Posted: Wed Apr 22, 2020 2:28 Post subject: VPN help required for both WiFi and Ethernet Ports
Greetings fellow dd-wrt-ers,
I am trying to set-up dd-wrt to enable both VPN and direct connections on both WiFi and Ethernet ports.
I currently have dd-wrt installed on a Netgeart R7000 4-port WiFi router.
The version of dd-wrt that I have installed is: Firmware: DD-WRT v3.0-r41813 std (12/29/19)
My final goal is to have the following set-up
Wifi:
2Gz Access Point - Direct connection
5Gz Access Point - Direct connection
5Gz Virtual Access Point - VPN Connection
Ethernet:
Port 1 - Direct connection
Port 2 - VPN connection
Port 3 - VPN connection
Port 4 - VPN connection
Currently by using the tutorial [https://medium.com/@libertylocked/dd-wrt-tricks-dedicated-wireless-virtual-access-point-for-openvpn-the-easy-way-6399fca14916] I have managed to set-up the WiFi component as documented above.
It's important to note that I am using Policy Based Routing to obtain the desired result on WiFi. I assume that I will need to do something similar to get this working on my Ethernet ports, however, I am now stuck as to how to proceed to achieve a similar set-up for the Ethernet ports.
Any thoughts or advice would be greatly appreciated.
Thanks,
junipergrower
Notes:
Edited to add dd-wrt version.
Last edited by junipergrower on Wed Apr 22, 2020 4:12; edited 1 time in total
Joined: 18 Mar 2014 Posts: 12877 Location: Netherlands
Posted: Wed Apr 22, 2020 8:04 Post subject:
See the policy based routing guide in my signature at the bottom of this post.
If you have any question left ( I cannot imagine ) please ask
For ethernet ports via VPN you have to use VLANS, set the ports you want to use the VPN on a separate VLAN, create a bridge and attach that VLAN and the VAP to that bridge and then place the IP range of that bridge under PBR and bob's your uncle
See the policy based routing guide in my signature at the bottom of this post.
Thank you for the pointers. I'll dive into the recommended file and see what I can do. Thank you for the quick reply.
egc wrote:
But why not use IP based routing, it is easier, just hand out static leases to the clients you want to use the VPN and place that under PBR
That's a good idea but won't fit my use-case which is that I want any new and adhoc device connecting to the network to just be able to connect with standard DCHP. It's a family network so we end-up with all sorts of devices being attached
Thanks again. But unless I misunderstood you, I think I need to do the opposite of what you described.
I can place the entire network (WiFi and Network Ports) behind a VPN using dd-wrt's built in OpenVPN client. I then want to add a single additional WiFi VAP that would allow devices connected to it to directly access the Internet and bypass the VPN. Said another way, only the VAP would not be behind the VPN, but all other ports and WiFi points would be behind the VPN. I want the default for all access points to be behind the VPN with the single exception of the newly created WiFi VAP.
Is this possible?
Thanks again for your help and patience. I really appreciate it. While my general IT and tech skills are ok-good, my networking skills are very noobish.
egc wrote:
junipergrower wrote:
@egc
Would it be simpler to have the entire router utilizing the VPN client and then set-up a single WiFI VAP that bypassed the VPN?
Any ideas on how I would do that?
In the meantime I'm looking into your first set of PBR suggestions. Thanks again.
Certainly, make an unbridged VAP e.g. if your router is 192.168.1.1/24 you make an unbridged VAP on 192.168.2.1/24
In the PBR field enter: 192.168.2.1/24
and now the whole VAP is routed via the VPN
Joined: 18 Mar 2014 Posts: 12877 Location: Netherlands
Posted: Thu Apr 23, 2020 7:31 Post subject:
junipergrower wrote:
Thanks again. But unless I misunderstood you, I think I need to do the opposite of what you described.
I can place the entire network (WiFi and Network Ports) behind a VPN using dd-wrt's built in OpenVPN client. I then want to add a single additional WiFi VAP that would allow devices connected to it to directly access the Internet and bypass the VPN. Said another way, only the VAP would not be behind the VPN, but all other ports and WiFi points would be behind the VPN. I want the default for all access points to be behind the VPN with the single exception of the newly created WiFi VAP.
Is this possible?
Thanks again for your help and patience. I really appreciate it. While my general IT and tech skills are ok-good, my networking skills are very noobish.
egc wrote:
junipergrower wrote:
@egc
Would it be simpler to have the entire router utilizing the VPN client and then set-up a single WiFI VAP that bypassed the VPN?
Any ideas on how I would do that?
In the meantime I'm looking into your first set of PBR suggestions. Thanks again.
Certainly, make an unbridged VAP e.g. if your router is 192.168.1.1/24 you make an unbridged VAP on 192.168.2.1/24
In the PBR field enter: 192.168.2.1/24
and now the whole VAP is routed via the VPN
Yes you do it the other way around set 192.168.1.1/24 in the PBR field
Or if you only want the DHCP client of the routers subnet set DHCP to start at .64 and set Maximum DHCP users to 64 and then enter 192.168.1.64/26 in the PBR field so that all DHCP users will use the VPN and of course create an additional VAP for user to use if they do not want the VPN.
