first time OpenWrt user, lovin' it so far. Thanks so much for creating & maintaining this!
I'm not very friendly with networking etc, so having a hard time getting the setup built that I need.
Here's hoping someone here might give me steps on what I have to do to get it finally done
Router:
WRT3200acm behind a Zyxel VDSL2 super vectoring modem.
Goal:
I want to achieve two things: (both with Wireguard)
Have remote access to my home network while traveling (access to devices but also a VPN so I could surf with home home IP address even in another country).
In my home network have an additional 5Ghz SSID that should always map to a premium VPN service (For Netflix etc.)
What I have so far:
Not much haha I have created two wireless ssids (5Ghz and 2.4Ghz),
which simply provide my home access to my ISP provided internet.
I've installed all required wireguard packages thru Luci as well as vpn-policy-routing.
I've come as fqr aa creating a Wireguard interface, but couldn't connect it to my wireless ssid.
Never done anything like this before and feel a little stupid haha.
Could you give me some guidance? I'd appreciate it really!
It is bad idea to use Wireguard with PBR due to UDP protocol in Wireguard. However connection to Wireless should not influence on Wireguard, and vice-versa.
Sooo, I've managed to get the described setup to work, to 99%.
I am seeing a weird problem now that I cannot really put my finge on...
Everything works:
2 SSIDs connected via lan interface, for unencrypted ISP internet
1 WG0 Wireguard interface for Wireguard "server", where I can connect devices remotely to my home router and share my home internet from anywhere.
1 SSID for encrypted VPN internet (Windscribe VPN) (WG1 Wireguard interface, WG1_VPN Static interface assigned to SSID)
The problem now is, the Windscribe VPN SSID only works, if I check "Route allowed IPs" in the WG1 interface. But this causes the internet to break when i switch to any of the unecnrypted wifi SSIDs...
If I remove this checkmark, and restart network services the encrypted WIFI stops working, but the unencrypted wifi SSIDs start working again and have internet connection.
What can I do to get it all working simultaneously?
Here is my config:
/etc/config/network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd59:1d89:daaf::/48'
config interface 'lan'
option type 'bridge'
option ifname 'eth0.1'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
list dns '1.1.1.1'
list dns '1.0.0.1'
config interface 'wan'
option ifname 'eth1.2'
option proto 'pppoe'
option password 'XXX'
option ipv6 'auto'
option username 'XXX'
list dns '1.1.1.1'
list dns '1.0.0.1'
option peerdns '0'
config interface 'wan6'
option ifname 'eth1.2'
option proto 'dhcpv6'
list dns '1.1.1.1'
list dns '1.0.0.1'
option reqprefix 'auto'
option reqaddress 'try'
option peerdns '0'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0 1 2 3 5t'
option vid '1'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '4 6t'
option vid '2'
config interface 'wg0'
option proto 'wireguard'
option private_key 'XXX'
option listen_port '1234'
list addresses '10.20.20.1/24'
config wireguard_wg0
option public_key 'XXX'
option description 'Macbook'
option persistent_keepalive '25'
list allowed_ips '10.20.20.2/32'
option route_allowed_ips '1'
config wireguard_wg0
option public_key 'XXX'
option description 'iPhone'
option persistent_keepalive '25'
list allowed_ips '10.20.20.3/32'
option route_allowed_ips '1'
config interface 'wg1'
option proto 'wireguard'
list addresses 'XXX/32'
option private_key 'XXX'
option delegate '0'
config wireguard_wg1
option public_key 'XXX'
option description 'XXX'
option persistent_keepalive '25'
option endpoint_port '1194'
list allowed_ips '0.0.0.0/0'
option preshared_key 'XXX'
option endpoint_host 'XXX'
option route_allowed_ips '1'
config interface 'wg1_vpn'
option delegate '0'
option type 'bridge'
option proto 'static'
option ipaddr '192.168.2.1'
option netmask '255.255.255.0'
list dns '1.1.1.1'
list dns '1.0.0.1'
/etc/config/firewall
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option network 'lan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option network 'wan wan6'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Remote-SSH-22'
option src 'wan'
option dest_port '22'
option target 'ACCEPT'
option proto 'tcp'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config rule
option src '*'
option target 'ACCEPT'
option proto 'udp'
option dest_port '1234'
option name 'Allow-Wireguard-Inbound'
config zone
option name 'wg'
option input 'ACCEPT'
option forward 'ACCEPT'
option output 'ACCEPT'
option masq '1'
option network 'wg0'
config forwarding
option src 'wg'
option dest 'wan'
config forwarding
option src 'wg'
option dest 'lan'
config forwarding
option src 'lan'
option dest 'wg'
config forwarding
option src 'wan'
option dest 'wg'
config zone
option name 'wg1'
option mtu_fix '1'
option input 'REJECT'
option forward 'REJECT'
option masq '1'
option output 'ACCEPT'
option network 'wg1'
config zone
option input 'REJECT'
option forward 'REJECT'
option name 'wg1_vpn'
option output 'ACCEPT'
option network 'wg1_vpn'
config forwarding
option dest 'wg1'
option src 'wg1_vpn'
config rule
option src_port '68'
option src 'wg1_vpn'
option name 'Allow-Wg1VPN-DHCPv4-Input'
option family 'ipv4'
option target 'ACCEPT'
option dest_port '67'
list proto 'udp'
You don't need to depend on connection tracking if you alter the default route in a separate routing table which is assigned with IP rules to a specific source interface or subnet.
