OpenWRT - How to set up an OpenVPN Tap Bridge between two routers - 21.x and below.

[@brns480]

Great job! Works like a charm, thank you very much 👍🏻👍🏻👍🏻

[@Devesh-b5d]

Hello mate need some help on it

[@mlmmly]

Thanks， I setup the client side openvpn by your tutorial。 Good tutorial

[@primetechguides3050]

For OpenWRT 21 and above, this may help. Server: 16:40 - Physical Settings is now under Network > Interfaces > Devices (tab) > br-lan Configure. Bridge Ports - Add tap_vpn - Ensure OpenVPN is running first to see this. Client Skip 21:44 - 22:48 There is no Network > Switches menu. Skip 23:10 - 24:08 - Adding of LANVPN interface. Goto Network > Interfaces > Devices (tab) br-lan > Configure... > Remove lan1 from the bridge ports Add a new Device Configuation Device Type > Bridge Device Device Name > lan_bridge Bridge Ports > lan1 & tap_vpn Goto Network > Interfaces > Interfaces (tab) Add New Interface Name - lanvpn Protocol - Static Address Device - lan_bridge Create Interface. IPv4 address - 192.168.2.2 Subnet Mask - 255.255.255.0 Skip 31:36 - 33:54 Add Firewall like 24:12 - 24:43

[@liammiller9015]

Hi mate. Me again! Following this part of your guide as I'm on OpenWRT v23. When I go into Device Configuration (as you've listed below) and attempt to bridge ports, tap_vpn isn't in the Bridge Ports drop down list. Is there a reason that might not be an option? Add a new Device Configuation Device Type > Bridge Device Device Name > lan_bridge Bridge Ports > lan1 & tap_vpn

[@primetechguides3050]

@@liammiller9015 Need to ensure the OpenVPN is active and running on both server and client. Check System Log

[@robotti84]

does this config work if client is laptop? how to change accordingly?

[@liammiller9015]

Hi mate. Any advice on generating the certificates with ECDSA or EdDSA? I'm being told these certs, with TLS 1.3 and ChaCha20 encryption should improve speeds.

[@rooobosmith]

I am at 16:40 in the video on Interfaces >> LAN, but do not see the "Physical Settings" tab. I am trying to configure OpenVPN under OpenWRT v 21.02.3 (openwrt-21.02.3-ath79-generic-tplink_archer-a7-v5-squashfs-factory.bin) with the upgrade bin installed. Is this a version problem? How do I set the Bridge Interfaces?

[@primetechguides3050]

I believe Physical Settings is now under Interfaces > Devices (tab) > br-lan Configure.

[@Samezrp]

Hi, I'm following your manual and starting time 16:41 you are showing bridging interfaces. On LuCI ver 21.02 there is no this option (Physical Settings option tab is missing). How to set this bridge in /etc/config/network file as I believe this is the way it is done? I'm not Linux geek and I cannot easily find that option. Would you mind sharing your /etc/config/network file?

[@rooobosmith]

Did you ever find a solution to this problem? I am seeing the same missing Physical Settings on LuCI v 21.02

[@Samezrp]

@@rooobosmith I did manage to setup all. I do not remember at this time exactly what was done. Please remind me it on Monday. As far as I remember there was a change in LuCI 21 regarding whole network settings and when I read this info I understood what should be done. However at the moment I'm at home and working setup is at work so I cannot check exactly what was the solution.

[@rooobosmith]

@@Samezrp thanks for responding. Maybe when you get a chance you could post your solution here? Thanks.

[@rooobosmith]

Hi @@Samezrp did you find your solution?

[@liammiller9015]

Really great tutorial as I'm about to set up something similar. Question though - why are you needing to configure the VPN to be on a specific ethernet port with VLAN on both sides? I would've thought that the VPN router on the client side should be able to have any device plugged into any of the LAN ports and receive an IP address from the server router? At least that's my goal here. Anything plugged into the client router should receive an IP address from the server router.

[@primetechguides3050]

I wasn't port forwarding just opening a specific port on the Server router to allow the OpenVPN connection.

[@liammiller9015]

Apologies - I was referring to your Site B client router - you have the TAP VPN configured to work on only one ethernet port. While I'm assuming a standard network switch plugged into that ethernet port could provide more ethernet ports if more than one network device requires the VPN, is it possible to assign the VPN to more ports than just the one?@@primetechguides3050

[@primetechguides3050]

@@liammiller9015 ah I was just showing how to use VLANS at the same time. Just ignore the VLAN section and creating a LANVPN interface, and just use the main LAN interface to use all the ports. Still bridge the tap_vpn to the LAN Physical Settings.

[@liammiller9015]

@@primetechguides3050 Thank you, sir!

[@liammiller9015]

@@primetechguides3050 Any chance you can give some guidance on how to configure the Network > Switch setup on routers that now use DSA? Switch is missing on my version of OpenWRT. I believe I need to add a new bridge device and set it up in there.

[@Devesh-b5d]

Hello i have some queries regarding this setup can we connect on mail or discord if it's possible

[@ApointFilm]

Many thanks for the excellent tutorial, which can also be adopted almost 1:1 under V21.02. What happens if more than one client is to be connected in parallel? Does it need a separate port for each connection? I have not yet found a conclusive solution for TAP.

[@primetechguides3050]

You could have a separate switch going into the one port with multiple devices attached.

[@fabioamado6725]

Which hardware requirements the routers have? Can I do This with glinet GL-MT300N-V2?

[@Samezrp]

This is according to compatible OpenWRT hardware. Looks like your router is supported: openwrt.org/toh/start?dataflt%5BModel*%7E%5D=GL-MT300N

[@fabioamado6725]

@@Samezrp Hello and thank you for quick answer and support. I know this router supports OpenWrt. In fact, it runs it natively, with a vendor "configuration page" with a simpler operation on top. I just wanted to confirm that if it supports OpenWrt, than it has everything needed to run this solution. No special hardware is needed: if it runs OpenWrt, does this! Thank you :)