equipment:rbpi_openwrt
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| equipment:rbpi_openwrt [2024/01/12 11:19] – [Install OPNsense] dirk | equipment:rbpi_openwrt [2024/02/09 08:10] (current) – [Setup OpenWRT] dirk | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== Setup OpenWRT with WireGuard VPN on a Raspberry Pi 4 ====== | ====== Setup OpenWRT with WireGuard VPN on a Raspberry Pi 4 ====== | ||
| This will guide you through the setup of [[server: | This will guide you through the setup of [[server: | ||
| - | ===== Install | + | ===== Install OpenWRT ===== |
| * Download software from https:// | * Download software from https:// | ||
| * Model: Raspberry Pi 4 | * Model: Raspberry Pi 4 | ||
| Line 9: | Line 9: | ||
| * See webpage info below for optional step of resizing the default partition. | * See webpage info below for optional step of resizing the default partition. | ||
| * Put SD card in Pi, connect ethernet and power on. | * Put SD card in Pi, connect ethernet and power on. | ||
| - | | + | |
| - | * set a new password by following the prompts. | + | ===== Setup OpenWRT ===== |
| + | | ||
| + | * Set a new password by following the prompts. | ||
| + | * Change IP block. | ||
| + | * Go to Network and choose Interfaces. | ||
| + | * Edit the LAN | ||
| + | * Protocol: Static address | ||
| + | * Bring up on boot: checked | ||
| + | * IPv4 address: 10.28.9.1 | ||
| + | * IPv4 netmask: 255.255.255.0 | ||
| + | * Save | ||
| + | * Save Apply and reconnect to new IP address with new password. | ||
| * From the top menu, click on Network and choose Wireless. | * From the top menu, click on Network and choose Wireless. | ||
| * Click Remove next to the existing wireless config and then Save & Apply. | * Click Remove next to the existing wireless config and then Save & Apply. | ||
| Line 18: | Line 29: | ||
| * You now have a WAN connection on the internal WiFi adapter and a LAN connection on the LAN port. | * You now have a WAN connection on the internal WiFi adapter and a LAN connection on the LAN port. | ||
| * Now add USB WiFi card as radio1 for our WiFi access point for clients to connect to. | * Now add USB WiFi card as radio1 for our WiFi access point for clients to connect to. | ||
| - | * The Wifi card I have from a previous nonWifi Pi bundle seems compatable and may not require any extra install steps. See link below for more info if it does. | ||
| * From the top menu, click on the Network tab and choose Wireless. | * From the top menu, click on the Network tab and choose Wireless. | ||
| - | * If you see radio1, you are all good with the installation of the second WiFi adapter. | + | * If you see radio1, you are all good with the installation of the second WiFi adapter. If not, use these steps to install drivers. |
| - | * | + | * Click System -> Software |
| - | * Turn on the device | + | * Click Update lists... |
| - | * login as ' | + | * when done, in the filter box type " |
| - | * select keyboard layout, Install | + | * For my CanaKit Raspberry Pi WiFi Wireless Adapter/ |
| + | * pretty sure the 2800-lib and 2800-usb files installed the 2x00 ones as well. | ||
| + | * Now you should have radio1 show up under Network -> Wireless. | ||
| + | * Click Edit for the OpenWrt SSID (under the radio1) | ||
| + | * Click Enable for Wireless network is disabled | ||
| + | * Change Operating Frequency to 7 or anything that is free | ||
| + | * Under Interface Configuration, select | ||
| + | * Click Save | ||
| + | * Click Save & Apply | ||
| + | Link: https:// | ||
| - | Link: https:// | + | ===== Setup WireGuard VPN ===== |
| - | ===== Connect | + | * From OpenWRT top menu, click System tab and choose Software. |
