Can I run a Wireguard (or really any VPN) on my dumb AP router with openWRT? reddit / selfhosted ---------------------------------------------------------------------- water_we_wading_for · 2023-10-21 20:05 Hello all, I have never ran a VPN in my own home but I would like to try it. It so happens that I have 2 of my own routers in the house, besides my router/modem from the ISP, which are only serving as dumb wireless APs. And I have openWRT running on them. I have heard of running Wireguard on openWRT. But can this work even when openWRT is on a router like in my case? Or is there no point to this when the router in question does not actually connect to the internet? And how would I connect my wired devices to this VPN, when they do not normally interact with these routers? (As they do not connect to the WiFi) Is there even a point to doing this, or should my VPN exist outside of my home network? For example as a VPS? Thanks for any and all clarification you can provide! As you can see I am a bit confused but I'd like to learn. ---------------------------------------------------------------------- thekrautboy · 2023-10-21 20:18 It could, but the router needs to have enough free space (NVRAM) to install extra software. Most standard routers have very limited space. Check the OpenWRT documentatiom or ask their community about your exact router model. ---------------------------------------------------------------------- Reasonable-Ladder300 · 2023-10-21 21:25 Yes you can running it myself as backup vpn on my openwrt linksys wrt1900acs v2. Which is configured as a dump AP as well. You can follow guide on wireguard openwrt instructions on the OpenWRT website but instead of wan forwarding you need to use lan and you should be good to go. ---------------------------------------------------------------------- water_we_wading_for · 2023-10-21 21:27 Thank you so much! Just to be clear, are you talking about a VPN server or a VPN client? I am supposing a server for entry from the outside. ---------------------------------------------------------------------- Reasonable-Ladder300 · 2023-10-21 21:28 Yes VPN server, I mainly use the one on my server, but i have the openwrt as backup just in case the other fails. ---------------------------------------------------------------------- water_we_wading_for · 2023-10-21 21:29 Thanks! I have 2 different ones. A Netgear Nighthawk X4S R7800 and a Netgear Archer 1750_A7. I guess these would be their relevant pages for openwrt: https://openwrt.org/toh/netgear/r7800 https://openwrt.org/toh/tp-link/archer_a7_v5 ---------------------------------------------------------------------- water_we_wading_for · 2023-10-21 21:35 Thank you. How does your modem know to forward traffic to the VPN router? I guess a guide would cover that. I'm a dummy when it comes to networking. ---------------------------------------------------------------------- Reasonable-Ladder300 · 2023-10-21 21:49 I used port forwarding in my isp modem/router to forward the port used for wireguard to forward it to my the openwrt dump ap ip and wireguard port ---------------------------------------------------------------------- thekrautboy · 2023-10-21 22:33 Okay? ---------------------------------------------------------------------- water_we_wading_for · 2023-10-21 23:04 Port forwarding makes sense thank you. I am following a few different guides on how to set up a wireguard server on the dumb AP router. All of them seem to think that this router is my main router. So, they create a new interface on the router to allow traffic from the WAN. They also create a firewall rule on the router. Are those things I have to do? Sorry if this is a silly question. For example, steps 3 and 4 here: https://openwrt.org/docs/guide-user/services/vpn/wireguard/server ---------------------------------------------------------------------- phein4242 · 2023-10-21 23:18 Yes, all of the vpns will work. ---------------------------------------------------------------------- Familiar-Newspaper23 · 2023-10-21 23:31 you say 'dumb' ap router - but if it's running openwrt then id say it isnt dumb. might not have lots of resources but it isnt dumb. also the AP part of your question isn't really relevant - openwrt router software can run wireguard and can run access points if they have the hardware - but doesnt need to. personally I have two of these so far for a small homemade mesh: [https://www.ebay.com/itm/304334846904](https://www.ebay.com/itm/30433 4846904) these run wireguard just fine and i get similar speeds to my hardwired ubuntu server running a vpn in the house. i'll probably switch to a pfsense router built from an HP elitedesk but only because i want to connect to my modem with 2.5G and may add 10G whereas these routers only have 1G wan ports - but once I do i'll just set these two up as access points only hardwired back to a 1G switch which is connected to pfsense router...these are sold under belkin and linksys if i remember right and they can be bought in pairs for a mesh - for $200 from walmart - or can be had here on ebay open box (they fell off a truck, these boxes werent ever opened) for $80 total or a mesh of 5 units for $200 and with openwrt can also, yes, run wireguard. there are lots of options out there. they don't even need to have giant spiderleg antenna. openwrt does port forwarding easily, too. i also have adblocking on and block all traffic from several countries to keep my servers a slight bit safer. i monitor the router with home assistant and have it renew my ddns as well. openwrt is smart AF and can totally run wireguard. checkout pfsense if you have lots of throughput but i mean im mostly going that router for the fun of it, i dont actually need anything more than this. good luck - enjoy ---------------------------------------------------------------------- Reasonable-Ladder300 · 2023-10-21 23:31 That’s where it’s gets a bit tricky, and I don’t remember it fully but you could for step 3 omit the second line and replace the second wan with lan and that should do the trick. ---------------------------------------------------------------------- youngsecurity · 2023-10-21 23:49 Why go with something outdated like a VPN, and not something far more secure like OpenZiti? The main difference is the traditional VPN is open to attack from the Internet and OpenZiti uses an overlay network that is not visible to the public Internet. ---------------------------------------------------------------------- DuhMal · 2023-10-21 23:53 he thinks you are chatGPT ---------------------------------------------------------------------- JustForkIt1111one · 2023-10-21 23:54 What are you trying to accomplish with a VPN? Is it an 'incoming' vpn, where your devices can securely connect to your home network, and access resources / internet there? Or, is it an 'outgoing' vpn where you connect to a 'cloud server' owned by someone else on a connection pooled with a ton of other people - usually used by people that think it gives them anonymity on the internet. ---------------------------------------------------------------------- PublicSchwing · 2023-10-22 01:41 Technically there's no such thing as a WireGuard server. It's peer to peer. I think maybe TailScale would be a good option for you. It's built on top of WireGuard and will most likely be quite a bit more user- friendly. At least until you've acquired a little more networking knowledge. [Here's](https://openwrt.org/docs/guide- user/services/vpn/tailscale/start?s[]=vpn) some documentation to get you started.