Accessing OpenWrt via WAN IP Address | Generated by AI

Home 2026.03

Question: For an OpenWrt router connected to a main home router, can a computer connected to the OpenWrt router access the OpenWrt’s WAN IP address to log in to it (e.g., LuCI web interface)? I tried but it didn’t work—could this be a firewall issue?

Answer:

No, this is usually not possible by default in a typical OpenWrt setup, and it’s not primarily a firewall issue in the most common case.

Here’s why it fails and what you can do:

Typical Home Setup (Most Common Reason It Fails)

When your computer tries to reach the OpenWrt WAN IP (192.168.1.50):

This is normal Linux routing behavior (not specific to OpenWrt). NAT loopback / hairpinning only helps when accessing your own public IP from inside (not private WAN IP).

Solutions (Pick One)

  1. Recommended & Simplest
    Just use the LAN IP of OpenWrt (e.g., http://192.168.2.1 or http://openwrt.lan).
    There’s almost never a good reason to force access via the WAN IP from inside your own network.

  2. If you really want to access via the WAN IP
    • Create a firewall traffic rule to allow input from LAN zone to destination port 80/443 (LuCI) on the router itself.
      Network → Firewall → Traffic Rules → Add
      • Name: Allow LuCI from LAN to WAN IP
      • Protocol: TCP
      • Source zone: lan
      • Destination zone: Device (input)
      • Destination port: 80, 443
      • Action: ACCEPT
    • But this alone usually still fails due to the routing reply issue above.

    To fix the routing/reply path (advanced):

    • Add SNAT/Masquerade rule for traffic destined to the WAN IP coming from LAN
      (or use policy routing + marks — quite complicated for this purpose)
  3. Change OpenWrt to “dumb AP” mode (if you don’t need separate subnet / NAT)
    • Connect main router LAN → OpenWrt LAN port (not WAN)
    • Disable DHCP on OpenWrt
    • Set OpenWrt LAN IP static in same subnet as main router (e.g., 192.168.1.2)
    • Assign WAN interface to LAN firewall zone or remove it
      → Then OpenWrt only has one IP (the LAN one) and you access it normally
  4. Quick firewall test (only if upstream is trusted!)
    Temporarily set WAN zone Input policy to ACCEPT (Network → Firewall → Zones → wan → edit → Input: ACCEPT).
    If it suddenly works → firewall was blocking.
    Warning: Only do this if the “WAN” is actually your trusted home LAN (not real Internet). Revert afterward.

Bottom line
In almost all cases you should simply use the LAN IP of the OpenWrt router from devices connected to it. Trying to reach the WAN IP from its own LAN clients rarely works cleanly without extra configuration, and it’s usually unnecessary.

References:

Back Donate