Upstream Router LAN Connection

Use this path when an existing router already handles the internet connection. The Pi connects to it over Ethernet, while phones and computers join Pi Wi-Fi and pass through the Pi for OpenClash routing.

Acceptance result: Pi WAN automatically receives an upstream address; Pi Wi-Fi clients receive a separate LAN address and can access the internet.

Network topology

Internet
  │
Upstream router (example: 192.168.1.1)
  │ LAN port
  │
Pi eth0 → WAN (DHCP client, receives 192.168.1.x)
Pi Wi-Fi → LAN / br-lan (example: 192.168.8.1)
  │
Phones and computers (receive 192.168.8.x)

This creates a second routed network, but keeps WAN and LAN roles explicit, makes troubleshooting predictable, and ensures Wi-Fi client traffic passes through the Pi.

Older guides often place Pi LAN directly in the upstream subnet while leaving two DHCP servers active on the same layer-2 network. That can randomly change client addresses, gateways, and DNS. This guide does not recommend that design.

Pre-change checks

1. Leave OpenClash disabled for now.
2. Confirm that LuCI still opens.
3. Generate a configuration archive under System -> Backup / Flash Firmware.
4. Record the upstream LAN subnet, such as 192.168.1.0/24.

Pi LAN must use a different subnet. This guide uses 192.168.8.0/24; choose another private subnet if the upstream router already uses it.

Step 1: Prepare Pi Wi-Fi

Go to Network -> Wireless:

1. Enable a wireless network.
2. Select Access Point mode.
3. Set the SSID and WPA2/WPA3 password.
4. Bind Network only to lan, not wan.

Confirm that the computer can join this Wi-Fi. The next steps move physical port eth0 from LAN to WAN, so the current wired management connection will drop.

Step 2: Give LAN a separate subnet

Open Network -> Interfaces -> LAN -> Edit:

Keep the LAN DHCP server enabled. The common start value 100 and limit 150 are fine.

After Save & Apply, the old 192.168.1.1 address stops working:

1. Join Pi Wi-Fi.
2. Disconnect and reconnect once to renew the client address.
3. Open http://192.168.8.1.

If it does not open, first confirm that the computer received a 192.168.8.x address. Do not change WAN yet.

Step 3: Remove eth0 from br-lan

Go to Network -> Interfaces -> Devices, find br-lan, and configure it:

1. Remove eth0 from Bridge ports.
2. Keep the br-lan device.
3. Enable Bring up empty bridge when the option is available.

Wireless APs attached to lan are carried by br-lan even without a wired bridge port. Do not leave eth0 in br-lan while also using it for WAN.

Step 4: Create WAN

Open Network -> Interfaces -> Add new interface:

Save and apply, then connect Pi Ethernet to a LAN port on the upstream router.

WAN should automatically receive an upstream address such as 192.168.1.23, along with a default gateway and DNS.

Step 5: Confirm firewall direction

Under Network -> Firewall, confirm:

• the lan zone contains LAN
• the wan zone contains WAN
• lan -> wan forwarding is allowed
• masquerading is enabled for wan

Do not allow unrestricted wan -> lan forwarding.

Step 6: Verify in order

On the Pi

ip addr show dev eth0
ip route show
ping -c 3 1.1.1.1
nslookup openwrt.org

On a client

After joining Pi Wi-Fi, confirm that:

1. the client address is 192.168.8.x
2. gateway and DNS point to 192.168.8.1
3. http://192.168.8.1 opens
4. a regular website opens

Only after all four pass is the base network complete. Return to the quick start package-manager check.

Common problems

WAN receives no address

Check in this order:

1. Ethernet connects to an upstream LAN port
2. Upstream DHCP is enabled
3. WAN uses eth0
4. eth0 is no longer in br-lan

The Pi is online but Wi-Fi clients are not

Check:

1. LAN DHCP is enabled
2. wireless is attached to lan
3. WAN belongs to the wan firewall zone
4. lan -> wan forwarding is allowed
5. WAN masquerading is enabled

Raw IP works but domains fail

This is a DNS problem. Do not redesign LAN and WAN. Check received DNS and test:

cat /tmp/resolv.conf.d/resolv.conf.auto
nslookup openwrt.org 1.1.1.1

LuCI disconnects after applying changes

That is expected when the management address changes from 192.168.1.1 to 192.168.8.1. Rejoin Pi Wi-Fi and renew the client DHCP lease.

When not to use this path

• Pi must enter PPPoE credentials directly: use PPPoE
• Wired LAN clients are required: add a USB Ethernet adapter or VLAN-capable switch
• Pi is only a plain AP and does not need to route all client traffic: a bridge AP is possible, but it is outside this proxy-gateway path