equipment:rbpi_openwrt
Differences
This shows you the differences between two versions of the page.
| Next revision | Previous revision | ||
| equipment:rbpi_openwrt [2024/01/12 11:05] – created dirk | equipment:rbpi_openwrt [2024/02/09 08:10] (current) – [Setup OpenWRT] dirk | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== Setup OpenWRT with WireGuard VPN on a Raspberry Pi 4 ====== | ====== Setup OpenWRT with WireGuard VPN on a Raspberry Pi 4 ====== | ||
| This will guide you through the setup of [[server: | This will guide you through the setup of [[server: | ||
| - | ===== Install | + | ===== Install |
| - | * Download software from https://www.opnsense.org/download/ | + | * Download software from https://openwrt.org/toh/ |
| - | * System architecture: amd64 | + | * Model: Raspberry Pi 4 |
| - | * image type: vga | + | * Version: B |
| - | * Use balenaEtcher or other usb boot drive creator | + | * For the above: |
| - | * Turn on the device and boot from USB to load installer. | + | * Use balenaEtcher or other favorite tool to write OpenWRT onto SD card. |
| - | * login as ' | + | * See webpage info below for optional step of resizing |
| - | * select keyboard layout, Install (UFS), select harddrive, ok on swap, change password, reboot without USB plugged in. | + | * Put SD card in Pi, connect ethernet and power on. |
| - | Link: https:// | + | ===== Setup OpenWRT |
| - | ===== Connect | + | * Go to http://192.168.1.1 |
| - | * plug into the LAN port (see below note for the FW4C) and navigate | + | * Set a new password by following the prompts. |
| - | * NOTE: OPNsense defines ports right to left as LAN, WAN but the Protectli FW4C labels them right to left as WAN, LAN. So you'll have to plug into the WAN port for this initial | + | * Change IP block. |
| - | * log in using ' | + | * Go to Network and choose |
| - | * go to Interfaces / Assignments and swap the LAN and WAN ports if needed (see above note) | + | * Edit the LAN |
| - | * once this step is complete, you'll need to plug the wire into the new LAN port and re-login | + | * Protocol: Static |
| - | ===== Setup ===== | + | * Bring up on boot: checked |
| - | * go to Interfaces / LAN | + | * IPv4 address: 10.28.9.1 |
| - | * make sure it is enabled and locked | + | * IPv4 netmask: 255.255.255.0 |
| - | * config type Static IPv4 | + | |
| - | * set IPv4 address to your desire (10.23.79.1/24 for me) | + | |
| - | * upstream gateway is auto-detect | + | |
| - | * Save/Apply | + | |
| - | * go to Interfaces / WAN | + | |
| - | * make sure it is enabled and locked | + | |
| - | * block private and bogon networks | + | |
| - | * config type DHCP (for CenturyLink at least) | + | |
| - | * Save/ | + | |
| - | ===== Setting up with CenturyLink Quantum Fiber ===== | + | |
| - | * This service provider requires traffic from the ONT to go to a router set to VLAN 201 | + | |
| - | * go to Interfaces | + | |
| - | * create new by clicking on the " | + | |
| - | * Device: vlan01 | + | |
| - | * Parent: igc0 (the address | + | |
| - | * VLAN tag: 201 | + | |
| - | * VLAN priority: Best Effort | + | |
| - | * Description: Internet | + | |
| * Save | * Save | ||
| - | * go to Interfaces / Assignments | + | * Save Apply and reconnect |
| - | * change WAN to the new vlan01 that you just created | + | * From the top menu, click on Network and choose Wireless. |
| - | * Save/Apply/Reboot(?) | + | * Click Remove next to the existing wireless config and then Save & Apply. |
| - | * Plug line from internet into WAN port. | + | * Click Scan to search for available networks, find your and click Join Selected. |
| - | ===== Firewall/ | + | * Enter your WiFi password in the WPA passphrase box and click Submit and then Save. |
| - | ==== Port Forwarding ==== | + | * Click Save & Apply to connect to your WiFi. |
| - | * go to Firewall / NAT / Port Forward | + | * You now have a WAN connection on the internal WiFi adapter and a LAN connection on the LAN port. |
| - | * create new rule by clicking | + | * Now add USB WiFi card as radio1 for our WiFi access point for clients |
| - | * Interface: WAN | + | * From the top menu, click on the Network tab and choose Wireless. |
| - | * Protocol: TCP | + | * If you see radio1, you are all good with the installation of the second WiFi adapter. If not, use these steps to install drivers. |
| - | * Source Advanced should all be "any" | + | * Click System -> Software |
| - | * Destination: WAN address | + | * Click Update lists... |
