The central network configuration is located in the file /etc/config/network. This configuration file is responsible for defining switch VLANs, interface configurations and network routes. After editing and saving /etc/config/network you need to execute

/etc/init.d/network reload

• https://dev.openwrt.org/browser/branches/attitude_adjustment/package/base-files/files/etc/config/network
• https://dev.openwrt.org/browser/trunk/package/base-files/files/etc/config/network

Feel free to inform yourself about netifd (Network Interface Daemon).

Below is an overview of the section types that may be defined in the network configuration. A minimal network configuration for a router usually consists of at least two interfaces (lan and wan) and a switch section if applicable.

The globals section is available in Barrier Breaker and later releases.

The globals section contains interface-independent options affecting the network configuration in general.

The switch section is responsible for partitioning the switch into several VLANs which appear as independent interfaces in the system although they share the same hardware. Not every OpenWrt supported device (or architecture, like x86) has a programmable switch, therefore this section might not be present on some platforms. Please also note, that some switches only support 4Bit-VLANs.

There are currently two different configuration formats in use, one for the legacy /proc/switch/ API and one for the newer swconfig-based switch configuration.

This variant is actually only found on Broadcom devices like the WRT54GL.

A typical configuration for it looks like this:

config 'switch' 'eth0'
        option 'vlan0' '0 1 2 3 5*'
        option 'vlan1' '4 5'

The eth0 identifier specifies the switch the section is belonging to. VLANs are defined by vlan# options with # being the VLAN number. For further information refer to the switch documentation.

The newer swconfig-framework is intended to replace the legacy switch configuration.

Configuration for swconfig have a slightly different structure with one extra section per VLAN. The example below shows a typical configuration:

config 'switch' 'eth0'
        option 'reset' '1'
        option 'enable_vlan' '1'

config 'switch_vlan' 'eth0_1'
        option 'device' 'eth0'
        option 'vlan' '1'
        option 'ports' '0 1 2 3 5t'

config 'switch_vlan' 'eth0_2'
        option 'device' 'eth0'
        option 'vlan' '2'
        option 'ports' '4 5t'

Common properties are defined within the switch section; vlan specific properties are located in additional switch_vlan sections linked to the switch section through the device option. The complete layout is explained in the switch documentation.

Sections of the type interface declare logical networks serving as containers for IP address settings, aliases, routes, physical interface names and firewall rules - they play a central role within the OpenWrt configuration concept.

A minimal interface declaration consists of the following lines:

config 'interface' 'wan'
        option 'proto' 'dhcp'
        option 'ifname' 'eth0.1'

• wan is a unique logical interface name
• dhcp specifies the interface protocol, DHCP in this example
• eth0.1 is the physical interface associated with this section

The system limits the physical interface name length to 15 characters including the automatically added prefix that is added for some protocols (e.g. "6in4-", "pppoa-", "pppoe-") or due to bridge status ("br-"). Depending on the protocol type, the logical interface name may thus be limited to only 9 characters. E.g. 'abcde67890' is a valid interface name for a normal interface using dhcp, but not for a pppoe interface where the final name would be 'pppoe-abcde67890', which is >15 chars. Using a too long name may lead into errors, as some of the settings in network, firewall or dhcp config may be left unapplied.

The interface protocol may be one of the following:

Depending on the used interface protocol several other options may be required for a complete interface declaration. The corresponding options for each protocol are listed below. Options marked as "yes" in the "Required" column must be defined in the interface section if the corresponding protocol is used, options marked as "no" may be defined but can be omitted as well.

In openwrt 12.09, if an interface section has no protocol defined (not even none ), the other settings are completely ignored. The result is that, if the interface section is mentioning a physical network interface (i.e. eth0), this will be down even if a cable is connected (with proto 'none' the interface is up). (could be that more testing is needed)

Note: To automatically configure 6rd from dhcp you need to create an interface with option auto 0 and put its name as the 'iface6rd' parameter. In addition you also need to add its name to a suitable firewall zone in /etc/config/firewall.

These parameters are handled partially by netifd (in interface.c) and partially by a shell script in lib/netifd/proto/dhcp.sh.

