Wireguard on a Dumb AP

Installing and Using OpenWrt
1

Hello,

I have an Archer C7 v2 setup as a dumb AP.
The ISPs router is mandatory and cannot be replaced! Sadly it lacks the support for static routes, which means that this solution won't work for me.

Is it possible to use Wireguard on this device to get access to my home network?
So I can access smb shares from devices like Fire TV Stick.

network

config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'

config interface 'lan'
option type 'bridge'
option ifname 'eth1.1'
option proto 'static'
option ipaddr '192.168.2.4'
option netmask '255.255.255.0'
option gateway '192.168.2.1'
list dns '192.168.2.1'

config interface 'wg_client'
option proto 'wireguard'
option private_key ''
list addresses '192.168.6.23/32'
option listen_port '50001'

config wireguard_wg_client
option description 'home_tunnel'
option endpoint_host 'hostname.com'
option endpoint_port '50001'
option persistent_keepalive '25'
option public_key ''
option preshared_key ''
list allowed_ips '192.168.5.0/24'
option route_allowed_ips '1'

config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'

config switch_vlan
option device 'switch0'
option vlan '1'
option ports '2 3 4 5 0t'

config switch_vlan
option device 'switch0'
option vlan '2'
option ports '1 6t'

firewall

config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'

config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option network 'lan wg_client'

config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network ' '

config forwarding
option src 'lan wg_client'
option dest 'wan'

config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'

config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'

config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'

config include
option path '/etc/firewall.user'

2

Can you reach its Web GUI to see if it has an option to place it in bridge mode? This will turn your ISP's gateway into a dumb modem. A waste of hardware, but considering it is your ISP's hardware and ISP's firmware, it's probably for the best. From there - connect to your own OpenWrt device to be your own gateway?

3

Not an option since it acts as a VoIP gateway too.

4

Without the option of static routes on your ISP router, the situation gets difficult - and rather impossible with the OpenWrt device in AP mode.

The only option I'd imagine, would be running the OpenWrt device in router mode (double-NAT) and not using the ISP router for anything else (WLAN disabled, no LAN devices connected to it, other than the c7), that would 'just' require the appropriate port-forwardings on the ISP router side (but it comes with all the downsides of double-NAT).

1 Like
5

You can add static routes to the VPN and remote networks via the VPN client on your LAN clients.

6

This is most likely an unsatisfying suggestion, but if your combined internet and VOIP plan through your ISP is priced anything like the offerings in my area, buying your own VOIP hardware (I use a refurbished Ooma telo for example and pay nothing more beyond a $5/month FCC access fee) and transferring your "land line" phone number to it (or for even less, convert to a new number for free) pays for itself in very short order. Your plan may be different, but my experience has been the package "deals" are not deals at all, and the fewer "package deals" I lock into the better. Next step, put their gateway in bridge mode, and the heck with losing their VOIP. Now I sound like a broken record :wink:

7

How exactly do I have to do this? Could you give me an example based on my config?
Also which LAN Clients do you mean? The ones in my home network or the ones in the network I am in the moment of connection?

At home in my place I did the same as you and just got a plain modem, a dedicated VoIP gateway and built an OpenWrt x86 router.
However the router I am setting up is not in my home network and I wan't to spend as little money as possible, without changing the network layout to much.
Also not to be rude ... but my question was not if there are other ways to solve my problem, I was asking how I can solve my problem with the current setup. :grin:

8

Your laptop, phone, etc.
It depends on the client OS, e.g. in case of NetworkManager on Linux:

nmcli connection modify id CON_NAME \
ipv4.routes "192.168.5.0/24 192.168.2.4, 192.168.6.0/24 192.168.2.4"

Yes.

1 Like
9

Currently I am still trying to get the wireguard interface working.
It gives me "Error: Network device is not present".

Also to explain this further.
This router should act as a wireguard "client-peer" that just provides access from the "remote" network to my home network (where I have my wireguard main "server-peer").