| - | * Destination port range: select outside port (example: 80 or 443) | + | * when done, in the filter box type "kmod-" |
| - | * Redirect target IP: Single host or Network | + | * For my CanaKit Raspberry Pi WiFi Wireless Adapter/ |
| - | * Redirect target port: (other) / internal server port (example: 180 or 1443) | + | * pretty sure the 2800-lib and 2800-usb files installed the 2x00 ones as well. |
| - | * Description: | + | * Now you should have radio1 show up under Network |
| - | * NAT reflection: Enabled | + | * Click Edit for the OpenWrt SSID (under the radio1) |
| - | * Filter rule association: | + | * Click Enable for Wireless network is disabled |
| - | * Save/Apply | + | * Change Operating Frequency to 7 or anything that is free |
| - | * repeat for other forwarded ports | + | * Under Interface Configuration, |
| - | * Port Forwarding rules if unraid/ Nginx:< | + | * Click Save |
| - | 443 | + | * Click Save & Apply |
| - | 22 Both 10.23.79.X | + | Link: https://tristam.ie/2023/582/# |
| - | * Port Forwarding rules if standalone:< | + | |
| - | 443 | + | |
| - | 22 Both 10.23.79.X | + | |
| - | 32400 | + | |
| - | * Hairpin NAT: | + | |
| - | * go to Firewall | + | |
| - | * Check " | + | |
| - | * Save / Apply | + | |
| - | ==== Wireguard | + | ===== Setup WireGuard |
| - | === Create Instance and Peers === | + | * From OpenWRT top menu, click System |
| - | * go to System | + | * Click Update lists button and wait for process |
| - | * go to VPN / WireGuard / Settings / Instances | + | * Click Dismiss |
| - | * create new instance by clicking on the " | + | * Install the following packages |
| - | * Enabled: check | + | * kmod-wireguard |
| - | * Name: WG1 | + | * luci-proto-wireguard |
| - | * click the gear to create a Public/ | + | * luci-app-wireguard |
| - | * we will call this public key " | + | * Click Network-> |
| - | * Listen port: 51820 | + | * enter wg0 as the interface name. |
| - | * Tunnel address: pick a subnet not used elsewhere (10.23.0.1/ | + | * select |
| - | * Save/Apply | + | * click Create interface |
| - | * go to VPN / WireGuard / Settings / General and enable WireGuard | + | * Click General Settings tab and enter following parameters from your Wireguard setup. |
| - | * go to VPN / WireGuard / Settings / Peers | + | * Bring up on boot: checked |
| - | * create new peer by clicking | + | * Private Key: Generate new key pair |
| - | * Enabled: check | + | * Public Key: this will go into your home wireguard setup on the other end as the peer's public key) |
| - | * Name: iPhone / Macbook / whatever | + | * Listen Port: blank |
| - | * Public key: PEERPUBLIC | + | * IP Addresses: whatever you assign it in your home wireguard setup as the peer's ip (10.23.0.13/32) |
| - | * Allowed IPs: something on the subnet configured above (10.23.0.11/32) | + | * Click Advanced Settings tab |
| - | * Instances: | + | * Use default gateway: checked |
| - | * Save/ | + | * enter custom |
| - | * go to VPN / WireGuard / Settings / Instances / Edit WG1 | + | * Click on the Firewall tab and select the WAN zone for Create/ |
| - | * Add Peers into Peers drop down | + | * Click the Peers tab and Add peer |
| - | * Save/ | + | * Description: |
| - | * go to Lobby / Dashboard and restart wireguard | + | |
| - | === Create interface | + | * Private Key: blank |
| - | * go to Interfaces / Assignments | + | * Preshared key: blank |
| - | * in the drop down under new interface, select the WireGuard instance (wg1) | + | * Allowed IPs: 0.0.0.0/0 |
| - | * Enable: check | + | * Route Allowed IPs: checked |
| - | * Description: WG1 | + | * Endpoint Host: brimble.com |
| - | * Save/ | + | * Endpoint Port: 51820 |
| - | * go to Interfaces / WG1 | + | * Persistent Keep Alive: 25 |
| - | * Enable: check | + | * Click Save and then Save & Apply. |
| - | * Description: | + | * Also, set custom |
| - | * Save/ | + | |
| - | === Create VPN Firewall rules === | + | |
| - | * go to Firewall / Rules / WAN | + | |
| - | * create new rule by clicking | + | |
| - | * Action: Pass | + | |
| - | * Quick: check | + | |
| - | * Interface: WAN | + | |
| - | * Direction: in | + | |
| - | * TCP/IP Version: IPv4 | + | |
| - | * Protocol: UDP | + | |
| - | * Source Invert: unchecked | + | |
| - | * Source: any | + | |
| - | * Destination Invert: unchecked | + | |
| - | * Destination: | + | |
| - | * Destination port range: from (other) | + | |
| - | * Description: allow wireguard inbound | + | |
| - | * Save/ | + | |
