You can't easily use a dumb AP as a VPN because the gateway that will be advertised by DHCP (from your Fritz) is going to be the fritzbox (i.e. the main router).
There are several ways of approaching this challenge, depending on your goals... do you want all of your internet traffic to go through the tunnel?
Option 1: If your Fritz (main router) supports changing the DHCP advertised router/gateway, you can simply set that gateway as 192.168.168.120.
Option 2: Turn off the DHCP server on the Fritz and use the DHCP server on the OpenWrt router. By default, it will send its own address (.120) as the gateway, so all devices will then use the OpenWrt system with WG to route to the internet.
Option 3: Remove the fritz entirely... if this is an option, just simply remove it and put the OpenWrt router in its place. If the Fritz is a modem + router, you might be able to make it a modem only (bridge mode), and then the OpenWrt device will be the only router in the system.
Option 4: connect the OpenWrt device via the WAN port (instead of the LAN)... you'll need to change the subnet of the OpenWrt LAN, but then what you'll have is cascaded routers. Once there, you will have all device connect to the OpenWrt device (no clients will connect to the Fritz) and then they will all use the WG tunnel.
Meanwhile: several errors I see in your configuration:
below, you should have input = reject
this zone should have masquerading enabled.
remove this.... it shouldn't be there.
turn of masquerading on the lan zone
you need to enable route_allowed_ips in this section of your network file
Also, you no longer have a wan interface or firewall zone, so if you use the wan connection method I mentioned earlier, you'll need to recreate those aspects.
@psherman
I will try to implement option 4 and will get back to you
You mentioned that I have to remove all the devices from main router, Is this necessary ?
Necessary? not absolutely required. Depends on your goals. If you want the devices to use the vpn, they need to be behind the openwrt router. Or if you need the devices to be able to communicate with each other, they also need to be connected to the same router.
Ok seems like it's not easy to make AP using WAN (can you guide me how this can be done) or is there another way to achieve this without tinkering main router (FRITZBOX) ?
The point of option 4 is to use the OpenWrt device as a normal router and not as a dumb AP. This means that the WAN of the OpenWrt router would be on the same subnet as the main router, but the OpenWrt LAN would be an entirely different network.
I think it can be implemented in an easier way. The requirement is for clients connecting to the OpenWrt wifi to get routed over VPN.
Therefore the dumbAP can remain as is. A special SSID needs to be created on the OpenWrt, which will be bound to a new inteface. All traffic from this interface will go to VPN.
@psherman
I tried option 6, but I have no idea why I'm running into no internet problem (I assigned static address to WAN which was in the same subnet as main router and i assigned a different subnet to LAN).
@trendy
Thanks for offering your help. I liked your idea, and it sounds easy to implement, but due to my limited knowledge in networking I'm still stuggling. If possible, can you help me in implementation. The following is how my config looks now:
cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd28:714c:ff0d::/48'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0.1'
config device
option name 'eth0.1'
option macaddr '50:d3:f4'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option ipaddr '192.168.178.120'
list dns '8.8.8.8'
option gateway '192.168.178.1'
config interface 'wan'
option device 'eth0.2'
option proto 'dhcp'
config interface 'wan6'
option device 'eth0.2'
option proto 'dhcpv6'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '1 2 3 4 6t'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '0 6t'
config interface 'gate'
option proto 'static'
option device 'br-lan'
option ipaddr '192.168.2.2'
option netmask '255.255.255.0'
option gateway '192.168.178.1'
config interface 'g0'
option proto 'wireguard'
option private_key 'asdfasdf='
option peerdns '0'
list dns '10.0.0.243'
list dns '10.0.0.242'
list addresses '10.27.150.105/24'
config wireguard_g0
option description 'Imported peer configuration'
option public_key 'adsfdsaf='
list allowed_ips '0.0.0.0/0'
option persistent_keepalive '25'
option endpoint_host '102.165.16.66'
option endpoint_port '1337'
cat /etc/config/firewall
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config zone
option name 'gate'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
list network 'gate'
list network 'g0'
gate is this new interface (i have given it a different subnet, I hope it's the correct way to go). I have assigned this interface to Secure AP. Please let me know how I can establish this route. Currently, when I connect with Haze, I have internet connection (but obviously it's not routed through vpn).
Remove the gateway and the device from gate interface.
Remove this from gate zone.
Create a new g0 zone covering g0 network and use masquerade. Also make a forwarding from gate to g0.
Last, to enable traffic via VPN, you need to route_allowed_ips at the g0 peer.
What is the purpose of the gate network? It currently is connected to one of the SSIDs, but it is not associated with a firewall zone.
you need to enable the 'route allowed IPs' option.
Your 'g0' network is not associated with firewall zones. You should create one like this and then allow forwarding from the lan zone (unless lan is supposed to be non-VPN'd):
config zone
option name 'vpn'
list network 'g0'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
config forwarding
option src 'lan'
option dest 'vpn'
Let's see them all together.
Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have
ubus call system board; \
uci export network; uci export wireless; \
uci export dhcp; uci export firewall; \
head -n -0 /etc/firewall.user; \
iptables-save -c; ip6tables-save -c; nft list ruleset; \
ip -4 addr ; ip -4 ro li tab all ; ip -4 ru; \
ls -l /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*
