![Dev Odyssey](/img/default-banner.jpg)
- 57
- 1 359 584
Dev Odyssey
United States
เข้าร่วมเมื่อ 20 มิ.ย. 2019
A Developer’s Journey Through IT, covering Tutorials and Reviews of IT Tools and Technologies.
Tunneling Out of Your Home Network! - How to set up a VPN on a Router // OpenVPN, OpenWrt
Go to our partner (trymintmobile.com/dev) to get premium wireless for as low as $15 a month. Special offer: New customers can get any plan for $15/month. New
activation and upfront payment of $45 for 3 mo. service required. Restrictions apply.
See trymintmobile.com for more details.
Follow me on X (Twitter) and Facebook
Dev_Odyssey
Dev0dyssey
In this episode of Dev Odyssey, we're revisiting VPNs on a router, except this time, we're using OpenVPN. I cover how you can create a network wide VPN for all of your devices, using OpenVPN and OpenWrt.
OpenVPN protocol was created in 2001 by James Yonan and released under the GNU GPL version 2 license, as the first open source VPN protocol. Over time, it’s become a versatile and widely used solution known for its robustness and cross-platform compatibility.
OpenVPN does have some advantages over WireGuard, including support for authentication, certificates, key exchange, layer 2 networking, and extensible plugins. In comparison, OpenVPN's focus is broader.
WireGuard has its own advantages, particular around speed, security and portability / roaming. It's meant to be more lightweight, with a lean code base for easy auditing. Additional features, such as the ones noted above, are left to developers to implement. For example, Tailscale has built enterprise grade features on top of the WireGuard, to include the best of both worlds.
Each protocol has it's best use case scenario, and I encourage you to research them both to see what works best for you in your situation.
Setting one up is fairly easy, by following the steps below.
1. Install the OpenVPN packages:
openvpn-openssl
luci-app-openvpn
openssl-util
2. Grab an ovpn configuration file from your VPN provider
3. Upload the ovpn configuration file to OpenWrt
4. Make any necessary changes as dictated by your VPN provider (i.e. authentication)
5. Set the appropriate DNS servers to prevent DNS leaks
OpenWrt Version: 23.05
VPN Provider: Mullvad
Links
OpenVPN Reference Manual
openvpn.net/community-resources/reference-manual-for-openvpn-2-5/
Mullvad OpenVPN Guide for OpenWrt:
mullvad.net/en/help/openwrt-routers-and-mullvad-vpn
Mullvad Checks:
mullvad.net/en/check
Tailscale
tailscale
OpenWrt
openwrt.org/
Chapters
00:00 Intro
01:01 About OpenVPN
02:42 Setting up OpenVPN Client on OpenWrt
14:40 Validating OpenVPN configuration
16:16 Final Words on VPN Config
16:50 Mint Mobile
17:45 Outro
Tags
#vpn #openvpn #openwrt #wireguard #networking #homenetwork
activation and upfront payment of $45 for 3 mo. service required. Restrictions apply.
See trymintmobile.com for more details.
Follow me on X (Twitter) and Facebook
Dev_Odyssey
Dev0dyssey
In this episode of Dev Odyssey, we're revisiting VPNs on a router, except this time, we're using OpenVPN. I cover how you can create a network wide VPN for all of your devices, using OpenVPN and OpenWrt.
OpenVPN protocol was created in 2001 by James Yonan and released under the GNU GPL version 2 license, as the first open source VPN protocol. Over time, it’s become a versatile and widely used solution known for its robustness and cross-platform compatibility.
OpenVPN does have some advantages over WireGuard, including support for authentication, certificates, key exchange, layer 2 networking, and extensible plugins. In comparison, OpenVPN's focus is broader.
WireGuard has its own advantages, particular around speed, security and portability / roaming. It's meant to be more lightweight, with a lean code base for easy auditing. Additional features, such as the ones noted above, are left to developers to implement. For example, Tailscale has built enterprise grade features on top of the WireGuard, to include the best of both worlds.
Each protocol has it's best use case scenario, and I encourage you to research them both to see what works best for you in your situation.
Setting one up is fairly easy, by following the steps below.
1. Install the OpenVPN packages:
openvpn-openssl
luci-app-openvpn
openssl-util
2. Grab an ovpn configuration file from your VPN provider
3. Upload the ovpn configuration file to OpenWrt
4. Make any necessary changes as dictated by your VPN provider (i.e. authentication)
5. Set the appropriate DNS servers to prevent DNS leaks
OpenWrt Version: 23.05
VPN Provider: Mullvad
Links
OpenVPN Reference Manual
openvpn.net/community-resources/reference-manual-for-openvpn-2-5/
Mullvad OpenVPN Guide for OpenWrt:
mullvad.net/en/help/openwrt-routers-and-mullvad-vpn
Mullvad Checks:
mullvad.net/en/check
Tailscale
tailscale
OpenWrt
openwrt.org/
Chapters
00:00 Intro
01:01 About OpenVPN
02:42 Setting up OpenVPN Client on OpenWrt
14:40 Validating OpenVPN configuration
16:16 Final Words on VPN Config
16:50 Mint Mobile
17:45 Outro
Tags
#vpn #openvpn #openwrt #wireguard #networking #homenetwork
มุมมอง: 3 166
วีดีโอ
The Easiest VPN Router I've Used // Encrouter ENC-AX1800A Review
มุมมอง 3.5K7 หลายเดือนก่อน
Buy your own Encrouter (ENC-AX1800A) amzn.to/3tHza7S (Paid Link) Follow me on Twitter and Facebook Dev_Odyssey Dev0dyssey Description VPN Configuration is hard, especially for the non tech savvy. It puts a damper on enjoying your favorite geo specific content, services, or simply accessing your home network remotely. It doesn't have to be difficult. With Encrouter, you ...
