equipment:rbpi_openwrt
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| equipment:rbpi_openwrt [2024/01/12 11:46] – [Install and Setup OpenWRT] dirk | equipment:rbpi_openwrt [2024/02/09 08:10] (current) – [Setup OpenWRT] dirk | ||
|---|---|---|---|
| Line 13: | Line 13: | ||
| * Go to http:// | * Go to http:// | ||
| * Set a new password by following the prompts. | * Set a new password by following the prompts. | ||
| + | * Change IP block. | ||
| + | * Go to Network and choose Interfaces. | ||
| + | * Edit the LAN | ||
| + | * Protocol: Static address | ||
| + | * Bring up on boot: checked | ||
| + | * IPv4 address: 10.28.9.1 | ||
| + | * IPv4 netmask: 255.255.255.0 | ||
| + | * Save | ||
| + | * Save Apply and reconnect to new IP address with new password. | ||
| * From the top menu, click on Network and choose Wireless. | * From the top menu, click on Network and choose Wireless. | ||
| * Click Remove next to the existing wireless config and then Save & Apply. | * Click Remove next to the existing wireless config and then Save & Apply. | ||
| Line 20: | Line 29: | ||
| * You now have a WAN connection on the internal WiFi adapter and a LAN connection on the LAN port. | * You now have a WAN connection on the internal WiFi adapter and a LAN connection on the LAN port. | ||
| * Now add USB WiFi card as radio1 for our WiFi access point for clients to connect to. | * Now add USB WiFi card as radio1 for our WiFi access point for clients to connect to. | ||
| - | * The Wifi card I have from a previous nonWifi Pi bundle seems compatable and may not require any extra install steps. See link below for more info if it does. | ||
| * From the top menu, click on the Network tab and choose Wireless. | * From the top menu, click on the Network tab and choose Wireless. | ||
| - | * If you see radio1, you are all good with the installation of the second WiFi adapter. | + | * If you see radio1, you are all good with the installation of the second WiFi adapter. If not, use these steps to install drivers. |
| + | * Click System -> Software | ||
| + | * Click Update lists... | ||
| + | * when done, in the filter box type " | ||
| + | * For my CanaKit Raspberry Pi WiFi Wireless Adapter/ | ||
| + | * pretty sure the 2800-lib and 2800-usb files installed the 2x00 ones as well. | ||
| + | * Now you should have radio1 show up under Network -> Wireless. | ||
| * Click Edit for the OpenWrt SSID (under the radio1) | * Click Edit for the OpenWrt SSID (under the radio1) | ||
| * Click Enable for Wireless network is disabled | * Click Enable for Wireless network is disabled | ||
| Line 29: | Line 43: | ||
| * Click Save | * Click Save | ||
| * Click Save & Apply | * Click Save & Apply | ||
| + | Link: https:// | ||
| ===== Setup WireGuard VPN ===== | ===== Setup WireGuard VPN ===== | ||
| - | * Turn on the device | + | * From OpenWRT top menu, click System tab and choose Software. |
| - | * login as 'installer' | + | * Click Update lists button and wait for process |
| - | * select | + | * Click Dismiss |
| + | * Install the following packages by using the Filter field and clicking Install | ||
| + | * kmod-wireguard | ||
| + | * luci-proto-wireguard | ||
| + | * luci-app-wireguard (Try installing this first, it should automatically install the others) | ||
| + | * Click Network-> | ||
| + | * enter wg0 as the interface name. | ||
| + | * select WireGuard VPN from protocol drop down | ||
| + | * click Create interface | ||
