Skip to content

Instantly share code, notes, and snippets.

@danpawlik

danpawlik/wireguard-ssid.md

Created May 15, 2024 14:43
Show Gist options
  • Save danpawlik/d96c057f47de9a1caf79ddff9890c114 to your computer and use it in GitHub Desktop.
Save danpawlik/d96c057f47de9a1caf79ddff9890c114 to your computer and use it in GitHub Desktop.
Download ZIP
Create wireless SSID that is connected to the Wireguard network
Raw
wireguard-ssid.md

Guide comes from the reddit topic - One Router, One Wireguard VPN, Two SSIDs

https://www.reddit.com/r/openwrt/comments/yyhm7i/comment/j94zi5m/

Assuming you don't have IPv6, have OpenWRT 22.03 with LuCI and already have:

  • one interface (wan) with a default route in the wan firewall zone

  • one bridge for your lan

  • one interface (lan) with static ip and dhcp in the lan firewall zone

  • a wifi ap attached to that interface (lan)

You need to create:

  • an empty bridge with no ports attached, select "bring up empty bridge", name it brvpn

  • a new interface on a different subnet from your lan interface (example: 192.168.71.1, netmask 255.255.255.0), add it to the lan firewall zone, select the bridge you just created, name it vpnlan, enable dhcp

    • go to "DHCP Server" -> "Advanced Settings" and in DHCP-Options add: 6,1.1.1.1,1.0.0.1 (or whatever public DNS you want to use) as otherwise you'll end up using your main DNS server without going through the VPN and leak your DNS requests

  • create a new wireguard interface, name it vpnwan, add it to the wan firewall zone, click load configuration and import it

    • check "no host routes" on the "general settings" tab

    • go to "peers" then select the only peer, and disable "Route Allowed IPs"

    • make sure that "Allowed IPs" is 0.0.0.0/0

  • create a new wifi ap attached to that interface (vpnlan)

  • go to "Routing" -> "Static IPv4 Routes", then add a new route to 0.0.0.0/0 interface vpnwan, in advanced settings, in "Table" put 3 (or any number except 0, 253, 254 or 255)

  • go to "IPv4 Rules" and add a rule: "Source" - your vpnlan network (in the above example: 192.168.71.0/24), "Table" 3 (or the number you put in the step above)

Configuration files output

On the end, the example configuration looks like:

  • /etc/config/network
config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fde4:d1c2:780f::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

config device
	option type 'bridge'
	option name 'brvpn'
	option bridge_empty '1'

config interface 'vpnlan'
	option proto 'static'
	option device 'brvpn'
	option ipaddr '192.168.2.1'
	option netmask '255.255.255.0'

config interface 'vpnwan'
	option proto 'wireguard'
	option private_key 'm(...)VWE='
	list addresses '10.0.5.2/32'
	list dns '10.0.5.1'
	option nohostroute '1'

config wireguard_vpnwan
	option description 'Imported peer configuration'
	option public_key 'Imim(...)Q3I='
	option preshared_key 'vh3Obr(...)='
	list allowed_ips '0.0.0.0/0'
	list allowed_ips '::/0'
	option persistent_keepalive '25'
	option endpoint_host 'XXX.duckdns.org'
	option endpoint_port '51820'

config route
	option interface 'vpnwan'
	option target '0.0.0.0/0'
	option metric '3'

config rule
	option src '192.168.2.0/24'
	option lookup '3'
  • /etc/config/dhcp
config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	option ra_slaac '1'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'vpnlan'
	option interface 'vpnlan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	list dhcp_option '6,1.1.1.1,1.0.0.1'
  • /etc/config/firewall (no changes comparing to default settings)
config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'
	option flow_offloading '1'
	option flow_offloading_hw '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'
	list network 'vpnlan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'
	list network 'vpnwan'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'
  • /etc/config/wireless
config wifi-device 'radio0'
	option type 'mac80211'
	option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
	option channel '1'
	option band '2g'
	option htmode 'HT20'
	option disabled '0'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
  option ssid 'SOMESSID_LAN'
	option encryption 'sae-mixed'  
 	option key 'SOMEKEY'

config wifi-device 'radio1'
	option type 'mac80211'
	option path '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
	option channel '36'
	option band '5g'
	option htmode 'VHT80'
	option cell_density '0'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'vpnlan'
	option mode 'ap'
	option ssid 'SOMESSID_WG'
	option encryption 'sae-mixed'
	option key 'SOMEKEY'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment