0

I used to have a simple setup with two raspberry pi's, where the one in my house acts as a wireguard client with a wireless AP and forwards all traffic via a VPN to exit at the remote pi, like this (except in this diagram the server is called home server, while in my setup, the server is remote and the client is local). network diagram 1 Now I've moved and upgraded my home wifi to two Omada EAP225s wired to a level 2 managed switch from HP. Is there any way to have the remote VPN network served via the EAP225s, rather than through the raspberry pi's wifi AP? network diagram 2

Here's what I have so far:

I set up a vlan on my switch with the ports for the raspberry pi and two APs

enter image description here On the raspberry pi I set up a vlan interface with sudo nano /etc/network/interfaces.d/vlans

auto eth0.2
iface eth0.2 inet manual
    vlan-raw-device eth0

nano /etc/dhcpcd.conf

interface eth0
static ip_address=192.168.1.104/24
static routers=192.168.1.1
static domain_name_servers=8.8.8.8 8.8.4.4 1.1.1.1

interface eth0.2
static ip_address=10.0.0.1/24
static domain_name_servers=8.8.8.8 8.8.4.4 1.1.1.1

I then got wireguard up on wg0 following https://github.com/adrianmihalko/raspberrypiwireguard

This works to establish the connection to the server and curl https://ipinfo.io/ip gives me the public IP of the server

To provide access to connected hosts I set up dnsmasq with sudo apt-get install dnsmasq, then sudo nano /etc/dnsmasq.conf

interface=eth0.2
dhcp-range=10.0.0.50,10.0.0.150,12h
server=1.1.1.1
server=8.8.8.8
server=8.8.4.4

In the EAP controller web interface I set up a new SSID with the following settings eap setup

I can now connect to the network with my laptop, and connect to the raspberry pi by ssh, but no web traffic is getting across. What am I missing?

Improve this question

1 Answer 1

Reset to default
1

Configure the switch to have an additional tagged VLAN on the three ports (AP1, AP2, and RPi).

Configure your APs to serve the "VPN" SSID using the tagged VLAN ID.

Configure the Raspberry Pi to have a tagged VLAN interface (e.g. eth0.2 if it's VID 2) next to the existing physical eth0 interface. (Most tools – NetworkManager, ifupdown, systemd-networkd, ip link add – are able to create VLAN interfaces. Any manual that tells you to use "vconfig" is obsolete.)

Then bring up the VPN connection, and proceed as if you were trying to share the VPN connection over an ordinary Ethernet port (that happens to be named "eth0.2").

Improve this answer
9
  • Sorry, this is my first experience with layer 2 networking. My switch says that vlan ports can be in tagged or untagged mode for outgoing frames. Should I leave all three ports as tagged?
    – pgcudahy
    Mar 31, 2020 at 6:00
  • Yes, the additional VLANs should be in "tagged" mode for those 3 ports. (Each physical port should only have one untagged VLAN at a time, and you already have the default VLAN 1 in that mode.)
    – user1686
    Mar 31, 2020 at 6:06
  • That being said, if you want some devices to be directly wired to the VPN – e.g. computer or Xbox – then you can configure their switchports to have the VPN VLAN as "untagged" (and remove them from VLAN 1 using no untagged).
    – user1686
    Mar 31, 2020 at 7:35
  • Your answer has gotten me 95% there. Could you please look at the edits to my question and see if there's anything else I can do?
    – pgcudahy
    Mar 31, 2020 at 10:21
  • If you can reach the RPi (gateway) itself, then it sounds like an issue on the RPi side, e.g. perhaps you forgot to enable IP routing entirely, or to update interface names in your iptables rules?
    – user1686
    Mar 31, 2020 at 10:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.