| - | * plug into the LAN port (see below note for the FW4C) and navigate to 192.168.1.1 | + | * Click Update lists button and wait for process |
| - | * NOTE: OPNsense defines ports right to left as LAN, WAN but the Protectli FW4C labels them right to left as WAN, LAN. So you'll have to plug into the WAN port for this initial login and we will switch the ports in software so that the labels are matched up. | + | * Click Dismiss |
| - | * log in using ' | + | * Install |
| - | * go to Interfaces / Assignments and swap the LAN and WAN ports if needed (see above note) | + | * kmod-wireguard |
| - | * once this step is complete, you'll need to plug the wire into the new LAN port and re-login | + | * luci-proto-wireguard |
| - | ===== Setup ===== | + | * luci-app-wireguard |
| - | * go to Interfaces / LAN | + | * Click Network->Interfaces->Add new interface. |
| - | * make sure it is enabled and locked | + | * enter wg0 as the interface name. |
| - | * config type Static IPv4 | + | * select WireGuard VPN from protocol drop down |
| - | * set IPv4 address to your desire | + | * click Create interface |
| - | * upstream gateway is auto-detect | + | * Click General Settings tab and enter following parameters |
| - | * Save/ | + | * Bring up on boot: checked |
| - | * go to Interfaces | + | * Private Key: Generate new key pair |
| - | * make sure it is enabled and locked | + | * Public Key: this will go into your home wireguard setup on the other end as the peer's public key) |
| - | * block private and bogon networks | + | * Listen Port: blank |
| - | * config type DHCP (for CenturyLink at least) | + | * IP Addresses: whatever you assign it in your home wireguard setup as the peer's ip (10.23.0.13/ |
| - | * Save/ | + | * Click Advanced Settings tab |
| - | ===== Setting up with CenturyLink Quantum Fiber ===== | + | * Use default gateway: checked |
| - | * This service provider requires traffic | + | * enter custom DNS servers |
| - | * go to Interfaces / Other Types / VLAN | + | * Click on the Firewall tab and select the WAN zone for Create/ |
| - | * create new by clicking | + | * Click the Peers tab and Add peer |
| - | * Device: vlan01 | + | * Description: brimble.com |
| - | * Parent: igc0 (the address of the WAN port) | + | * Public Key: from the home wireguard instance setup |
| - | * VLAN tag: 201 | + | * Private Key: blank |
| - | * VLAN priority: Best Effort | + | * Preshared key: blank |
| - | * Description: | + | * Allowed IPs: 0.0.0.0/0 |
| - | * Save | + | * Route Allowed IPs: checked |
| - | * go to Interfaces / Assignments | + | * Endpoint Host: brimble.com |
| - | * change WAN to the new vlan01 that you just created | + | * Endpoint Port: 51820 |
| - | * Save/ | + | * Persistent Keep Alive: 25 |
| - | * Plug line from internet into WAN port. | + | * Click Save and then Save & Apply. |
| - | ===== Firewall/ | + | * Also, set custom DNS again in Interfaces->WWAN if not already. |
| - | ==== Port Forwarding ==== | + | |
| - | * go to Firewall / NAT / Port Forward | + | |
| - | * create new rule by clicking on the " | + | |
| - | * Interface: WAN | + | |
| - | * Protocol: TCP | + | |
| - | * Source Advanced should all be " | + | |
| - | * Destination: WAN address | + | |
| - | * Destination port range: select outside port (example: 80 or 443) | + | |
| - | * Redirect target IP: Single host or Network / internal IP address of the server (10.23.79.4) | + | |
| - | * Redirect target port: (other) / internal server port (example: 180 or 1443) | + | |
| - | * Description: whatever | + | |
| - | * NAT reflection: Enabled | + | |
| - | * Filter rule association: Add associated filter rule | + | |
