Wireguard VPN through WiFi for router running as a dumb AP

Installing and Using OpenWrt Network and Wireless Configuration
1

Hello Everyone, I'm new to networking so please excuse me if my question is not coherent enough. I tried my hands at a few recommendations but was still having trouble so I'm seeking some help here.

Current Setup:
I have 2 routers, of which the Main Router is from the ISP(using as-is) and the second router is setup as a OpenWRT Dumb AP, which is working as expected for both LAN and Wi-Fi.
Wireguard VPN client setup to connect to a commercial VPN, and it is able to establish hand-shake to the VPN service fine?.

Issue:
When I connect via LAN/Wi-Fi the Wireguard VPN is not in effect, however I'm able access the internet fine.

Objective:
To be able to Route all the clients connecting to the Wi-Fi to go through Wireguard VPN.

Observations:

  • Ping from router to domain.com is working fine
  • Checking my IP displays the VPN IP (showing that the connection is fine)
  • but traceroute is not working as expected.
ping + ipcheck + traceroute 
root@OpenWrt:~# ping google.com
PING google.com (74.125.130.113): 56 data bytes
64 bytes from 74.125.130.113: seq=0 ttl=109 time=52.571 ms
64 bytes from 74.125.130.113: seq=1 ttl=109 time=52.115 ms
64 bytes from 74.125.130.113: seq=2 ttl=109 time=52.313 ms
64 bytes from 74.125.130.113: seq=3 ttl=109 time=52.080 ms
--- google.com ping statistics ---
4 packets transmitted, 4 packets received, 0% packet loss
round-trip min/avg/max = 52.080/52.269/52.571 ms

root@OpenWrt:~# curl ipinfo.io
  "ip": "86.4x.xx.47",
   "country": "SG",
  "org": "AS136787 TEFINCOM S.A.",

root@OpenWrt:~# traceroute google.com
traceroute to google.com (74.125.130.139), 30 hops max, 46 byte packets
 1  *  *  *
 2  *  *  *
 3  *  *  *
 4  *  *  *
 5  *  *  *
 6  *  *

My Config:

IP05ZLn778
IP05ZLn778873×759 115 KB

Relevant Info

/etc/config/network 
config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdxx:edxx:5axx::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.1.100'
        option broadcast '192.168.1.255'
        option gateway '192.168.1.1'
        list dns '103.86.96.100'
        list dns '103.86.99.100'

config device
        option name 'eth0.2'
        option macaddr '10:xx:xx:xx:xx:4e'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0 1 2 3 4 6t'

config interface 'w0'
        option proto 'wireguard'
        option private_key 'EFxxxxxxxx='
        option listen_port '51820'
        list addresses '10.5.0.2/32'

config wireguard_w0
        option description 'sgp481'
        option public_key 'U3xxxxx='
        list allowed_ips '0.0.0.0/0'
        list allowed_ips '::/0'
        option route_allowed_ips '1'
        option endpoint_host 'sg481.vpn.com'
        option endpoint_port '51820'
        option persistent_keepalive '25'
/etc/config/firewall 
config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'vpnsg'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'w0'

config forwarding
        option src 'lan'
        option dest 'vpnsg'
wg show 
interface: w0
  public key: a4xxxxxxxxxxxxxxxx
  private key: (hidden)
  listening port: 51820

peer: U3xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  endpoint: 8x.xx.xx.xxx:51820
  allowed ips: 0.0.0.0/0, ::/0
  latest handshake: 2 minutes, 2 seconds ago
  transfer: 15.09 KiB received, 19.77 KiB sent
  persistent keepalive: every 25 seconds
/etc/config/wireless 
config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/10300000.wmac'
        option channel '1'
        option band '2g'
        option htmode 'HT20'
        option disabled '1'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'OpenWrt'
        option encryption 'none'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'pci0000:00/0000:00:00.0/0000:01:00.0'
        option channel '36'
        option band '5g'
        option htmode 'VHT80'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option mode 'ap'
        option ssid 'OpenWrt'
        option encryption 'none'
        option network 'lan'

Please let me know, if you need any further information.

2

The OpenWrt must not be configured as dumbAP if you want the connected hosts to use its upstream VPN.
You need a default setup and on top of that the VPN configuration.

1 Like
3

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.