They just keep getting better - VPN routers on the go // GL iNet Beryl AX Review
มุมมอง 7K9 หลายเดือนก่อน
Purchase a GL iNet Beryl AX! store-us.gl-inet.com/products/beryl-ax-gl-mt3000-pocket-sized-wi-fi-6-wireless-travel-gigabit-router Get $5 off a Beryl AX (US Store) - bit.ly/devodyssey-gl-inet-us (Referral Link) Get $5 off a Beryl AX (Global Store) - bit.ly/devodyssey-gl-inet-global (Referral Link) Buy on Amazon www.amazon.com/dp/B0BPSGJN7T Follow me on Twitter and Facebook Dev_Odysse...
Cut the Landline for a FREE Cloud Phone // 3CX Free
มุมมอง 5K10 หลายเดือนก่อน
Get start with 3CX Free below! www.3cx.com/signup/ Follow me on Twitter and Facebook Dev_Odyssey Dev0dyssey Description In this episode of Dev Odyssey, we cover SIP protocol, the 3CX platform, and how to set one up for yourself. SIP, or Session Initiation Protocol, is a signaling protocol used for initiating, maintaining, modifying and terminating real-time communicatio...
Your network is wide open! // A Beginner's Guide to Firewall Rules in OPNsense
มุมมอง 21Kปีที่แล้ว
Support Me Get a 5% off Ekster Products shop.ekster.com/devodyssey or discount code "DEV" at checkout! (PAID Link) Follow me on Twitter and Facebook Dev_Odyssey Dev0dyssey Description We already know about firewalls in our home; those routers that connect us to the internet, and how they provide security for our home networks. We also know about OPNsense, how to install...
Your network needs rules! // A Beginners Guide to Firewall Rules in OpenWrt, GL.iNet Slate
มุมมอง 17Kปีที่แล้ว
Support Me Get a 5% off Ekster Products shop.ekster.com/devodyssey or discount code "DEV" at checkout! (PAID Link) Follow me on Twitter and Facebook Dev_Odyssey Dev0dyssey Description We all have a firewall in our home, we just call it by a different name, that is, of course, router. We know our home routers do multiple things, like act as a switch, and access point. Wh...
Make more networks with this feature - How to Create a VLAN // OPNsense Firewall
มุมมอง 27Kปีที่แล้ว
Support Me Get a 5% off Ekster Products shop.ekster.com/devodyssey or discount code "DEV" at checkout! (PAID Link) Follow me on Twitter and Facebook Dev_Odyssey Dev0dyssey Description VLANs are ubiquitous in networking, and practically universal in enterprise networking equipment. While setting up a VLAN is conceptually the same, there will be variations between network...
Don’t VPN Everything! - Split Tunnel Your Traffic - Policy Based Routing / OpenWrt Wireguard OpenVPN
มุมมอง 21Kปีที่แล้ว
Support Me Get a 5% off Ekster Products shop.ekster.com/devodyssey or discount code "DEV" at checkout! (PAID Link) Follow me on Twitter and Facebook Dev_Odyssey Dev0dyssey Description VPN all the things, is what VPN providers tell you. That is, they are selling you VPN services under the impression you are not secure without a VPN. This scare tactic works all too often,...
Ditch your hotspot and build a better travel router // OpenWrt, Raspberry Pi, Verizon
มุมมอง 5Kปีที่แล้ว
Get up to 40% off Ekster wallets when you use my link partner.ekster.com/devodyssey or discount code "DEV" at checkout! (PAID Link) Follow me on Twitter and Facebook Dev_Odyssey Dev0dyssey Description Most often, we buy the solution presented to us. It never checks all the boxes, but it usually does good enough. However, empowered with knowledge, we can build our own so...
You already own a proxy … it’s your router!
มุมมอง 9Kปีที่แล้ว
Use the coupon code ROUTER at checkout to get a 50% discount on the royal residential proxies. Make sure to use it before the deal expires! iproyal.club/DevOdyssey Follow me on Twitter and Facebook Dev_Odyssey Dev0dyssey You guessed it, or maybe not; I made a router into a proxy! It acts like a proxy in many ways, especially with NAT, but by default, it does not act lik...
How to Create a Site to Site VPN // OpenWrt, Wireguard
มุมมอง 27Kปีที่แล้ว
Support Me Get a 5% off Ekster Products shop.ekster.com/devodyssey or discount code "DEV" at checkout! (PAID Link) Follow me on Twitter and Facebook Dev_Odyssey Dev0dyssey We're all aware of how VPNs are used for privacy, geographic specific content, and hiding your IP. But VPNs have many other use cases, and a big one is site to site VPNs. What this does, is connect yo...
Let's make a Router Firewall // How to install OPNsense on a PC
มุมมอง 11Kปีที่แล้ว
Support Me Get a 5% off Ekster Products shop.ekster.com/devodyssey or discount code "DEV" at checkout! (PAID Link) Follow me on Twitter and Facebook Dev_Odyssey Dev0dyssey While Raspberry Pi and OpenWrt dominate the videos on my channel, my (virtual) network experience actually started with OPNsense. With that, I'd like to share my what I know, starting with how to inst...
Building a Better Raspberry Pi Router // RPi Compute Module 4, OpenWrt, DFRobot Carrier Board
มุมมอง 10K2 ปีที่แล้ว
Shout out to @JeffGeerling for helping to make this video possible by fixing an RPI CM4 bug with OpenWrt! Get a 5% off Ekster Products shop.ekster.com/devodyssey or discount code "DEV" at checkout! (PAID Link) Follow me on Twitter and Facebook Dev_Odyssey Dev0dyssey A Raspberry Pi 4B router is cool, but whats even better is a Raspberry Pi 4 router, with the I/O of your...
One Port To Rule Them All // Serial, Ethernet, USB OTG, Raspberry Pi, OpenWrt
มุมมอง 4.6K2 ปีที่แล้ว
Support Me Get a 5% off Ekster Products shop.ekster.com/devodyssey or discount code "DEV" at checkout! (PAID Link) Follow me on Twitter and Facebook Dev_Odyssey Dev0dyssey Description Welcome back to Dev Odyssey! In this episode, we're harnessing the power of USB OTG to power and connect to our OpenWrt 21.02 Raspberry Pi, via serial and ethernet, all with one USB-C cabl...