| - | * Save/Apply | + | |
| - | * repeat for other forwarded ports | + | |
| - | * Port Forwarding rules if unraid/ Nginx:< | + | |
| - | 443 | + | |
| - | 22 Both 10.23.79.X | + | |
| - | * Port Forwarding rules if standalone:< | + | |
| - | 443 | + | |
| - | 22 Both 10.23.79.X | + | |
| - | 32400 | + | |
| - | * Hairpin NAT: | + | |
| - | * go to Firewall / Settings / Advanced | + | |
| - | * Check " | + | |
| - | * Save / Apply | + | |
| - | ==== Wireguard VPN ==== | + | Link: https://tristam.ie/2023/805/ |
| - | === Create Instance and Peers === | + | |
| - | * go to System / Firmware / Plugins and install os-wireguard | + | |
| - | * go to VPN / WireGuard / Settings / Instances | + | |
| - | * create new instance by clicking on the " | + | |
| - | * Enabled: check | + | |
| - | * Name: WG1 | + | |
| - | * click the gear to create a Public/Private key pair | + | |
| - | * we will call this public key " | + | |
| - | * Listen port: 51820 | + | |
| - | * Tunnel address: pick a subnet not used elsewhere (10.23.0.1/24) | + | |
| - | * Save/ | + | |
| - | * go to VPN / WireGuard / Settings / General and enable WireGuard | + | |
| - | * go to VPN / WireGuard / Settings / Peers | + | |
| - | * create new peer by clicking on the " | + | |
| - | * Enabled: check | + | |
| - | * Name: iPhone / Macbook / whatever | + | |
| - | * Public key: PEERPUBLIC (put in the key created when you setup the client... see below) | + | |
| - | * Allowed IPs: something on the subnet configured above (10.23.0.11/32) | + | |
| - | * Instances: select above instance (WG1) | + | |
| - | * Save/Apply | + | |
| - | * go to VPN / WireGuard / Settings / Instances / Edit WG1 | + | |
| - | * Add Peers into Peers drop down | + | |
| - | * Save/ | + | |
| - | * go to Lobby / Dashboard and restart wireguard | + | |
| - | === Create interface === | + | |
| - | * go to Interfaces / Assignments | + | |
| - | * in the drop down under new interface, select the WireGuard instance (wg1) | + | |
| - | * Enable: check | + | |
| - | * Description: | + | |
| - | * Save/ | + | |
| - | * go to Interfaces / WG1 | + | |
| - | * Enable: check | + | |
| - | * Description: | + | |
| - | * Save/ | + | |
| - | === Create VPN Firewall rules === | + | |
| - | * go to Firewall / Rules / WAN | + | |
| - | * create new rule by clicking on the " | + | |
| - | * Action: Pass | + | |
| - | * Quick: check | + | |
| - | * Interface: WAN | + | |
| - | * Direction: in | + | |
| - | * TCP/IP Version: IPv4 | + | |
| - | * Protocol: UDP | + | |
| - | * Source Invert: unchecked | + | |
| - | * Source: any | + | |
| - | * Destination Invert: unchecked | + | |
| - | * Destination: | + | |
| - | * Destination port range: from (other) 51820 to (other) 51820 | + | |
| - | * Description: | + | |
| - | * Save/ | + | |
| - | * go to Firewall / Rules / [Name of interface assigned above (WG1)] | + | |
| - | * create new rule by clicking on the " | + | |
| - | * Action: Pass | + | |
| - | * Quick: check | + | |
| - | * Interface: WG1 | + | |
| - | * Direction: in | + | |
| - | * TCP/IP Version: IPv4 | + | |
| - | * Protocol: any | + | |
| - | * Source Invert: unchecked | + | |
| - | * Source [Name of interface assigned above NET (WG1 net)] | + | |
| - | * Destination Invert: unchecked | + | |
| - | * Destination: | + | |
| - | * Destination port range: any | + | |
| - | * Save/ | + | |
| - | === Setup Clients === | + | |
| - | * This will differ based on device... principal is the same. | + | |
| - | * iPhone | + | |
| - | * Download WireGuard from app store | + | |
| - | * create new | + | |
| - | * Name: brimble.com | + | |
| - | * Generate keypair | + | |
