OpenWRT as a Proxmox VM

Proxmox with single network interface CGHMN setup with virtual OpenWRT:

Make sure you have signed up for CGHMN first before starting this! You will need to imput various details sent in your welcome message.

1. Create new bridge in Proxmox VE

a. Add the following to your network bridge:

auto <name-of-bridge>
iface <name-of-bridge>
        bridge-ports none
        bridge-stp off
        bridge-fd 0
        post-up echo 1 > /proc/sys/net/ipv4/ip_forward

<name-of-bridge> should be an available vmbr# interface, such as vmbr1. This bridge will be dedicated to all our CGHMN Proxmox VMs going forward.

b. Run:

systemctl networking restart

c. Confirm configuration is correct with:

ip a

Example output:

21: vmbr1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000

2. Create new OpenWRT VM (based off this tutorial).

a. Download the x86-64-generic-ext4-combined.img.gz OpenWRT image

b. Transfer it to your Proxmox system using SFTP

c. Decompress it so you have a .img file using gzip:

gzip -d openwrt*.img.gz

d. To make space for additional software that we're going to install to OpenWRT later, grow the disk image to 1GB:

qemu-img resize -f raw ./openwrt.img 1G

e. Create the VM using the following command:

qm create --name <vm-name> <available-vm-id#> --memory 256 --cores 1 --cpu cputype=kvm64 --net0 virtio,bridge=<existing-proxmox-network-bridge> --net1 virtio,bridge=<name-of-bridge> --scsihw virtio-scsi-pci --numa 1

f. Check for available VM disk stores:

pvesm status

Example Output:

Name         Type     Status           Total            Used       Available        %
local         dir     active       772966856        53281488       680347384    6.89%

g. Import disk image into VM:

qm importdisk <available-vm-id#> ./openwrt.img <vm-disk-store>

Example Output:

transferred 0.0 GiB of 1.0 GiB (0.00%)
...
transferred 1.0 GiB of 1.0 GiB (99.59%)
transferred 1.0 GiB of 1.0 GiB (100.00%)
transferred 1.0 GiB of 1.0 GiB (100.00%)
Successfully imported disk as 'unused0:local:102/vm-102-disk-0.raw'

h. Attach imported disk to VM:

qm set <available-vm-id#> --scsihw virtio-scsi-pci --virtio0 <vm-disk-store>:<available-vm-id#>/vm-<available-vm-id#>-disk-0.raw

Example Output:

update VM 102: -scsihw virtio-scsi-pci -virtio0 local:102/vm-102-disk-0.raw

i. Set serial console and boot order priority:

qm set <available-vm-id#> --serial0 socket --vga serial0
qm set <available-vm-id#> --boot c --bootdisk virtio0

j. (optional if you want it to boot on Proxmox startup) - Configure VM to start up on system boot:

qm set <available-vm-id#> --onboot 1

3. Configure OpenWRT

a. Start VM and connect to the console. Once started enter the console shell by pressing Enter.

b. Set a new root password:

passwd

c. Show current network configuration:

uci show network

d. Set a static IP address that is accessible from another VM with a GUI (this will make troubleshooting and checking your config easier). For example if you have a VM at 203.0.113.100 and your existing bridge subnet is 203.0.113.0/24, then you could set your OpenWRT's vmbr0 interface to be 203.0.113.101.

e. Do the above by editing /etc/config/network file and adding the following:

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '<your-chosen-IP-address>'
	option netmask '<matching-netmask-with-vmbr0>'
	option gateway '<vmbr0-gateway-ip-for-internet-access>'
	list dns '<public-dns-resolver-such-as-quad9-or-google>'
	list dns '<2nd-public-dns-resolver>'
	<list as many resolvers as you would like>

config interface 'retro_lan'
	option device 'br-retrolan'
	option proto 'static'
	option ipaddr '<cghmn-assigned-subnet>'
	option netmask '<cghmn-assigned-netmask-usually-255.255.255.0>'
	option multipath 'off'
	list dns '100.64.11.1'
	list dns '100.64.12.2'

f. Add a static route to allow for your router to reach the internet. This should be the IP of the Proxmox VE's vmbr0 interface. For example, if vmbr0 on Proxmox VE is configured as 203.0.113.1, you would put that in this command on OpenWRT so it would know who to communicate with to get to the internet. You can do this by adding the following to /etc/config/network:

config route
       option interface 'lan'
       option target '0.0.0.0/0'
       option gateway '203.0.113.1'

g. Restart the networking stack to read the new configuration settings:

/etc/init.d/network restart

i. Update your package lists:

apk update

j. Install any additional desired software using apk, such as wget (needed for the next step)

k. Download the get-connected.sh script to your OpenWRT router by following the steps here

l. Once the steps from the link are completed, reboot your VM and reconnect. Your Wireguard connection should establish automatically and be bridged through the Wireguard tunnel to CGHMN, and your systems should automatically get an IP address from your assigned subnet. Additional configuration should have been added to /etc/config/network to accommodate the Wireguard connection. If you need to share the contents of this file make sure you do not include your private_key from the configuration! Your public_key is OK to share.