The 4G LTE Raspberry Pi Router has arrived! // OpenWrt, Verizon Network
มุมมอง 53K2 ปีที่แล้ว
The 4G LTE Raspberry Pi Router has arrived! // OpenWrt, Verizon Network
How to build an OpenWrt image // Compile and Install for Raspberry Pi 4B
มุมมอง 31K2 ปีที่แล้ว
How to build an OpenWrt image // Compile and Install for Raspberry Pi 4B
How to Create a VLAN - Updated Guide // OpenWrt Router (21.02 +), DSA, Managed Switch, RPi 4
มุมมอง 21K2 ปีที่แล้ว
How to Create a VLAN - Updated Guide // OpenWrt Router (21.02 ), DSA, Managed Switch, RPi 4
Protect yourself when using public WiFi // GL.iNet AR750S Slate Review
มุมมอง 1.4K2 ปีที่แล้ว
Protect yourself when using public WiFi // GL.iNet AR750S Slate Review
How to setup a Raspberry Pi 4 Display (and what you can do with it) // RPI 4, Wimaxit Touchscreen
มุมมอง 6K2 ปีที่แล้ว
How to setup a Raspberry Pi 4 Display (and what you can do with it) // RPI 4, Wimaxit Touchscreen
How to Connect a Raspberry Pi to a Cell Network // OpenWrt, 3G
มุมมอง 30K2 ปีที่แล้ว
How to Connect a Raspberry Pi to a Cell Network // OpenWrt, 3G
How To Build A Custom Raspberry Pi Router // OpenWrt on RPi 4
มุมมอง 133K2 ปีที่แล้ว
How To Build A Custom Raspberry Pi Router // OpenWrt on RPi 4
How To Secure Your Home Network - Pi-hole // DNS Sinkhole
มุมมอง 9K2 ปีที่แล้ว
How To Secure Your Home Network - Pi-hole // DNS Sinkhole
How To Set Up A VPN On A Router // Wireguard on OpenWrt
มุมมอง 84K3 ปีที่แล้ว
How To Set Up A VPN On A Router // Wireguard on OpenWrt
How to Create a Proxy // Squid (HTTP) and SOCKS
มุมมอง 163K3 ปีที่แล้ว
How to Create a Proxy // Squid (HTTP) and SOCKS
How to Create a VLAN - A Beginner's Guide // OpenWrt Router (Up to 19.x)
มุมมอง 125K3 ปีที่แล้ว
How to Create a VLAN - A Beginner's Guide // OpenWrt Router (Up to 19.x)
How to Send Requests from Scripts // Postman Pointers
มุมมอง 2.1K3 ปีที่แล้ว
How to Send Requests from Scripts // Postman Pointers
How to Upgrade a Router // OpenWrt (How To Guide)
มุมมอง 36K3 ปีที่แล้ว
How to Upgrade a Router // OpenWrt (How To Guide)
You are awesome, talented, and great video. I've duplicated your tutorial. Quick feedback: I've would you either slow-down or pause when you finish typing the commands. Even when I tired to go back, it's difficult to stop at the right moment to copy the command you've been typing.
for safe torrenting blocking all traffic between lan and wan is enough?
Great video. Clear and concise.
Thanks for watching @PhilipLemon! Appreciate the compliment 😊
thanks for this amazing tutorial. using with warp, works great. but my ipv6 doesn't seem to route via wireguard. any suggestions???
You're welcome, thanks for watching @gowtham1598! I have been seeing my viewers saying they are able to get it working with WARP successfully. As for IPv6 not routing, I can't be so certain why. I assume you have set it up with the correct routing rules (i.e. Allowed IPs to be all IPv6 IPs, ::0/0. A good follow up is if WARP is giving you an IPv6 IP to use for your VPN. If not, that could be a reason. Or if IPv6 to IPv4 translation isn't being done (depending on the origin type of the traffic and what IP version its going out on, 4 or 6). What troubleshooting have you done in regards to IPv6 routing?
Do I add RFC1918 rules to all my Vlans? Switch, wireguard, etc?
Thanks for watching @tzvikawasserman1776! So I'm not sure I completely understand the ask, but my answer would be it depends. Do you want all your VLANs to communicate to all RFC1918 networks? Depends on the purpose of your VLAN. For example, my IoT VLAN doesn't communicate with all RFC1918 networks, because I want to limit its communication to the local subnet, and to the internet, rather than to devices on my other networks, or to my VPN network that I've configured with WireGuard. But you might want to use RFC1918 for a management VLAN to talk to all devices, and therefore would use that rule.
5:49 Update: Commit was merged on the luci-app-wireguard It is now luci-proto-wireguard Just put GitHub's link in front of ' openwrt/luci/commit/6e6fce3eb43ea6899eedc91bebd5713a5d4c773b '
It's cool that everything works on the video. I put pbr on owrt on 23.05. Writes: Failed to set up any gateway! It is unclear how to solve this problem.
@georgeShtuller thanks for watching! Not sure what your error is, I haven't seen that before. Doing a quick search, I did find this comment within the forum. forum.openwrt.org/t/policy-based-routing-pbr-package-discussion/140639/24 Maybe this will help? Otherwise, I'd suggest the forum for more help since its easier to post configurations there and let alone, you're problem has probably been experienced by someone else and already resolved by them.
@@DevOdyssey Thank you. I was on this forum. I tried this solution, but no. On Mr. shangri's advice, updating the version from his repository did not help. For some reason, he doesn't answer anymore. He says that the configuration is correct, everything should work - in reality it does not work. The forum is useless so far
Thank you for your great video🤩😍❤️
You're welcome @ARMINJB, thanks for watching!
Ty!
@alkardo332 You're welcome, thanks for watching!
