Wireguard for a single SSID

[eenin]

hi. I have recently signed up for a VPN and would like to set it up on my router instead of having to set it up on all devices. To achieve this, I've set up a separate "guest" wifi ssid following this guide. I also followed this mullvad's guide to set up the wireguard client. The problem is that mullvad's guide sets the firewall such that ALL of the traffic goes through VPN, which is not what I am aiming for. Instead, when I need VPN i want to be able to simply switch wifi network to the "guest" one

here's my setup:

/etc/config/network

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fdbc:a192:002e::/48'

config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
list ports 'lan5'

config device
option name 'lan1'
option macaddr 'macaddr'

config device
option name 'lan2'
option macaddr 'macaddr'

config device
option name 'lan3'
option macaddr 'macaddr'

config device
option name 'lan4'
option macaddr 'macaddr'

config device
option name 'lan5'
option macaddr 'macaddr'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'

config device
option name 'eth1'
option macaddr 'macaddr'

config interface 'wan'
option device 'eth1'
option proto 'dhcp'

config interface 'wan6'
option device 'eth1'
option proto 'dhcpv6'
option auto '0'
option reqaddress 'try'
option reqprefix 'auto'

config interface 'mullvad'
option proto 'wireguard'
option private_key 'my-privKey'
list addresses 'my-ip'
option force_link '1'
list dns '10.64.0.1'
option auto '0'
option disabled '1'

config wireguard_mullvad
option description 'mullvad-server'
option public_key 'mullvad-server-pubkey'
list allowed_ips '0.0.0.0/0'
option route_allowed_ips '1'
option endpoint_host 'mullvad-server-ip'
option endpoint_port '51820'

config device 'guest_dev'
option type 'bridge'
option name 'br-guest'

config interface 'guest'
option proto 'static'
option device 'br-guest'
option ipaddr '192.168.3.1/24'

/etc/config/wireless

config wifi-device 'radio0'
option type 'mac80211'
option path 'platform/soc/18000000.wifi'
option channel '1'
option band '2g'
option htmode 'HE20'
option country 'US'
option cell_density '0'

config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'mySSID'
option encryption 'psk2+ccmp'
option key 'myKey'
option wds '1'

config wifi-device 'radio1'
option type 'mac80211'
option path 'platform/soc/18000000.wifi+1'
option channel '36'
option band '5g'
option htmode 'HE80'
option country 'US'
option cell_density '0'

config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid 'mySSID-5g'
option encryption 'psk2+ccmp'
option key 'myKey

config wifi-iface 'guest'
option device 'radio1'
option mode 'ap'
option network 'guest'
option ssid 'mySSID-guest'
option encryption 'psk2+ccmp'
option key 'myKey'
option isolate '1'
option macaddr 'random'

/etc/config/firewall

[leaving out firewall rules]

config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'

config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'

config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'

config forwarding
option src 'lan'
option dest 'wan'

config zone 'guest'
option name 'guest'
option network 'guest'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'

config forwarding 'guest_wan'
option src 'guest'
option dest 'wan'

Could someone please provide any advice on how to go about achieving this?

[darksky]

Create a SSID/Interface that will use a commercial VPN

I have the goal configuring my OW router/firewall to allow a device connected to particular SSID or plugged into a specific physical port use the to use a commercial VPN's server. I am thinking this will require me to: Create a new wg interface and configure it with the commercial VPN's credentials Configure PBR to allow all traffic on the intended interface by IP range to use the wg interface Am I missing anything conceptually? I should note that when complete, I will have two wireguard in…

[eenin]

thanks for the quick reply, I didn't come across your topic when i was looking for information prior to posting.

First, i added option defaultroute '0' to my mullvad interface as I don't want this to be my default gateway.

Then i installed pbr. Getting this service warning, not sure if it is going to prevent PBR to function correctly: Resolver set (dnsmasq.nftset) is not supported on this system..

I added option secure_reload '1' to pbr's config and finally added a policy to route all traffic from 192.168.3.0/24 (which corresponds to the ip range of the "guest" interface in /etc/config/network) to the mullvad interface:

config policy                                                                            
        option src_addr '192.168.3.0/24'
        option interface 'mullvad'
        option name 'mullvad redirect'

After rebooting multiple times and accessing the "guest" ssid I still do not have access to the internet and the "mullvad" interface in LuCI shows 0 packets transmitted and receied. I guess something is still missing/misconfigured?

[eenin]

so i looked more into pbr's service warning and it looks like i had to install dnsmasq-full. Followed this guide and the warning is gone

That said, when joining the "guest" ssid, I'm still unable to connect to the internet. Could someone please help me with this?