It seems that if an interface is configured as dhcp client, at least on OpenWrt 10.03, the default route received by dhcp will be the only one listed and will remove other default route/metrics defined for other interfaces if those interfaces comes "before" the interface with dhcp in terms of "ifname" values. For example:

config interface wan
    option ifname eth0
    option proto static
    ..other options..
    
config interface wan2
    option ifname eth1
    option proto dhcp
    ..other options..

config interface wan
    option ifname eth0
    option proto dhcp
    ..other options..
    
config interface wan2
    option ifname eth1
    option proto static
    ..other options..

The package odhcp6c must be installed to use dhcpv6.

Note: To automatically configure ds-lite from dhcpv6 you need to create an interface with option auto 0 and put its name as the 'iface_dslite' parameter. In addition you also need to add its name to a suitable firewall zone in /etc/config/firewall.

The package ppp must be installed to use PPP.

The packages ppp, kmod-pppoe and ppp-mod-pppoe must be installed to use PPPoE.

opkg update
opkg install ppp kmod-pppoe ppp-mod-pppoe

The package ppp-mod-pppoa must be installed to use PPPoA.

The package comgt must be installed to use 3G. Check 3gdongle for further help with that.

The package uqmi must be installed to use QMI.

The package comgt-ncm + modem specific driver must be installed to use NCM.

The package wwan must be installed to use this feature. The "wwan" protocol detects the right protocol (3G/QMI/NCM/MBIM) for the USB Modem model and passes the configuration to the protocol.

The package hnet-full must be installed to use hnet. We recommend you install ipset before installing hnet-full See https://tools.ietf.org/html/rfc7788 for details.

The package pptp must be installed to use PPtP. There is a separate Howto for this: vpn.client.pptp. You need to have another section to configure the "parent" device, and you might need to add "<vpn>" to your "wan" zone in the firewall (<vpn> being the "logical interface name" of this section).

The package 6in4 must be installed to use this protocol.

Note: This protocol type does not need an ifname option set in the interface section. The interface name is derived from the section name, e.g. config interface sixbone would result in an interface named 6in4-sixbone.

Note: HE.net has introduced updatekey as default for new tunnels in February 2014. Support added to Openwrt trunk by r39646.

Note: as of r41358 username, password and updatekey are all plaintext entries.

Note: although ip6prefix isn't required, sourcerouting, enabled by default, will prevent forwarding of packets unless ip6prefix is specified.

The package aiccu must be installed to use this protocol. This utility is not meant to be operated in a headless mode. Do not use it if you have some other option. Only AYIYA tunnel type has been tested. For static or heartbeat tunnels, use native 6in4 tunnel instead, perhaps with the he.net Tunnel Broker.

This protocol is available for Barrier Breaker and newer versions only.

Note: This protocol type does not need an ifname option set in the interface section. The interface name is derived from the section name, e.g. config interface sixbone would result in an interface named aiccu-sixbone.

The package 6to4 must be installed to use this protocol.

Note: This protocol type does not need an ifname option set in the interface section. The interface name is derived from the section name, e.g. config interface wan6 would result in an interface named 6to4-wan6.
Note: If radvd is installed and enabled, the 6to4 scripts will add a temporary prefix and interface declaration to the radvd uci configuration and perform a daemon restart if required. (deprecated)

The package 6rd must be installed to use this protocol.

The needed tunnel values are usually obtained via the DHCPv4 request for the WAN interface. Try that first. Below is only needed for hardcoding the tunnel.

Note: This protocol type does not need an ifname option set in the interface section. The interface name is derived from the section name, e.g. config interface wan6 would result in an interface named 6rd-wan6.

Note: Some ISP's give you the number of bytes you should use from your WAN IP to calculate your IPv6 address. ip4prefixlen expects the prefix bytes of your WAN IP to calculate the IPv6 address. So if your ISP gives you 14 bytes to calculate, enter 18 (32 - 14).

The package ds-lite must be installed to use this protocol.

ds-lite operation requires that IPv4 NAT is disabled. You should adjust your settings in /etc/config/firewall accordingly.

Note: This protocol type does not need an ifname option set in the interface section. The interface name is derived from the section name, e.g. config interface wan would result in an interface named dslite-wan.

The package xl2tpd must be installed to use this protocol.

Most options are similar to protocol "ppp".

The name of the physical interface will be "l2tp-<logical interface name>".

The package relayd must be installed to use this protocol.

The package gre must be installed to use GRE. Additionally, you need kmod-gre and/or kmod-gre6.

GRE support has been introduced in Barrier Breaker. Four protocols are defined: "gre", "gretap", "grev6", and "grev6tap". The name of the GRE interface will be gre-<logical interface name> for "gre" and "gretap", and grev6-<logical interface name> for "grev6" and "grev6tap".