| + | * Click General Settings tab and enter following parameters from your Wireguard setup. | ||
| + | * Bring up on boot: checked | ||
| + | * Private Key: Generate new key pair | ||
| + | * Public Key: this will go into your home wireguard setup on the other end as the peer's public key) | ||
| + | * Listen Port: blank | ||
| + | * IP Addresses: whatever you assign it in your home wireguard setup as the peer's ip (10.23.0.13/ | ||
| + | * Click Advanced Settings tab | ||
| + | * Use default gateway: checked | ||
| + | * enter custom DNS servers (8.8.8.8 and 8.8.4.4) | ||
| + | * Click on the Firewall tab and select | ||
| + | * Click the Peers tab and Add peer | ||
| + | * Description: | ||
| + | * Public Key: from the home wireguard instance setup | ||
| + | * Private Key: blank | ||
| + | * Preshared key: blank | ||
| + | * Allowed IPs: 0.0.0.0/0 | ||
| + | * Route Allowed IPs: checked | ||
| + | * Endpoint Host: brimble.com | ||
| + | * Endpoint Port: 51820 | ||
| + | * Persistent Keep Alive: 25 | ||
| + | * Click Save and then Save & Apply. | ||
| + | * Also, set custom DNS again in Interfaces-> | ||
| + | |||
| + | Link: https:// | ||
| - | Link: https:// | ||
| ===== Connect ===== | ===== Connect ===== | ||
| - | * plug into the LAN port (see below note for the FW4C) and navigate | + | * Use laptop |
| - | * NOTE: OPNsense defines ports right to left as LAN, WAN but the Protectli FW4C labels them right to left as WAN, LAN. So you'll have to plug into the WAN port for this initial login and we will switch the ports in software so that the labels are matched up. | + | * go to 10.28.9.1 (or whatever your LAN is) |
| - | * log in using ' | + | * go to network/wireless |
| - | * go to Interfaces / Assignments and swap the LAN and WAN ports if needed (see above note) | + | * click scan next to radio0 |
| - | * once this step is complete, you'll need to plug the wire into the new LAN port and re-login | + | * click Save & Apply |
| - | ===== Setup ===== | + | * Should now be connected |
| - | * go to Interfaces / LAN | + | * If using a captive portal |
| - | * make sure it is enabled and locked | + | |
| - | * config type Static IPv4 | + | |
| - | * set IPv4 address to your desire (10.23.79.1/24 for me) | + | |
| - | * upstream gateway is auto-detect | + | |
| - | * Save/ | + | |
| - | * go to Interfaces / WAN | + | |
| - | * make sure it is enabled and locked | + | |
| - | * block private and bogon networks | + | |
| - | * config type DHCP (for CenturyLink at least) | + | |
| - | * Save/ | + | |
| - | ===== Setting up with CenturyLink Quantum Fiber ===== | + | |
| - | * This service provider requires traffic from the ONT to go to a router set to VLAN 201 | + | |
| - | * go to Interfaces / Other Types / VLAN | + | |
| - | * create new by clicking on the " | + | |
| - | * Device: vlan01 | + | |
| - | * Parent: igc0 (the address of the WAN port) | + | |
| - | * VLAN tag: 201 | + | |
| - | * VLAN priority: Best Effort | + | |
| - | * Description: | + | |
| - | * Save | + | |
| - | * go to Interfaces / Assignments | + | |
| - | * change WAN to the new vlan01 that you just created | + | |
| - | * Save/ | + | |
| - | * Plug line from internet into WAN port. | + | |
| - | ===== Firewall/ | + | |
| - | ==== Port Forwarding ==== | + | |
| - | * go to Firewall / NAT / Port Forward | + | |
| - | * create new rule by clicking on the " | + | |
| - | * Interface: WAN | + | |
| - | * Protocol: TCP | + | |
| - | * Source Advanced should all be " | + | |
| - | * Destination: | + | |
