How to make OpenWRT router settings page accessible from main network?

Question

I have a wireless router (router1) running DD-WRT that is connected to my ADSL modem. It is assigning DHCP addresses on my home network.

I also have a second router (router2) running OpenWRT that I use to extend the signal. It is setup as a client and takes a static ip on the wifi network of router1. When I'm connected to router1, I can ping Router2, but I am unable to access the config page of router2 unless I am connected directly to router2's network.

I assume it's a setting that needs to be changed on router2 to make the config page accessible from it's "wan", but does anyone know specifically what setting I should be changing in the OpenWRT settings of router2?

Unfortunately I can't avoid the problem by using WDS to make the two routers appear as the same network because the two routers have different chipsets.

Answer 1

Add a firewall rule on OpenWrt to allow traffic to LuCI's IP, however, you want to ensure uhttpd is running with an SSL cert and that it's auto-redirecting port 80 to port 443

• /etc/config/uhttpd

  config uhttpd 'lan'
      list    listen_http     '192.168.1.1:80'
      list    listen_https    '192.168.1.1:443'
      option  cert            '/etc/ssl/uhttpd.crt'
      option  key             '/etc/ssl/uhttpd.key'
      option  redirect_https  '1' 
  

  
  

• /etc/config/firewall

  config redirect
      option  target          'DNAT'
      option  family          'ipv4'
      option  proto           'tcp'
      option  src             'wan'
      option  src_dport       '443'
      option  dest            'lan'
      option  dest_ip         '192.168.1.1'
      option  dest_port       '443'
      option  name            'Redirect WAN -> LuCI (TCP:443)'
  

  • If encountering traffic issues for downstream devices, change the port uhttpd is running on to something other than 443 (i.e 10443)
  • If security is a concern with forwarding from the DD-WRT network(s) to OpenWrt, then don't utilize a firewall redirect, but instead, access LuCI via SSH by adding a port forward tunnel for the SSH connection
    • For example, in PuTTY: Connection > SSH > Tunnels - Forwarded Ports:
      • Source Port (arbitrary local port): 20443
      • Destination: localhost:443 || 127.0.0.1:443
    • Access LuCI by navigating to https://localhost:20443 || https://127.0.0.1:20443

Answer 2

Even if you could do this, you would reduce the security of the router with OpenWRT in doing so. You are much better off configuring OpenWRT locally while connected directly to the router - preferably with a direct wired connection.