I have an internet connection that has a proxy and its IP is 192.168.49.1:8000, in order to connect to the internet I must configure this data, how do I configure the same on the raspberry pi4, I have not been able to use the internet via wifi, the raspberry pi4 connects to the wifi and assigns an IP automatically but does not browse because I have not configured this data as would be done when it is in client mode.
To configure a proxy client on the Raspberry Pi 4b, that will greatly vary depends on your operating system. From other comments I've seen you make on different videos it seems like you are using OpenWrt. If so, you can follow this video below that reviews it. th-cam.com/video/tjiMyuLrejA/w-d-xo.html You can use privoxy to forward requests to an upstream http proxy, as you've given in your comment. For Raspberry Pi OS, you should be able to do it in your OS configuration, and a simple search should give you plenty of information to do that. I'd be sure to specify if you are using Raspberry Pi OS with a GUI or just a terminal. Either way, heres an example of how to set one up using the terminal. forums.raspberrypi.com/viewtopic.php?t=28835
how configure proxy cliente in openwrt
While this video doesn't cover proxy configuration, the video below gives you a example of how to configure a SOCKS5 proxy in OpenWrt. th-cam.com/video/tjiMyuLrejA/w-d-xo.html
Friend, I want to add a 8811cu USB WiFi adapter. Do you have any video that can help me configure it?
Thanks for watching @MASKDANTE! While I don't have a video that will exactly sho you how to do this, the process is straightforward. Generally you search for the driver as a package, and you should be able to find if its supported by getting some packages to show up. If nothing does, then its likely not supported out of the box by OpenWrt. Now googling the driver, I do see some posts about it, but it seems you have to add it to OpenWrt manually. At this point, I'd suggest looking at other WiFi adapters, as this one is not well supported by the vendor / OpenWrt community. It would be much easier to do that, or get a mini router and flash it with vanilla OpenWrt like the GLiNet travel routers, instead of trying to get this dongle to work, or getting a new dongle even (again, really depends on cost). But if you really want to use this WiFi adapter / dongle, you can do some searching and find github repos that have the driver, where then you might have to cross compile the ipk, then add it to OpenWrt. These repos are not official either, so you will take some risk there installing them, and I can't personally guarantee they will work. So given all that, I'd honestly just find another WiFi adapter, as noted, or even a mini router like GL iNet, as I've personally had a great experience with them and made a couple of videos on them too, below being the latest. th-cam.com/video/CKpKuHt8BaE/w-d-xo.html
Thanks a lot! I could finally set this up on a seperate VLAN! Great video!
You're welcome and thanks for watching @ghkpr! Happy this video helped! 🙂
This is nice, great explanation and practical solution👍 I have been searching the whole youtube without finding a solution. All they do is to talk and talk and even confuse people more 😂😂😂😂
Thanks for the compliment @wilsonomonz299! I enjoy sharing practical educational material, as its fun for me, but also what I find to be the most helpful when I'm looking to learn how to do something new. So thats my preferred format, to talk about it and do it 🙂
hey really enjoyed your content. might i make a suggestion for a follow up video on setting up a mullvad with socks5 proxy on openwrt?! what do you think?
Thanks for watching and being a fan @tobiasholter1224. I do certainly appreciate the suggestion, and I have actually already done that, but not particularly with Mullvad. I have with IPRoyal but the concept should remain the same. th-cam.com/video/tjiMyuLrejA/w-d-xo.html
thank you sir it was excellent. but i am gonna in other way. i need to set some urls to go thru VPN and almost other from lan. how to config this? and is there any method to create a wildcard to allow all subdomains in a role too?
Thanks for watching @hassanbagheri8265! I am not exactly sure I understand, but to set some URLs to go through the VPN, you simply set your WAN as your default gateway, and then when creating your rules (policy), you choose to have those URLs go through the VPN, and thats it. Everything else will go through the WAN by default. Following the video should explain it. As for a method to wildcard allow all subdomains, refer to my latests comments. Yea can have subdomains be routed by default in a rule when including the top level domain by using dnsmasq's nftset. docs.openwrt.melmac.net/pbr/#UseDNSMASQnftsetsSupport
if i had an other wireguard "inbound" working as a server,to connect from outside,can i use both? for example,when i connect from outside to my home network through mi wireguard server config, i will be navigating on internet trough this wireguard client? thanks a lot.
Thanks for watching @ivannicolas166! If I'm understanding your question correctly, which I think I am, then yes, you can have two WireGuard interfaces running, where one acts as an "inbound" VPN that lets you connect into your home, and one as an "outbound" VPN, that you use to tunnel traffic out through a VPN. You'd simply have to set up the routes properly to facilitate this but its definitely possible, and something I'm looking to explore setting up in the future.
Does OpenWrt allow us to setup multiple VPN locations through Wireguard so I can change the location if/when needed? If yes, how do we do that?
Thanks for watching @saswatachakraborty! Yup it does, you can create multiple WireGuard interfaces, each with a different peer in a different physical location, then from there you'd have to route to the different WireGuard interfaces so you can change your location. Now you can put all of these different peers (locations) under one WireGuard interface, but you can't route to all of them in the same way (say for example have a full tunnel to each / default route of all traffic), it simply wouldn't know how to route your traffic. So separating them out by new WireGuard interfaces would make it easier to move between them, and effectively you'd change your route between each WireGuard interface. This is all taken care of by the "Allowed IPs" section in your peer configuration that will create the necessary routes for you automatically. However, in order to forcibly change which location you are routing you, you'd have to do that manually, or potentially using failover configuration (such as mwan3).
Great tutorial however I can't find luci-app-wireguard on the software tab. I am using a raspberry pi4b and openwrt 23.05.04. What I am doing wrong? Any alternative?
Thank you and thanks for watching @belyrodriguezmorales8032! I'm not sure why you wouldn't see that, other than if you didn't update your list of packages. Did you first update your lists of packages by clicking update lists? It goes without say, but make sure you do this with an upstream internet connection to your Raspberry Pi 4B Given the hardware and software you are using, you shouldn't have any issue finding that package, and there wouldn't be an alternative (other than using terminal commands).