| - | * Destination port range: select outside port (example: 80 or 443) | + | |
| - | * Redirect target IP: Single host or Network / internal IP address of the server (10.23.79.4) | + | |
| - | * Redirect target port: (other) / internal server port (example: 180 or 1443) | + | |
| - | * Description: | + | |
| - | * NAT reflection: Enabled | + | |
| - | * Filter rule association: | + | |
| - | * Save/Apply | + | |
| - | | + | |
| - | * Port Forwarding rules if unraid/ Nginx:< | + | |
| - | 443 | + | |
| - | 22 Both 10.23.79.X | + | |
| - | * Port Forwarding rules if standalone:< | + | |
| - | 443 | + | |
| - | 22 Both 10.23.79.X | + | |
| - | 32400 | + | |
| - | * Hairpin NAT: | + | |
| - | | + | |
| - | * Check " | + | |
| - | * Save / Apply | + | |
| - | + | ||
| - | ==== Wireguard VPN ==== | + | |
| - | === Create Instance | + | |
| - | * go to System / Firmware / Plugins | + | |
| - | * go to VPN / WireGuard / Settings / Instances | + | |
| - | * create new instance by clicking on the "+" | + | |
| - | * Enabled: check | + | |
| - | * Name: WG1 | + | |
| - | | + | |
| - | * we will call this public key " | + | |
| - | * Listen port: 51820 | + | |
| - | * Tunnel address: pick a subnet not used elsewhere (10.23.0.1/ | + | |
| - | * Save/Apply | + | |
| - | * go to VPN / WireGuard / Settings / General | + | |
| - | * go to VPN / WireGuard / Settings / Peers | + | |
| - | * create new peer by clicking on the " | + | |
| - | * Enabled: check | + | |
| - | * Name: iPhone / Macbook / whatever | + | |
| - | * Public key: PEERPUBLIC | + | |
| - | * Allowed IPs: something on the subnet configured above (10.23.0.11/ | + | |
| - | * Instances: select above instance (WG1) | + | |
| - | * Save/Apply | + | |
| - | * go to VPN / WireGuard / Settings / Instances / Edit WG1 | + | |
| - | * Add Peers into Peers drop down | + | |
| - | * Save/ | + | |
| - | * go to Lobby / Dashboard and restart wireguard | + | |
| - | === Create | + | |
| - | * go to Interfaces / Assignments | + | |
| - | * in the drop down under new interface, select the WireGuard instance (wg1) | + | |
| - | * Enable: check | + | |
| - | * Description: | + | |
| - | * Save/ | + | |
| - | * go to Interfaces / WG1 | + | |
| - | * Enable: check | + | |
| - | * Description: | + | |
| - | * Save/ | + | |
| - | === Create VPN Firewall rules === | + | |
| - | * go to Firewall / Rules / WAN | + | |
| - | * create new rule by clicking | + | |
| - | * Action: Pass | + | |
| - | * Quick: check | + | |
| - | * Interface: WAN | + | |
| - | * Direction: in | + | |
| - | * TCP/IP Version: IPv4 | + | |
| - | * Protocol: UDP | + | |
| - | * Source Invert: unchecked | + | |
| - | * Source: any | + | |
| - | * Destination Invert: unchecked | + | |
| - | * Destination: | + | |
| - | * Destination | + | |
| - | * Description: | + | |
| - | * Save/ | + | |
| - | * go to Firewall / Rules / [Name of interface assigned above (WG1)] | + | |
| - | * create new rule by clicking on the "+" | + | |
| - | * Action: Pass | + | |
| - | * Quick: check | + | |
| - | * Interface: WG1 | + | |
| - | * Direction: in | + | |
| - | * TCP/IP Version: IPv4 | + | |
| - | * Protocol: any | + | |
| - | * Source Invert: unchecked | + | |
| - | * Source [Name of interface assigned above NET (WG1 net)] | + | |
| - | * Destination Invert: unchecked | + | |
| - | * Destination: | + | |
| - | * Destination port range: any | + | |
| - | * Save/ | + | |
| - | === Setup Clients === | + | |
| - | * This will differ based on device... principal is the same. | + | |
