lan table local proto kernel scope link src 192.168.15.69
0: from all lookup local
1: from all iif br-lan lookup 100
32766: from all lookup main
32767: from all lookup default
Again, you are bridging eth1 in lan interface. Remove eth1 from lan bridge.
lan interface must have static protocol and an IP/mask in a subnet different than 192.168.15.0/24 that your ISP router is offering.
Not needed. Input of lan zone is ACCEPT.
You don't need them all, the last 2 lines are redundant.
Hey @krazeh, yes, I can put it on bridge mode. Probably i will have to configure the openWRT to be a PPPoE, as the router would probably miss this config.
@trendy, yes, it had to rollback cause it lost all connections.
If I do the following changes:
Change ISP router to bridge
Change WAN on openWRT to PPPoE with the config
Remove the bridge between eth0 and eth1
should it work? Or am I still missing some step in this?
I have already wrote what needs to be done.
RPi1 is a bit weak for today's standards and might bottleneck your network depending on the contracted speed you have.
I suggest you leave the ISP modem in routed mode until you finish your experiments.