My entries don't appear on the live view at all. FYI none of this works after the recent update. Also DHCP server totally changed. Seems someone has infiltrated the project. Way too many coincidences.
Thanks for watching @tonysteele3805. So I'm not sure what this is the case for you, but are you sure that each rule you have made is set to log, such as at 11:34? If you haven't, they will never show up in your firewall log. As for working after the recent update, it still works fine for me, so I'm not sure why (or what) you are experiencing this. DHCP has changed to a new backend. It's using a more modern version of DHCP called KEA. You can find more in the link below, but the old version of DHCP is reaching end of life. docs.opnsense.org/manual/dhcp.html I wouldn't say it's infiltrated, there doesn't seem to be any indication that is the case, and would advise to be cautious of those statements without more concrete evidence, since unfortunately this is becoming a thing in modern day supply chain security of open source developed software, and should be taken very seriously, just as with the recent example of the xz backdoor that was created. I digress, but what has been seen so far is normal in software lifecycle.
Interesting viewpoint. The networks on different ports of your router are physically separated? Are you sure? Plug 2 devices into 2 ports and ping the other one. You will see that each device can see the other one. No separation through ports. And why would you assign a separate subnet to your VLAN. Thats just mixing two network layers. The VLAN should work fine within the same subnet. No?
Thanks for watching @marcg1043. Yes, so they're physically separate, in that each port on a router, is its own physical port. Now most of these are switch ports, which, I'll get back to in a second regarding its significance, but technically they aren't the same port. By default on any off the shelf router, if you plug into each LAN port, you'll be placed on the same network. That, of course, is by design. They will be on the same layer 2 and technically won't be separated as you noted. On other systems, say a mini PC's with more than one ethernet port, those will often have a dedicated ethernet controller for each ethernet port. As a result, this physical separation of ethernet controllers means that the ports can have their own separate networks defined, alluding to that physical separation of networks. On a standard router, these physical ethernet ports share the same ethernet controller, thereby acting as switch ports, and placing you on the same layer 2 network, unless its VLAN capable, which this video goes into how thats done. Anyway, thats the gist of it, but a notable caveat, so I appreciate the question. I assign a separate subnet to my VLAN because I want that VLAN to be a different network, its a simple as that. I can't make the VLAN be the same subnet as my primary LAN, as that would cause collisions and it simply doesn't work that way. Conceptually its against the purpose of a VLAN. A new subnet must be created for each new VLAN. Each are their own network.
Thanks so much for cool guide! Applied every step from your manual and now I have a VPN router!!
Thanks for watching @bogdangusak4573! Glad the step by step instructions worked for you exactly as expected. Enjoy your VPN router!
Hi I hope you can help. i made all the setting you do for a lan to lan conection. and it worked. the problem its that second router at 1 hour later stops comunicating with first router.but first router still can comunicate with second router.
Thanks for watching @pokomoro9461! Thats very strange, can you elaborate more on what that means? Are your devices on the second router not able to get to the internet? Have you tried to directly use the second router to communicate with the first? Have you repeated this and is it always that after 1 hour it "stops communicating"? How are you doing this testing to observe that the second router stops communicating with the first router? Some more context should help, but if the first router can still communicate with the second router, then it makes me wonder what the real issue is.
Hey thanks for your reply on the other video now i got to this video and got bpr working via ip address. Now im curious if i can tunnel only youtube for example?
You're welcome, happy to see you watching another video! You should be able to simply set youtube.com as your destination and it should work. Now I'm not sure if this covers everything that youtube uses on the back end as a part of its services, but this is effectively where you'd start. In addition, if you needed to route youtube sub domains, I did talk about that as well on a high level at 9:02. Basically, you can create a script that would pre populate all dnsmasq nfset (so long as you set that as your resolver), and pull down IPs for domains and subdomains, and any policies you write, would inherenetly include the subdomains (so long as you have a domain set in your policy). You can find more information here on that, that I actually referred to recently in another comment. docs.openwrt.melmac.net/pbr/#UseDNSMASQnftsetsSupport For now start with adding youtube.com in your policy and see if it works as expected.
Used this tutorial to setup WARP on my Pi4 based OpenWRT portable router. Worked like a charm and it didnt break tailscale compatibility so i can use rsync to synchronize a shared USB SSD on the router back to my server at home. It's amazing how much functionality you can cram into such a small space.
Thanks for sharing @rysterstech! I have't used Cloudflare WARP myself, but I see it's WireGuard based and happy to hear this helped you set it up. Should be easier then when I get trying it out. I wouldn't expect it to break tailscale, given they'll simply be different interfaces. Its honestly really neat to see how much you can do with these little boxes and Open Source Software. Let alone, it really gives you insight into how much manufacturers have limited consumer ability to customize their devices. It's grown a ton since the early days, but still you won't get that level of customization using off the shelf software for the hardware you buy. Plus this is more fun, especially when you get your use cases working 😊
thanks for this
You're welcome and thanks for watching! @Kim-jj3nr
So by firewall zones, it is possible to make like 2 or more physical routers and each of them has different local IP gateway in Openwrt system? (I dont know how to say it technically but you get the idea, right?) and if so, can you guide me what are the steps? Thanks 😊
Thanks for watching @j0efil! Not sure I completely understand, but I'll try. You can create different networks, or subnets, in OpenWrt, and each of those will have a different router IP, (say 192.168.1[.]1 and 192.168.2[.]1). They both would physically lie on the same system (the OpenWrt router). You can achieve this in multiple ways. If your router has more than one ethernet interface, you can simply create a new network on it. If not, you can create VLANs that can achieve the same thing, with a bit more flexibility. You can watch my video on creating VLANs below (for newer OpenWrt systems). The second video you can watch for more educational information regarding what VLANs are. VLANs in OpenWrt 21.02+ th-cam.com/video/d3aYMqt-b_c/w-d-xo.html How VLANs work (and how to set them up in OpenWrt 19.x) th-cam.com/video/5TtlAXeaGUM/w-d-xo.html
@@DevOdyssey thanks! Big help! Also do you have a guide how to setup port priority using mwan3?
