Layer 2 bridge between two GL-A1300

I will try this method to open DMZ on fios router and port forward on Fios router as well

this might not be the best idea, that means you open all ports to one device, since you want accessibility through the vpn server, DMZ only targets wan, and wan has nothing to do with this in this case.

first you need to look to your wireguard peers on the server on site A router, by default it shows as:

Do you see the /24 this needs to be set to /32. unless you want peer to communicate to each other, in your case you probably have only 1 peer (site B), this is fine but the clients need to have some configuration changed.

please do so on site B router by editing the vpn client:

I have been looking if this feature already exists in this firmware as I have requested this a while ago, unfortunately it still isn't there even on the Flint 2 OP24.

if you navigate to here please for site A (the server with tv):

login with root user and password same as ui.

you will see this or similar:

click on the navigation here:

then here:

then you click on traffic rules tab.

now create a rule as following:

make sure that your tv device is running on this 192.168.8.3 ip this is very important you need to have to set this to static, you can do that via the router but you can probably also do that on the device it self via manual network configuration.

if you know the ports for the destination you could theoretically set this in your rule this will lock it down more which is securer although the vpn layer makes it very secure compared if you would do it via wan so not a big issue can always be used to improve later on.

-- Tl;dr
now a little lesson about firewalll because I think this is very important to have a understandment how this works.

a classic firewall always works from source to destination, everytime you connect to a site, it goes from src to dest, that way on the same line the destination is allowed to talk back on the same line, when you was not the initiator of the packet and this type of handshaking never happened the packet gets dropped.

in this case you open the port for interface wgserver so that the peers site B is allowed to initiate first to your tv box and therefor the tvbox gets the green card to talk back.

in only extreme rare cases the tvbox searches for the other connection as first initiator, it does that through broadcasting or multicast these are layer 2 on the routing level and wireguard does not support layer 2 but you can use a layer 2 tunnel called vxlan or the very difficult approach adding a multicast route manually, often than not especially most tv boxes nowdays use Android TV it often now doesn't use igmp or multicast at all :slight_smile:

--

make sure on site B you have this option checked:

It does not have to be OpenVPN. I am open to any solution that would make this work.

Have a look at Zerotier. ZeroTier - GL.iNet Router Docs 4

Thanks!!
My router in site A went down so i had some do a hard reset and not able to do any thing right now
as soon as it goes back up i will let you know