| - | * iPhone | + | |
| - | * Download WireGuard from app store | + | |
| - | * create new | + | |
| - | * Name: brimble.com | + | |
| - | * Generate keypair | + | |
| - | * This public key (PEERPUBLIC) will go in VPN / WireGuard / Settings / Peers / Public key box | + | |
| - | * Addresses: This will be whatever you put in the Allowed IPs box of VPN / WireGuard / Settings / Peers (10.23.0.11/ | + | |
| - | * Listen port: Automatic | + | |
| - | * MTU: Automatic | + | |
| - | * DNS servers: 8.8.8.8, 8.8.4.4 | + | |
| - | * click Add peer | + | |
| - | * Public key: MAINPUBLIC | + | |
| - | * Preshared key: blank | + | |
| - | * Endpoint: the address and port of your server (brimble.com: | + | |
| - | * Allowed IPs: 0.0.0.0/0 | + | |
| - | * Save | + | |
| - | * macbook | + | |
| - | * Downlaod WireGuard from app store | + | |
| - | * create new | + | |
| - | * Name: brimble.com | + | |
| - | * This public key (PEERPUBLIC) will go in VPN / WireGuard / Settings / Peers / Public key box | + | |
| - | * < | + | |
| - | PrivateKey = whatever | + | |
| - | Address = This will be whatever you put in the Allowed IPs box of VPN / WireGuard / Settings / Peers (10.23.0.11/ | + | |
| - | DNS = 8.8.8.8, 8.8.4.4 | + | |
| - | + | ||
| - | [Peer] | + | |
| - | PublicKey = MAINPUBLIC this will be in VPN / WireGuard / Settings / Instances / Public key box | + | |
| - | AllowedIPs = 0.0.0.0/0 | + | |
| - | Endpoint = the address and port of your server (brimble.com: | + | |
| - | </ | + | |
| - | * Save | + | |
| - | Link: https:// | + | |
| - | ==== NAT for online gaming ==== | + | |
| - | * go to Firewall / Aliases | + | |
| - | * create new alias by clicking on the " | + | |
| - | * Enabled: check | + | |
| - | * Name: NintendoSwitch | + | |
| - | * Type: Host(s) | + | |
| - | * Content: IP address of Switch | + | |
| - | * Save/ | + | |
| - | * go to Firewall / NAT / Outbound | + | |
| - | * change mode to Hybrid so you can add manual rule | + | |
| - | * create new rule by clicking on the " | + | |
| - | * Interface: WAN | + | |
| - | * Protocol: any | + | |
| - | * Source address: NintendoSwitch | + | |
| - | * Static-port: | + | |
| - | * Give it a description | + | |
| - | * Save/ | + | |
| - | + | ||
| - | Link: https:// | + | |
| - | + | ||
| - | ==== Services ==== | + | |
| - | * DHCPv4 | + | |
| - | * Range Start 10.23.79.100 | + | |
| - | * Range Stop 10.23.79.245 | + | |
| - | * Save Apply | + | |
| - | * Static MAC/IP Mapping< | + | |
| - | BrimUpstairsAP | + | |
| - | BrimDownstairsAP 10.23.79.6 | + | |
| - | + | ||
| - | </ | + | |
| - | * DNS (System / Settings / General | + | |
| - | * 10.23.79.1 to use ISPs | + | |
| - | * 10.23.79.3 if using PiHole | + | |
| - | * 8.8.8.8 / 8.8.4.4 (or others) if hardcoding | + | |
| - | * Dynamic DNS | + | |
| - | * go to System / Firmware / Plugins and download os-ddclient | + | |
| - | * go to Services / Dynamic DNS / Settings | + | |
| - | * add new one by clicking on the " | + | |
| - | * Enabled | + | |
| - | * Service : easyDNS | + | |
| - | * Username : easyDNS username | + | |
| - | * Password : easyDNS token (not password). Token can be gotten from website | + | |
| - | * Hostnames: brimble.com | + | |
| - | * Check ip method: dyndns | + | |
| - | * Interface to monitor: WAN | + | |
| - | * Check ip timeout: 10 | + | |
| - | * Force SSL: checked | + | |
| - | * Save/Apply | + | |
equipment/rbpi_openwrt.1705081580.txt.gz · Last modified: by dirk
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