@@j0efil You're welcome! I unfortunately don't have a guide on it at this time, but I suggest following through with their guides. openwrt.org/docs/guide-user/network/wan/multiwan/mwan3 But if I understand what you are getting it, it should be as easy as changing the metric on the port, that really defines its routing priority. The hight the metric, the increased priority it has, it's really as simple at shat.
Hi it looks like I got this configured to work but I'm not seeing anything in the access.log. Is there anything I'm missing to why this is not printing there?
Thanks for watching @AlexanderDavila-q9r! Thats interesting, I haven't seen that before. Doing a quick search, it seems like entries can be logged in the /var/log/messages. Have you checked any other OS log location to see if squid is logging there? I'm not sure what distro you are using but thats something to consider here where it can mess with logging. Also, can you confirm that the proxy is working as expected? Are your requests being proxied after you've configured it? I used the base install of squid from Ubuntu, and didn't modify anything for logging, so depending on how you installed it, I wouldn't expect you to have missed something from a default install. Otherwise, I'd encourage doing some research to see how you can resolve this.
Thanks a lot! Maybe you have video about configuring resolver set support? Dnsmasq nft set. I cant understood how to configure it.
You're welcome @user-fc9ic5cm8d! I don't have a video on that unfortunately, but you should be able to follow the docs for pbr and set this up. docs.openwrt.melmac.net/pbr/#UseDNSMASQnftsetsSupport There is a screenshot in there that shows you an option to change your resolver set. After making sure you have dnsmasq-full package installed, I don't think there is anything else you'd need to do. You can add custom user files on top of that if you want, but again not required. You can find more information on that in the link above.
Why is there a USB device on site A network, but not on site B config device option name 'br-lan' option type 'bridge' list ports 'usb0'
Thanks for watching @Rugbyu17-jh8qg! Is the snippet you shared your config? It seems like so (as I don't see it in my video). What equipment are you running OpenWrt on for each site? to me it looks like your ethernet interface is actually USB based, and its using a USB adapter for that ethernet interface (built in to the board going over the USB controller, or simply an adapter plugged into the USB port). Looks like they would be different equipment too since it sounds like they aren't the same.
I tried this. My installation had a default allow ANy to any rule. I removed it and added the first two in this video. My entire network went down. I could not get to anything. ANy idea why
Thanks for watching @chuckcorvec3453! Sorry to hear about your trouble. I'm curious about that rule, I have to look again to check if that's a default rule in my installations. Anyway, these two rules will not be suitable for a all traffic on your home network. Rather, this was merely to show the example of how to create rules, and not all the rules you any home network needs. The rules you need depend on the devices in your environment. What you do want is allow rules for HTTP/HTTPS, for most web and internet based traffic. The way I recommend doing this process is setting up your base rules, all above your default ANY / ANY rule (making sure quick match is checked off). Then, when you feel you have done enough rules, you can disable the ANY / ANY rule, and see what happens. If something breaks, you can turn that rule back on, and begin to troubleshoot to find out how you can make a new rule to fix what broke, since you ideally wouldn't want that ANY / ANY rule in place indefinitely. This ANY / ANY rule is just an easy way to make sure everything works, and if you want the easiest solution, you can leave that on. However, it reduces the control you have over your network traffic. Depends on what you're trying to achieve and what level of control you want to exercise over your network.
Really great tutorial. Thanks for that. Quick question. Do I need a dyn DNS on both routers if I want to avoid the keep alive?
Thanks for the compliment @sirlanzi! Always happy to hear when people get value out of my videos. As for your question, technically no. DynDNS will not save you from needing the keep alive, you could still well need it with DynDNS. The reason DynDNS is needed is because of two reasons really. One is your external IP is CGNATed. Meaning you share a public IP address with other people. Because of that, you don't control the public IP address the internet sees, and you can't do port forwarding. The second reasons is you don't control your network, or have access to port forwarding or open up ports on your firewall. What the keep alive does is make sure one end of the tunnel initiates the connection, and keeps it going, since the opposite end cannot initiate the connection, due to the above reasons. When you get DynDNS, this doesn't remediate CGNAT or lack of network control, it just gives your IP address a DNS record. So if you fall into either situation above, you'll still need the keep alive on one end of the tunnel, particularly on the end that has your CGNAT IP or "IP you can't control". DynDNS is just convenient for the end IP that does change, that you know you'll always be hitting the right endpoint.
Any way i can route only certain user/ip address to the vpn? I just want to route vpn connection to my tv and not to my other devices.
Thanks for watching @wanttotree and great question. Yes, you certainly can by using a package called pbr, or "Policy Based Routing". I created a video on how to do that, which you can follow here: th-cam.com/video/FN2qfxNIs2g/w-d-xo.html
Good vid! As an MSP, I can definitely recommend Thirdlane's cloud phone system. It's not free but cost-effective, with decent support and customization options. 3CX is alright, but we've switched to Thirdlane and are really happy now.
Is it possible to add 2 wireguard vpns for protection if one drops? And how?
Interesting question! Theoretically, yes, you could use a failover package called mwan3, which you'd use to set up your second WireGuard interface, as a failover interface. It effectively operates on pings, and if the pings fail on the first WireGuard interface, traffic will begin to be routed over the second WireGuard interface. All you'd need to do is set up 2 WireGuard interfaces, then setup the mwan3 package. I haven't used mwan3 yet, but it should be pretty simple to follow. openwrt.org/docs/guide-user/network/wan/multiwan/mwan3
Hey. Thank you. But is there a way to use wildcard domain to include all subdomains of a domain?
