Connect OpenWrt to another Wi‑Fi network as a routed client

This guide turns OpenWrt into a routed Wi‑Fi client: an OpenWrt radio joins an upstream network, the wwan interface receives DHCP, and the downstream LAN uses a different subnet and NAT. This is not a bridged AP design; use the source's WDS or relayd guides when both sides must share one subnet.¹

Warning: Do not connect the OpenWrt router to the main router while changing its LAN address. Reset to OpenWrt defaults when necessary, configure through a LAN port, and keep a direct recovery path for any change that removes LuCI access.¹

Address plan and assumptions

Assume the upstream Wi‑Fi uses 192.168.1.x. OpenWrt must use another subnet, such as 192.168.2.1, so the two networks do not overlap. Before starting, record the SSID, encryption, optional BSSID, the radio to use, and the firewall zones already present on the device.¹

The source notes that a device with more than one radio can use the second radio by changing index 0 to 1 and wlan0 to wlan1. Do not guess radio names; inspect the device itself.¹

Configure it in LuCI

1. Do not wire the OpenWrt router to the main router. Reset to OpenWrt defaults if the current configuration is unclear.
2. Connect the computer to an OpenWrt LAN port and open LuCI at 192.168.1.1.
3. Open Network → Interfaces, edit LAN, and keep the protocol as Static address.
4. Move the LAN address to another subnet, for example 192.168.2.1, then click Save.
5. Click Save & Apply, disconnect and reconnect the computer so it picks up the new address.
6. Open Network → Wireless and click Scan.
7. Select the target Wi‑Fi network and click Join Network.
8. Select Replace wireless configuration when the existing Master AP should be removed from that radio.
9. Enter the Wi‑Fi password. In the normal case, the client firewall zone is wan/wan6.
10. If the wan zone does not exist, do not save the Wi‑Fi configuration yet; create the zone in the next subsection and repeat the Join step.
11. Keep the new network name as wwan, select the wan firewall zone, and click Save.
12. In the client settings, choose the Mode that matches the upstream network, set Width to match the upstream network, and do not change the channel used by the network being joined.
13. Click Save, then Save & Apply. View the wwan address under Network → Interfaces; it may not appear on every status screen.¹

Create a WAN zone when it is missing

If the wan zone is missing, open Network → Firewall, click Add, and create a zone equivalent to the default WAN zone. Return to Wireless, join the network again, leave the new network name as wwan, select wan, and save. Do not assign a client radio casually to LAN, because that removes the boundary between the upstream and management networks.¹

Configure and inspect it from the command line

Enable the radio, save the wireless file, and start Wi‑Fi before scanning:

1
2
3

uci set wireless.@wifi-device[^0].disabled="0"
uci commit wireless
wifi

Inspect the interface names and scan nearby networks:

1
2

iw dev
iw dev wlan0 scan

The following sample shows how to read SSID, BSSID, frequency, signal, and encryption. It is illustrative; do not copy the sample SSID or BSSID into a real network:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

# iw dev wlan0 scan
BSS c8:d5:fe:c8:61:b0(on wlan0) -- associated
        TSF: 24324848870 usec (0d, 06:45:24)
        freq: 2412
        beacon interval: 100 TUs
        capability: ESS (0x0411)
        signal: -72.00 dBm
        last seen: 140 ms ago
        Information elements from Probe Response frame:
        SSID: Violetta
        RSN:     * Version: 1
                 * Group cipher: CCMP
                 * Pairwise ciphers: CCMP
                 * Authentication suites: PSK
                 * Capabilities: 1-PTKSA-RC 1-GTKSA-RC (0x0000)
BSS f8:35:dd:eb:20:f8(on wlan0)
        TSF: 24225790925 usec (0d, 06:43:45)
        freq: 2457
        beacon interval: 100 TUs
        capability: ESS (0x0431)
        signal: -90.00 dBm
        last seen: 1450 ms ago
        Information elements from Probe Response frame:
        SSID: GOinternet_EB20FB
        HT capabilities:
                Capabilities: 0x11ee
                        HT20/HT40
                        SM Power Save disabled
                        RX HT20 SGI
                        RX HT40 SGI
                        TX STBC
                        RX STBC 1-stream
                        Max AMSDU length: 3839 bytes
                        DSSS/CCK HT40
                Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
                Minimum RX AMPDU time spacing: 4 usec (0x05)
                HT RX MCS rate indexes supported: 0-15, 32
                HT TX MCS rate indexes are undefined
        HT operation:
                 * primary channel: 10
                 * secondary channel offset: below
                 * STA channel width: any
        RSN:     * Version: 1
                 * Group cipher: TKIP
                 * Pairwise ciphers: TKIP CCMP
                 * Authentication suites: PSK
                 * Capabilities: 1-PTKSA-RC 1-GTKSA-RC (0x0000)

These are the UCI values changed by the example procedure. Violetta, the BSSID, and myWifiPasswordHere are sample data; replace the SSID, BSSID, encryption, and key with the results of your own scan. The key shown here is not a real credential.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

network.lan.ipaddr='192.168.2.1'
network.wwan=interface
network.wwan.proto='dhcp'
firewall.@zone[^1]=zone
firewall.@zone[^1].name='wwan'
firewall.@zone[^1].input='REJECT'
firewall.@zone[^1].output='ACCEPT'
firewall.@zone[^1].forward='REJECT'
firewall.@zone[^1].masq='1'
firewall.@zone[^1].mtu_fix='1'
firewall.@zone[^1].network='wwan'
wireless.@wifi-iface[^1]=wifi-iface
wireless.@wifi-iface[^1].network='wwan'
wireless.@wifi-iface[^1].ssid='Violetta'
wireless.@wifi-iface[^1].encryption='psk2'
wireless.@wifi-iface[^1].device='radio0'
wireless.@wifi-iface[^1].mode='sta'
wireless.@wifi-iface[^1].bssid='C8:D5:FE:C8:61:B0'
wireless.@wifi-iface[^1].key='myWifiPasswordHere'

Verification, limits, and common failures

A client should receive DHCP from the upstream Wi‑Fi, obtain a default route through wwan, reach the gateway and DNS, and reach the Internet. If AP and client mode must share one radio, check the driver limitation; the source links a Cannot enable client and AP on same radio issue. If LuCI disappears after the IP change, try 192.168.2.1, use the correct LAN port, and follow the model-specific recovery path rather than wiring into WAN.¹

Do not confuse this design with a Bridged AP: routed client mode creates a separate subnet. When one broadcast domain is required, switch to WDS or relayd and check the compatibility conditions for both devices.

Sources