| - | * go to Firewall / Rules / [Name of interface assigned above (WG1)] | + | |
| - | * create new rule by clicking on the " | + | |
| - | * Action: Pass | + | |
| - | * Quick: check | + | |
| - | * Interface: WG1 | + | |
| - | * Direction: in | + | |
| - | * TCP/IP Version: IPv4 | + | |
| - | * Protocol: any | + | |
| - | * Source Invert: unchecked | + | |
| - | * Source [Name of interface assigned above NET (WG1 net)] | + | |
| - | * Destination Invert: unchecked | + | |
| - | * Destination: | + | |
| - | * Destination port range: any | + | |
| - | * Save/ | + | |
| - | === Setup Clients === | + | |
| - | * This will differ based on device... principal is the same. | + | |
| - | * iPhone | + | |
| - | * Download WireGuard from app store | + | |
| - | * create new | + | |
| - | * Name: brimble.com | + | |
| - | * Generate keypair | + | |
| - | * This public key (PEERPUBLIC) will go in VPN / WireGuard / Settings / Peers / Public key box | + | |
| - | * Addresses: | + | |
| - | * Listen port: Automatic | + | |
| - | * MTU: Automatic | + | |
| - | * DNS servers: 8.8.8.8, 8.8.4.4 | + | |
| - | * click Add peer | + | |
| - | * Public | + | |
| - | * Preshared key: blank | + | |
| - | * Endpoint: the address and port of your server (brimble.com: | + | |
| - | * Allowed IPs: 0.0.0.0/0 | + | |
| - | * Save | + | |
| - | * macbook | + | |
| - | * Downlaod WireGuard from app store | + | |
| - | * create new | + | |
| - | * Name: brimble.com | + | |
| - | * This public key (PEERPUBLIC) will go in VPN / WireGuard / Settings / Peers / Public key box | + | |
| - | * < | + | |
| - | PrivateKey = whatever is there | + | |
| - | Address = This will be whatever you put in the Allowed IPs box of VPN / WireGuard / Settings / Peers (10.23.0.11/32) | + | |
| - | DNS = 8.8.8.8, 8.8.4.4 | + | |
| - | [Peer] | + | Link: https://tristam.ie/2023/805/ |
| - | PublicKey = MAINPUBLIC this will be in VPN / WireGuard / Settings / Instances / Public key box | + | |
| - | AllowedIPs = 0.0.0.0/0 | + | |
| - | Endpoint = the address and port of your server (brimble.com: | + | |
| - | </ | + | |
| - | * Save | + | |
| - | Link: https://docs.opnsense.org/manual/how-tos/ | + | |
| - | ==== NAT for online gaming ==== | + | |
| - | * go to Firewall / Aliases | + | |
| - | * create new alias by clicking on the " | + | |
| - | * Enabled: check | + | |
| - | * Name: NintendoSwitch | + | |
| - | * Type: Host(s) | + | |
| - | * Content: IP address of Switch | + | |
| - | * Save/ | + | |
| - | * go to Firewall / NAT / Outbound | + | |
| - | * change mode to Hybrid so you can add manual rule | + | |
| - | * create new rule by clicking on the " | + | |
| - | * Interface: WAN | + | |
| - | * Protocol: any | + | |
| - | * Source address: NintendoSwitch | + | |
| - | * Static-port: | + | |
| - | * Give it a description | + | |
| - | * Save/Apply | + | |
| - | Link: https:// | + | ===== Connect ===== |
| - | + | * Use laptop to connect to broadcasting WiFi | |
| - | ==== Services | + | * go to 10.28.9.1 (or whatever your LAN is) |
| - | * DHCPv4 | + | * go to network/wireless |
| - | * Range Start 10.23.79.100 | + | * click scan next to radio0 and connect |
| - | * Range Stop 10.23.79.245 | + | * click Save & Apply |
| - | * Save Apply | + | * Should now be connected and devices connecting to your device should work (might require reboot?) |
| - | * Static MAC/IP Mapping< | + | * If using a captive portal interface you need tunnel thru DNS to bypass captive portals, specifically on port 53. To do this you need to disable "DNS rebinding protection" |
| - | BrimUpstairsAP | + | |
| - | BrimDownstairsAP 10.23.79.6 | + | |
| - | + | ||
| - | </ | + | |
| - | * DNS (System / Settings / General | + | |
| - | * 10.23.79.1 to use ISPs | + | |
| - | * 10.23.79.3 if using PiHole | + | |
| - | * 8.8.8.8 / 8.8.4.4 | + | |
| - | | + | |
| - | | + | |
| - | * go to Services / Dynamic DNS / Settings | + | |
| - | * add new one by clicking on the "+" | + | |
| - | * Enabled | + | |
| - | * Service : easyDNS | + | |
| - | * Username : easyDNS username | + | |
| - | * Password : easyDNS token (not password). Token can be gotten from website | + | |
| - | * Hostnames: brimble.com | + | |
| - | * Check ip method: dyndns | + | |
| - | * Interface to monitor: WAN | + | |
| - | * Check ip timeout: 10 | + | |
| - | * Force SSL: checked | + | |
| - | * Save/Apply | + | |
equipment/rbpi_openwrt.1705079106.txt.gz · Last modified: by dirk
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
