WireGuard default + No-VPN alternative route

intel478 · December 27, 2022, 7:34pm

What works:

WireGuard client on OpenWRT as default route for LAN & WiFi over WAN (to upstream ISP provided router), following this tutorial: https://openwrt.org/docs/guide-user/services/vpn/wireguard/client

What doesn't work (yet):

2nd SSID that is not routed via the default wg0 interface, but simply acting as a network access point via the WAN port. Currently the DHCP server seems to work, but all Internet traffic times out, following just the 1st section of this tutorial: https://openwrt.org/docs/guide-user/network/routing/examples/pbr_netifd#route_all_ipv4_traffic_from_an_interface_named_novpn_over_the_wan_interface

What I'd like the end result to look like:

4x LAN + 1x SSID via WireGuard (works already), combined with:
1x normal SSID + 1x guest SSID via WAN as a regular network access point (the combination seems to be problematic).

Relevant configuration posted below:

Network:

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdfb:79d4:3033::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth1.1'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option netmask '255.255.255.0'
	option ipaddr '192.168.7.2'
	option gateway '192.168.2.1'

config interface 'wan'
	option device 'eth0.2'
	option proto 'dhcp'
	option type 'bridge'
	option peerdns '0'
	list dns '1.1.1.3'
	list dns '1.0.0.3'

config interface 'wan6'
	option device 'eth0.2'
	option proto 'dhcpv6'
	option reqaddress 'try'
	option reqprefix 'auto'
	option peerdns '0'
	list dns '2606:4700:4700::1113'
	list dns '2606:4700:4700::1003'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0t 2 3 4 5'
	option vid '1'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '6t 1'
	option vid '2'

config interface 'wg0'
	option proto 'wireguard'
	option private_key ''
	list addresses '192.168.3.2/32'
	list addresses ''
	option peerdns '0'

config wireguard_wg0 'wgserver'
	option public_key ''
	option preshared_key ''
	option endpoint_host ''
	option endpoint_port ''
	option route_allowed_ips '1'
	option persistent_keepalive '10'
	list allowed_ips '0.0.0.0/0'
	list allowed_ips '::/0'

config interface 'lan2'
	option proto 'static'
	option ipaddr '192.168.8.2'
	option netmask '255.255.255.0'
	option ip4table 'novpn'
	option ip6table 'novpn'
	option device 'br-lan2'
	option gateway '192.168.2.1'

config route
	option target '0.0.0.0/0'
	option interface 'wan'
	option table 'novpn'

config rule
	option in 'lan2'
	option lookup 'novpn'

config switch_vlan
	option device 'switch0'
	option vlan '3'
	option ports '0t'
	option vid '3'

config device
	option type 'bridge'
	option name 'br-lan2'
	list ports 'eth1.3'

config route6
	option target '::/0'
	option table 'novpn'
	option interface 'wan6'

config rule6
	option in 'lan2'
	option lookup 'novpn'

WiFi:

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'pci0000:00/0000:00:00.0'
	option band '5g'
	option htmode 'VHT80'
	option channel 'auto'
	option cell_density '0'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'platform/ahb/18100000.wmac'
	option band '2g'
	option htmode 'HT40'
	option channel 'auto'
	option cell_density '0'

config wifi-iface 'wifinet2'
	option device 'radio1'
	option mode 'ap'
	option ssid 'TheOne'
	option encryption 'psk2+ccmp'
	option key ''
	option network 'lan2'
	option isolate '1'

config wifi-iface 'wifinet3'
	option device 'radio1'
	option mode 'ap'
	option ssid 'TheOther'
	option encryption 'psk2+ccmp'
	option key ''
	option network 'lan'
	option isolate '1'

config wifi-iface 'wifinet4'
	option device 'radio0'
	option mode 'ap'
	option ssid 'TheOne'
	option encryption 'psk2+ccmp'
	option key ''
	option network 'lan2'
	option isolate '1'

config wifi-iface 'wifinet5'
	option device 'radio0'
	option mode 'ap'
	option ssid 'TheOther'
	option encryption 'psk2+ccmp'
	option key ''
	option network 'lan'
	option isolate '1'

DHCP:

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option localservice '1'
	option ednspacket_max '1232'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'
	list server '1.1.1.3'
	list server '1.0.0.3'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'lan2'
	option interface 'lan2'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'
	list server '1.1.1.3'
	list server '1.0.0.3'

Firewall:

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone 'lan'
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'
	list network 'lan2'

config zone 'wan'
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'
	list network 'wg0'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

rt_tables:

#
# reserved values
#
128	prelocal
255	local
254	main
253	default
10	novpn
0	unspec
#
# local
#
#1	inr.ruhep

intel478 · December 27, 2022, 8:59pm

I've added the same gateway to the novpn route as such:

config route
	option target '0.0.0.0/0'
	option interface 'wan'
	option table 'novpn'
	option gateway '192.168.2.1'

and now IPv4 seems to work on both main & novpn routed SSIDs.
However, IPv6 still won't work according to Windows 10.
I cannot determine for sure what the IPv6 gateway should be. The ISP provided router only tells me the upstream IPv6 gateway, but not its local IPv6 address. How can I find that out?

stangri · December 28, 2022, 12:06am

If you undo the manual tables/routes and use the pbr package, you can designate interfaces for 1x normal SSID + 1x guest SSID to use WAN.