@krazeh & @vgaetera, amazing info! Thanks a lot for this guys, I appreciate your help a lot and have actually learned quite a bit already
Right now I'm testing @krazeh's firewall rules, and @vgaetera's UCI rules.
Everything seems to work smoothly. Except when I am connecting WG1/WG1_VPN. The connection can be established, I am online but it's becoming extremely sluggish very quick.
When running for example a speed test on https://speedtest.net, the test stops executing half way through, or I receive a warning in my browser that maybe some firewall blocks some SOCKS port etc.
I'm unsure what to do from here, I cannot find any obvious logs that port XY or so is blocked, or maybe it's not even the firewall but something else?
Funny enough, the download speed is almost at my ISP's max (270Mbits), but when connected it freezes intermittently, it feels as if something is blocked somewhere, or extremely throttled. Ping to my destination VPN is 150ms, if I connect to it using the Windscribe app, none of these issues come up.
Here is my current config:
/etc/config/firewall:
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option network 'lan wg0'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option network 'wan wan6 wg1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Remote-SSH-22'
option src 'wan'
option target 'ACCEPT'
option proto 'tcp'
option dest_port '22222'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config rule
option src '*'
option target 'ACCEPT'
option proto 'udp'
option dest_port '1234'
option name 'Allow-Wireguard-Inbound'
config zone
option input 'REJECT'
option forward 'REJECT'
option name 'wg1_vpn'
option output 'ACCEPT'
option network 'wg1_vpn'
config forwarding
option dest 'wan'
option src 'wg1_vpn'
config rule
option src_port '68'
option src 'wg1_vpn'
option name 'Allow-Wg1VPN-DHCPv4-Input'
option family 'ipv4'
option target 'ACCEPT'
option dest_port '67'
list proto 'udp'
/etc/config/network:
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd59:1d89:daaf::/48'
config interface 'lan'
option type 'bridge'
option ifname 'eth0.1'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
list dns '1.1.1.1'
list dns '1.0.0.1'
config interface 'wan'
option ifname 'eth1.2'
option proto 'pppoe'
option password 'XXX'
option ipv6 'auto'
option username 'XXX'
list dns '1.1.1.1'
list dns '1.0.0.1'
option peerdns '0'
config interface 'wan6'
option ifname 'eth1.2'
option proto 'dhcpv6'
list dns '1.1.1.1'
list dns '1.0.0.1'
option reqprefix 'auto'
option reqaddress 'try'
option peerdns '0'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0 1 2 3 5t'
option vid '1'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '4 6t'
option vid '2'
config interface 'wg0'
option proto 'wireguard'
option private_key 'XXX'
option listen_port '1234'
list addresses '10.20.20.1/24'
config wireguard_wg0
option public_key 'XXX'
option description 'Macbook'
option persistent_keepalive '25'
list allowed_ips '10.20.20.2/32'
option route_allowed_ips '1'
config wireguard_wg0
option public_key 'XXX'
option description 'iPhone'
option persistent_keepalive '25'
list allowed_ips '10.20.20.3/32'
option route_allowed_ips '1'
config interface 'wg1'
option proto 'wireguard'
list addresses 'XXX/32'
option private_key 'XXX'
option delegate '0'
option ip4table '100'
option ip6table '100'
config wireguard_wg1
option public_key 'XXX'
option description 'XXX'
option persistent_keepalive '25'
option endpoint_port '1194'
list allowed_ips '0.0.0.0/0'
option preshared_key 'XXX'
option endpoint_host 'XXX'
option route_allowed_ips '1'
config interface 'wg1_vpn'
option proto 'static'
option ipaddr '192.168.2.1'
option netmask '255.255.255.0'
list dns '1.1.1.1'
list dns '1.0.0.1'
option delegate '0'
config rule 'wgrule'
option in 'wg1_vpn'
option lookup '100'