Thanks for watching @saotekwong3276! Referring to the link below, you should be able to route all subdomains of a domain in your policy. However, you don't explicitly wildcard it. Instead you write to domain as you normally would, say google.com, and then when you set your resolver set to dnsmasq.ipset or dnsmasq.nftset, whichever is supported on your system, then it will route subdomains through your existing policy. Refer to the comment below from the creator of PBR for more information. My answer is simply what he provided, and not something I have personally experienced. forum.openwrt.org/t/policy-based-routing-pbr-package-discussion/140639/779
@@DevOdyssey Thank you very much. I tried dnsmasq.nftset, but it is not working. I have no idea why
@@DevOdyssey Thz for you information. However, I have tried and but it does not work.
@@saotekwong3276 So can you elaborate on it? Whats not working about it and how is it not working? How have you tested it to prove its not working? Have you ensured that you have dnsmasq set up on your router? If you have further trouble here, it would probably be worth getting onto the OpenWrt's forums to ask for assistance, where you can share screenshots of what you've done any your observations of your tests, and the community should help you get it working, including creator of the pbr package. forum.openwrt.org/ forum.openwrt.org/t/policy-based-routing-pbr-package-discussion/140639?page=38
Something with snort3 and/or suricata might be helpful. Would squid help with layer3 issues? What else have you used for DPI?
Snort3 or suricata can definitely be helpful, though those are more IPs/IDS solutions, that are on top of DPI in general. IDS and IPS solutions can be for source intensive too, so OpenWrt on your standard routers won’t be able to handle too many rules in either platform. They’d be better on a x86 mini pc if you still wanted to use OpenWrt. To that point, it doesn’t seem like suricata has been fully ported to OpenWrt, only Snort has been. There are other DPI systems like Netify that work on OpenWrt, but I have not tried it, and it seems to be a paid solution as well. They don’t seem to exactly be an IDP or IDS but simply doing packet inspection for network analytics. For DPI and related services like IDP or IDS, I’d recommend using a platform with more power, and using BSD based solutions like OPNsense or pfSense, using Intel based hardware, and something with more than 1 GB of RAM. I haven’t gotten around to doing DPI or IDP/IDS personally, other than enterprise grade solutions such as Palo, so I don’t have much experience to share here. Though I’ve heard good things about ZenArmor that I’m hoping to try in the near future that offers tons of functionality more than IDP and IDS, more in the realm of “Next Generation Firewalls”. If you do happen to use Snort on OpenWrt, I’d be curious to hear about your experience. You might get to it before I do.
Hey Dev, appreciate your videos. Would you be able to do one on mwan3 & openwrt 23.05 I understand there is a script now that makes it work with ipsets. Thanks again!
Thanks @mikeclites8407! Awesome to hear from another happy viewer. I can't honestly say if or when I'd get to it, but if you do try it out yourself, I'd be happy to give my 2 cents. I haven't used mwan at all yet, but my understanding of it is pretty straight forward. Do you have a reference that says it works with ipsets using a specific script?
Awesome, easy to follow, thank you so much!
You're welcome @striker_rafael! Thanks for watching. I'm happy to make great content just like this. I have plenty of more video / network ideas I need to get started on that I'd be happy to share.
I would like to see a set of basic firewall rules set up on OpenWRT with a default deny rule set on the LAN. I would like to see rules for DNS/mDNS, dhcp-client including refresh, http/https-client, passive ftp client, ssh-client, pgp-clients, multimedia (like TH-cam) clients, and video conferencing clients (like ZOOM). An episode where you review assorted network tools would also be useful. I would like to be able to inspect the details of packets that get dropped for example, to figure out how to write my own rules and to check my configuration. Thanks for explaining the basics of linux firewalls. Some things definitely make more sense now.
Thanks for watching @JBlask! Appreciate you sharing your ideas. A general firewall rule video on good rules to implement is one I've been wanting to make for sometime, but haven't gotten around to it. Those additional rules you're referring to, I havent really ever made rules for all those, as some are automatic, like the dhcp rules. HTTP(s), FTP and SSH are straight forward, pgp clients I'm not sure on, and doing rules for applications like TH-cam or Zoom requires a different type of firewall, one that can create Layer 7 or application rules. You won't be able to create those with OpenWrt. I have wanted to do a network tools video too, like ping, iperf3, tcpdump, but haven't fully fleshed that idea out. Deep packet inspection is something I still need to improve on, so one day I could go more in depth there. Nonetheless, I'm happy to hear this video as it stands was able to teach the basics, just as I had intended.
great video man, very informative
Thanks for watching @confusio4207! Appreciate the compliment!
The services menu doesn’t pop out on mine router any suggestions
Thanks for watching @luhwoppp! Could you elaborate more? Does it actually show up after the install, and are you saying the dropdown doesn't show anything? What version of OpenWrt are you running? I haven't used this in the newer versions, 23.05, so I can't be sure if there are any issues, but to me it sounds like it could be something you are misunderstanding.
Best complete video on subject!!!!
Thanks @mikenyc1589! Really appreciate the compliment.