| - | * This public key (PEERPUBLIC) will go in VPN / WireGuard / Settings / Peers / Public key box | + | |
| - | * Addresses: This will be whatever you put in the Allowed IPs box of VPN / WireGuard / Settings / Peers (10.23.0.11/ | + | |
| - | * Listen port: Automatic | + | |
| - | * MTU: Automatic | + | |
| - | * DNS servers: 8.8.8.8, 8.8.4.4 | + | |
| - | * click Add peer | + | |
| - | * Public key: MAINPUBLIC this will be in VPN / WireGuard / Settings / Instances / Public key box | + | |
| - | * Preshared key: blank | + | |
| - | * Endpoint: the address and port of your server (brimble.com: | + | |
| - | * Allowed IPs: 0.0.0.0/0 | + | |
| - | * Save | + | |
| - | * macbook | + | |
| - | * Downlaod WireGuard from app store | + | |
| - | * create new | + | |
| - | * Name: brimble.com | + | |
| - | * This public key (PEERPUBLIC) will go in VPN / WireGuard / Settings / Peers / Public key box | + | |
| - | * < | + | |
| - | PrivateKey = whatever is there | + | |
| - | Address = This will be whatever you put in the Allowed IPs box of VPN / WireGuard / Settings / Peers (10.23.0.11/ | + | |
| - | DNS = 8.8.8.8, 8.8.4.4 | + | |
| - | [Peer] | + | ===== Connect |
| - | PublicKey | + | * Use laptop |
| - | AllowedIPs | + | * go to 10.28.9.1 |
| - | Endpoint = the address and port of your server (brimble.com: | + | * go to network/wireless and remove whatever old wifi is under radio0 |
| - | </ | + | * click scan next to radio0 and connect |
| - | * Save | + | * click Save & Apply |
| - | Link: https:// | + | * Should now be connected and devices connecting |
| - | ==== NAT for online gaming | + | * If using a captive portal interface you need tunnel thru DNS to bypass captive portals, specifically on port 53. To do this you need to disable "DNS rebinding protection" (this option is ON by default) before you can do this. |
| - | * go to Firewall / Aliases | + | |
| - | * create new alias by clicking on the " | + | |
| - | * Enabled: check | + | |
| - | * Name: NintendoSwitch | + | |
| - | * Type: Host(s) | + | |
| - | * Content: IP address of Switch | + | |
| - | * Save/Apply | + | |
| - | * go to Firewall | + | |
| - | * change mode to Hybrid so you can add manual rule | + | |
| - | * create new rule by clicking on the "+" | + | |
| - | * Interface: WAN | + | |
| - | * Protocol: any | + | |
| - | * Source address: NintendoSwitch | + | |
| - | * Static-port: | + | |
| - | * Give it a description | + | |
| - | * Save/ | + | |
| - | + | ||
| - | Link: https:// | + | |
| - | + | ||
| - | ==== Services ==== | + | |
| - | * DHCPv4 | + | |
| - | * Range Start 10.23.79.100 | + | |
| - | * Range Stop 10.23.79.245 | + | |
| - | * Save Apply | + | |
| - | * Static MAC/IP Mapping< | + | |
| - | BrimUpstairsAP | + | |
| - | BrimDownstairsAP 10.23.79.6 | + | |
| - | + | ||
| - | </ | + | |
| - | * DNS (System / Settings / General | + | |
| - | * 10.23.79.1 | + | |
| - | * 10.23.79.3 if using PiHole | + | |
| - | * 8.8.8.8 / 8.8.4.4 | + | |
| - | * Dynamic | + | |
| - | * go to System / Firmware / Plugins and download os-ddclient | + | |
| - | * go to Services / Dynamic | + | |
| - | * add new one by clicking on the "+" | + | |
| - | * Enabled | + | |
| - | * Service : easyDNS | + | |
| - | * Username : easyDNS username | + | |
| - | * Password : easyDNS token (not password). Token can be gotten from website | + | |
| - | * Hostnames: brimble.com | + | |
| - | * Check ip method: dyndns | + | |
| - | * Interface to monitor: WAN | + | |
| - | * Check ip timeout: 10 | + | |
| - | * Force SSL: checked | + | |
| - | * Save/Apply | + | |
equipment/rbpi_openwrt.1705079974.txt.gz · Last modified: by dirk
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