I'm almost there. But I'm missing one item. In Summary
1) Enable VPN client which sets all APs to VPN [done]
2) Create new VAP for WiFi with IP range 192.168.22.1 and subnet mask 255.255.255.0 [done]
3) Enable PBR in VPN Client with 192.168.22.1/24 [fail]
When I get to step 3, all my connections no longer work.
If I understand PBR correctly, it is telling the VPN to only route packets that fit the PBR criteria.
If this is correct, then my problem is that I need the inverse of this i.e. route all packets via VPN except those in the range 192.168.22.1/24 (which is the IP range of the new VAP).
Thank you for hanging in there. I feel that I am so close, I just need to crack the last element which is to allow devices connecting to the VAP to bypass the VPN.
Can you please take one more go at helping a slow student
egc wrote:
Yes you do it the other way around set 192.168.1.1/24 in the PBR field
Or if you only want the DHCP client of the routers subnet set DHCP to start at .64 and set Maximum DHCP users to 64 and then enter 192.168.1.64/26 in the PBR field so that all DHCP users will use the VPN and of course create an additional VAP for user to use if they do not want the VPN.
Joined: 18 Mar 2014 Posts: 12877 Location: Netherlands
Posted: Thu Apr 23, 2020 13:50 Post subject:
junipergrower wrote:
I'm almost there. But I'm missing one item. In Summary
1) Enable VPN client which sets all APs to VPN [done]
2) Create new VAP for WiFi with IP range 192.168.22.1 and subnet mask 255.255.255.0 [done]
3) Enable PBR in VPN Client with 192.168.22.1/24 [fail]
When I get to step 3, all my connections no longer work.
If I understand PBR correctly, it is telling the VPN to only route packets that fit the PBR criteria.
If this is correct, then my problem is that I need the inverse of this i.e. route all packets via VPN except those in the range 192.168.22.1/24 (which is the IP range of the new VAP).
Thank you for hanging in there. I feel that I am so close, I just need to crack the last element which is to allow devices connecting to the VAP to bypass the VPN.
Can you please take one more go at helping a slow student
egc wrote:
Yes you do it the other way around set 192.168.1.1/24 in the PBR field
Or if you only want the DHCP client of the routers subnet set DHCP to start at .64 and set Maximum DHCP users to 64 and then enter 192.168.1.64/26 in the PBR field so that all DHCP users will use the VPN and of course create an additional VAP for user to use if they do not want the VPN.
You can mix and match
You wrote that all your connections no longer work, does that mean you have no internet or that the VPN is not used?
The latter should be the case only the IP addresses entered in the VPN/PBR will take the VPN.
So if your normal network is 192.168.1.1/24 then enter that in the VPN PBR field.
Until recently you could not enter your routers own IP address in PBR because you lock yourself out but in recent builds you should be able to do so, so you still see a lot of people using this (which is still useful if you want your router free for connecting from the internet):
192.168.1.2/31
192.168.1.4/30
192.168.1.8/29
192.168.1.16/28
192.168.1.32/27
192.168.1.64/26
192.168.1.128/25
I do have a solution that does not require firmware mod.
Exressvpn allows you to download linux based software " as a line code" , ie it basically runs in the background. If you ever disconnect from teh vpn server it blocks your connection.
Posted: Sat Apr 25, 2020 6:16 Post subject: Re: Policy Routing on Ethernet
Hi, I have not tried that specific configuration. What I ended-up with instead was VPN on everything (Wifi & Ethernet) that's part of the base IP range (192.168.1.1/24) and then created a separate Wireless VAP with it's own UP range. That ended-up sorting out my problem, but as the router currently stands, all the Ports are linked to the VPN and I can only get direct ISP access by accessing the seperate WiFi VAP.
Do you mind if I ask what your use case is?
As an aside, the router seems to need around 2-4 minutes after booting before everything works. I'm not sure why this is.
However for now I am happy that I've managed to get my entire network behind a VPN but still have access to a direct Internet connection if the need arises e.g. certain apps such as Netflix or software (perhaps games) where low latency is critical.
In order to get the set-up you are looking for, I would try the following:
- Create a bridge for your new direct IP range.
- Use "Setup > Switch Config" and move your specific port to the newly created bridge.
- You will also likely have to create an additional DHCP via "Setup > Networking > DHCPD".
Hopefully these pointers propel you in the right direction. At the end of the day I dropped the need for direct ISP access via Ethernet as I was able to get what I needed done by having a WiFi VAP available.
Have a go and good luck.
As an aside, and I know that this is obvious but it took me a while to figure it out, make sure you have a backup of your working system before you start messing around. I needed to factory reset my router numerous times on my journey of discovery and being able to quickly get back to a working state was a life saver.
paultranemail wrote:
can you do the policy routing on the ethernet like you do in wifi
Like this :
Port 1 - Direct connection
Port 2 - VPN connection
Port 3 - VPN connection
Port 4 - VPN connection
) please ask