@@DevOdyssey I would like that info on mwan3....I wouldn't want wifey getting pissed if internet knonks out while shes working..:(
Great video. I have everything working except for the very last part I cannot ping a device on the opposite site LAN. I get a reply from the opposite sites WG interface address, Destination port unreachable. Handshake is fine, a PC on Site A can ping the wireguard interface address on site b, also the Pi running openwrt on site b. This also works in the other direction. However, a PC on site A cannot ping a PC on site B and the same fails in the other direction. IP’s and allowed IP’s are below. Also, I do not seem to see any error in the logread after failed ping attempts. If I ping a PC on site B from site A then the WG address on site B replies with Destination port unreachable. I have tried to set VPN and WAN forwards to ACCEPT but I am guessing really. I even tried temporarily disabling the windows firewall on each PC but this did not resolve the issue. Any help would be appreciated in what I can check next. Further info: I am using a draytek router as my simulated internet connection. I have LAN 3 and LAN 4 for site a and site b. The routing table shows both networks are in there. site_a (Pi OpenWRT 192.168.100.1 - WAN 192.168.3.10/24 - WG 10.10.10.1/32) Allowed IPs (10.10.10.0/24 - 192.168.200.0/24) site_b (Pi OpenWRT 192.168.200.1/24 - WAN 192.168.4.10/24 - WG 10.10.10.2/32) Allowed IPs (10.10.10.0/24 - 192.168.100.0/24)
I managed to resolve the issue with some help from the openwrt forum. Firstly I disabled the firewall for each of the routers using the command, /etc/init.d/firewall stop. I also disabled the windows firewall on both PC's. I was then able to Ping from PC to PC in both directions. I added the windows firewall back and could only ping in one direction. SO one of the PC's firewall needed configuring. Moving on I added config forward option dest 'lan' option src 'vpn' to each router. This created the rules required so I could start the firewall on each of them again with /etc/init.d/firewall start. Finally to get the ping working for both directions I added the WG subnet (10.10.10.0/24) and the opposite site subnet to each of the windows inbound firewall settings. Now all up and running. Great video. I found out a lot setting it up. One being that OpenWRT will block Forwarding on the lan when source and destination subnets are different.
Essentially I was using the wifi as the WAN and the Ethernet as the LAN. So at 9min 38secs of the video where you set VPN zone to forward to WAN, I needed to forward VPN to LAN. Something that I only realised after getting it to work.
@@jamesnorth6078 Thanks for watching and sharing what you've done, I appreciate it. These extensive notes are sure to help anyone else experiencing the same issue. Your experience reminds me of basically anything I make a video on, I have to rough through the experiences of getting it wrong so many times until I get it right. Given what you said, it makes sense why it didn't and did work after your changes. My simulated Internet was to show this with public IP addresses, and its pretty easy to set up in OpenWrt. Just define your subnet and allow forwarding. Thats pretty much it, and was pretty novel for me to do in this video. Though in future videos, I have some cloud ideas in mind for my demonstrations. Anyway, thanks again for sharing your experience, and I hope this set uo continues to treat you well!
not trying to be rude or something, but i kinda expected to see something different, like some tips or w/e, but video is less informative than just opening "full help" right on the rule page.
Thanks for watching @barneybarney3982, and no worries. I'm not taking any offense, I appreciate you sharing your thoughts. This video is really meant to provide the hands on approach that you wouldn't get from click "full help". While the things I say certainly has overlap, the full help won't click through the options for you and show how they are used, in conjunction with different options I have thought about some general "firewall tips" videos about best practices and good rules, that I hope to get to in the future, as I can see that being a very helpful video. I just havent gotten around to it yet.
I am hoping that my self-hosted 4SC FREE license will renew on June 2nd; - about 3 years ago, I ran up 3CX as a VM, - I was so impressed that I ran it 'on the metal' ......currently on V20 and I did my DNS homework...
Thanks for watching @ANTHONYBOOTH! Self hosted version would be cool to try, as I like to get my hands dirty that way. This video was a fun experiment in learning SIP and VOIP tech. Happy to hear that the platform has been treating you well overall!
Thank you, it worked. Though , when I stop the WireGuard interface, I can't connect to any website anymore. To get it to work again, I have to tick the box at "Use the DNS servers advertised by peer" in the WAN interface again, any idea how to fix that?
Thanks for watching @Anonym12393! Glad to hear it worked. So what this seems to indicate here is that your DNS server is not accessible outside of the tunnel, and therefore DNS requests are failing (and therefore any other requests that rely on DNS). You can remediate this by using a cloud flare DNS or simply making sure the DNS server is accessible outside of the tunnel. I believe Mullvad has DNS servers that are public that you can use, but obviously feel free to use one you trust.
Regarding the heatsink, probably 40mmx55mm standard size for a compute module 4. Could you let me know what the fin height is in your example? I'm not sure if it matters whether or not the fins stick out of the enclosure or not. Great video on this! 👍
Thanks for watching Victor! The height shouldn't matter since the fins do stick our of the enclosure, for the sake of air flow and letting the heat dissipate. I went ahead and measured it, and the height is roughly 4 mm, from the top of the fan to the base of the heat sink. Is there a reason you're concerned on the height?
@@DevOdyssey There are other heatsinks with differing heights, but same length and width for a CM4, but I understand now that the height doesn't matter for assembly purposes, any of them will do, thanks!
@@Victor-779 You're welcome and good to know. I figured there are, I don't shop around for different heatsinks for Raspberry Pi CM4s often. But yea it can be even taller if need be to catch more airflow, and it won't get in the way unless you squeeze the whole unit into a tight space, which I don't imagine anyone would really be doing.
Boa, diese schnellen Sprünge sind die komplette Katastrophe, wenn man mitmachen will...
Danke fürs zuschauen @dominikseildein6049! Entschuldigen Sie, während ich Google Translate verwende, um zu antworten. Die Beschleunigung soll das Video auf einer angemessenen Länge halten, aber ich sehe, dass es dadurch schwierig werden kann, dem Video zu folgen. Ich empfehle, das Video in diesen Abschnitten zu verlangsamen, um es genauer verfolgen zu können.
Thanks for the awsome video.I have a raspberry pi 5 with docker and adguard as a dns server. Would it be possible to add another container for openwrt? or i have to use another independent raspberry pi?
Thanks for watching @tranquiloteov! Nice setup! So from my research, you can setup OpenWrt within a container, but I can't say I have ever done it. The reverse is also true, you can run containers within OpenWrt (as the host OS). So you could run those adguard and dns server in a container on OpenWrt, or simply use the adguard package and built in dnsmasq. But if you want to use OpenWrt as a container, I'd refer to this reddit thread here with some notable links on OpenWrt containers. www.reddit.com/r/openwrt/comments/p7qple/has_anyone_tried_running_openwrt_in_a_docker/ openwrt.org/docs/guide-user/virtualization/lxc github.com/oofnikj/docker-openwrt If you do get it working, give update this here with a comment, I'd be happy to hear about it.