Keenetic VPN LAN Setup: Complete Guide

Configuring VPN Distribution Over LAN on Keenetic Router

To configure VPN distribution over LAN on a Keenetic Router, you need to properly set up routing and connection policies. Your issue with VPN not working when connecting via LAN occurs due to routing settings and interface policies.

Table of Contents

• Basic VPN Settings for LAN
• LAN Routing Configuration
• Connection Policies for Different VPN Locations
• WireGuard Configuration
• Testing and Debugging

Basic VPN Settings for LAN

For proper VPN distribution over LAN, you need to ensure that correct routing rules are configured on Keenetic. To do this:

1. Enable NAT for VPN clients in WireGuard settings
2. Configure firewall rules to allow traffic through VPN
3. Set up static routes for LAN devices

As stated in the official Keenetic documentation, to provide internet access through a VPN tunnel, you need:

interface Wireguard0
security-level private
ip Wireguard0 nat Wireguard0
system configuration save

This will allow traffic from LAN devices to pass through the VPN tunnel.

LAN Routing Configuration

To configure routing through LAN, you need to create appropriate rules in the Keenetic interface:

1. Go to “Firewall” → “Access Rules”
2. Add a rule to allow traffic from LAN devices to the VPN interface
3. Ensure the LAN interface is allowed in the routing policy

As mentioned in the guide to routing networks through VPN:

On the “Firewall” page, select the interface where incoming traffic will be monitored (this is the VPN connection), and click “Add rule” to create access rules for any protocols

For your configuration, you need to:

1. Select the WireGuard interface in firewall rules
2. Allow traffic through the LAN interface
3. Configure NAT for VPN clients

Connection Policies for Different VPN Locations

To configure different VPN locations on different interfaces (Germany - WiFi, Netherlands - LAN), you need to use Connection Priorities (PBR).

As explained in the documentation on connection priorities, PBR (Policy-Based Routing) allows you to solve the following practical problems:

Allows certain devices in the network to go through a VPN connection, while others go through the main internet provider

For your configuration:

1. Create a profile for Germany (WiFi):

   • Interface: Wi-Fi
   • VPN location: Germany
   • Priority: High

2. Create a profile for Netherlands (LAN):

   • Interface: LAN (connected to Rostelecom)
   • VPN location: Netherlands
   • Priority: Low

Important! As stated in the guide to setting up routes:

If connection priorities are configured, interfaces for connections through ISP and VPN provider must be in the same profile

WireGuard Configuration

For proper WireGuard operation with LAN distribution, you need to configure tunnel parameters:

1. In WireGuard settings for each location, specify:
   • Tunnel address (for example, 172.16.82.1/24 for server, 172.16.82.2/24 for client)
   • Listening port on the VPN server side
   • Encryption keys

As stated in the official Keenetic documentation:

For example, 172.16.82.1/24 on the server and 172.16.82.2/24 on the client. You need to specify the listening port number on the VPN server side, which will be used for incoming connections to the WireGuard interface

For your configuration, create two WireGuard connections:

• For Germany: WiFi interface
• For Netherlands: LAN interface

Testing and Debugging

After configuration, check VPN operation:

1. Check VPN interface availability:

   bash

   show interfaces wireguard0
   

2. Check routes:

   bash

   show ip route
   

3. Check NAT rules:

   bash

   show ip nat
   

4. For diagnostics, use the command:

   bash

   debug routing
   

If VPN still doesn’t work through LAN, check:

• Firewall rules on Keenetic
• DHCP settings on LAN port
• Routes on the main Rostelecom router

Sources

1. Internet access through a WireGuard VPN tunnel – Keenetic
2. Routing networks over VPN – Keenetic
3. Connection priorities – Keenetic
4. Setting up a route to a specific host through a WireGuard VPN provider – Keenetic
5. WireGuard VPN – Keenetic

Conclusion

To solve your problem, you need to:

1. Configure NAT for VPN clients in WireGuard settings for operation through LAN
2. Create firewall rules to allow traffic through the VPN interface
3. Use connection policies (PBR) to distribute different VPN locations across different interfaces
4. Verify routing and DHCP settings on both routers

After proper configuration, you will be able to:

• Distribute VPN through LAN for the Netherlands location
• Use WiFi for the Germany location
• Ensure stable operation of both VPN connections simultaneously

For more detailed configuration, study the official Keenetic documentation on VPN operation and routing policies.