Right now, my Wireguard interface just lives on a LAN interface on my router, but all my other devices are in their own VLAN’s. I treat my phone as IoT and my desktop as network admin. How should I go about pointing my Wireguard interface to my server’s VLAN? Is it simply by forwarding the Wireguard traffic to the server VLAN in firewall settings (lan (wireguard) → L4_V8 → wan), or am I looking at the wrong place?
my Wireguard interface just lives on a LAN interface on my router,
I assume you mean WireGuard is in the lan zone.
If it’s a site-to-site VPN where you trust the other end then the lan zone might be correct.
If it’s an external VPN service you connect to then the VPN probably should be in the WAN zone.
Instead of using an existing zone such as lan or wan you can create a vpn zone and set up the firewall exactly as you want.
Thank you for responding, and yeah, that’s right. It’s exclusively to be used for me to access my home server’s services, including SSH. Although I trust both ends, would it be more secure to put it in the WAN zone? I’ll eventually need a VPN to my server on my phone for CalDAV as well, which I’ve read shouldn’t be trusted. I obviously don’t need/want SSH available for my phone
For the last option, I’ll still end up with my VPN separated from the VLAN I’ve put my server in, right? Do you mean that I have the right idea with VPN zone → server VLAN zone → WAN zone?
Although I trust both ends, would it be more secure to put it in the WAN zone?
Sure if you only want to only allow traffic that should be allowed by the wan zone.
I obviously don’t need/want SSH available for my phone
If you want two types of VPN peers then you might configure two WireGuard interfaces (each in a separate zone), otherwise you may need to use firewall rules with IP addresses.
For the last option, I’ll still end up with my VPN separated from the VLAN I’ve put my server in, right?
You can also use the same zone (but then it isn’t a VLAN zone but a VLAN+VPN zone).
I have the right idea with VPN zone → server VLAN zone → WAN zone?
I’m not sure what traffic from the vpn would be forwarded via the server and then to wan.
Thanks, I was able to get it up an running with a VLAN+VPN zone for now. One thing I noticed is that it doesn’t work as expected if I’m connecting home from some other external network (e.g., phone hotspot). Because WAN here is just another device connected to the cable modem (10.0.0.xxx), the port forwarding for Wireguard basically just says to route 10.0.0.xxx:51820 to the Wireguard interface. Compared to when everything was connected to the cable modem, port forwarding routed :51820 to the Wireguard docker container I had on my server.
Would enabling bridge mode on the cable modem make any port forwards I set on openWRT actually apply to my public IP? Previously, I had to set up port forwards with an app from my ISP. Those would be gone too if I enabled bridge mode, right? I don’t want to nuke my cable modem unnecessarily and make all my roommates have to login again.