All four protocols accept the following common options:

The following options are supported, in addition to all common options above:

The following options are supported, in addition to all common options above:

The following options are supported, in addition to all common options above:

The following options are supported, in addition to all common options above:

VTI Tunnels are IPsec policies with a fwmark set. The traffic is redirected to the matching VTI interface.

The following options are supported, in addition to all common options above:

A minimal device declaration consists of the following lines:

config device 'eth0.106'
	option type '8021q'
	option name 'eth0.106'
	option ifname 'eth0'
	option vid '106'

VLAN Interfaces may be configured also. If not, they are created on the fly by netifd. Defining VLANs gives more options. The following options are supported:

MAC address option is send upstream but not merged at time of writng.

The package br2684ctl must be installed to use Ethernet over AAL5.

ATM bridges use a special config section called atm-bridge. Each atm-bridge section maps the specified ATM curcuit an atm# pseudo ethernet device which can be used for example in conjunction with pppoe to establish a DSL connection to the ISP.

A typical bridge section looks like this:

config atm-bridge
       option unit     '0'
       option vpi      '8'
       option vci      '35'

• Unit 0 will let br2684ctl create a nas0 pseudo device
• VPI 8 and VCI 35 specifies the circuit to bridge. Those values are ISP dependant.

The atm-bridge section allows the following options:

This currently only works on devices based on lantiq SoCs.

(V)DSL uses a special config section called dsl, which typically looks like this:

config vdsl 'dsl'
        option annex 'b'
        option firmware '/lib/firmware/vdsl.bin'
        option tone 'bv'
        option xfer_mode 'atm'

The dsl section allows the following options:

Name	Type	Required	Default	Description
annex	string	yes	b	Specifies the Annex setting (ISP/line dependent). Supported values on lantiq AMAZON and DANUBE devices: b, bdmt, b2, b2p, a, at1, alite, admt, a2, a2p, l, m, m2, m2p Supported values on lantiq ARX100 "AR9" and VRX200 "VR9" devices: a, b, j
firmware	string	yes	/lib/firmware/vdsl.bin	The path to the modem's firmware image Only supported by devices with lantiq SoC. See the xDSL firmware section below for more information
tone	string	yes	bv	The tone mode (ISP/line dependent). Supported values: a = A43, av = A43 + V43, b = B43, bv = B43 + V43 Only supported by devices with ARX100 "AR9" and VRX200 "VR9" lantiq SoC. This configuration was removed in "Designated Driver" as the driver now auto-detects the correct value
xfer_mode	string	yes	atm	The transfer mode. Supported values are: atm = Asynchronous Transfer Mode (often used for ADSL connections), ptm = Packet Transfer Mode (often used for VDSL connections) Only supported by devices with ARX100 "AR9" and VRX200 "VR9" lantiq SoC.

Starting with r47631 and r47650 (lantiq: add dsl-vr9-firmware-xdsl / lantiq: add dsl-vrx200-firmware-xdsl-b: add Annex B version of VRX200 DSL firmware) there are redistributable versions of the xDSL firmware available as OpenWrt packages:

• dsl-vrx200-firmware-xdsl-a
• dsl-vrx200-firmware-xdsl-b

A list (incomplete) of other firmware versions, including those with vectoring support, can be found here: https://xdarklight.github.io/lantiq-xdsl-firmware-info/

The "config alias" approach is deprecated. it used to be needed when multiple interfaces sharing the same device where not supported. JoW

Alias sections can be used to define further IPv4 and IPv6 addresses for interfaces. They also allow combinations like DHCP on the main interface and a static IPv6 address in the alias, for example to deploy IPv6 on wan while keeping normal internet connectivity. Each interface can have multiple aliases attached to it.

A minimal alias declaration consists of the following lines:

config 'alias'
        option 'interface' 'lan'
        option 'proto' 'static'
        option 'ipaddr' '10.0.0.1'
        option 'netmask' '255.255.255.0'

• lan is the logical interface name of the parent interface
• static is the alias interface protocol
• 10.0.0.1 specifies the alias ip address
• 255.255.255.0 specifies the alias netmask

At the time of writing, only the static protocol type is allowed for aliases. Defined options for alias sections are listed below.

To list IP addresses associated with devices, you can run ifconfig, but that command will show only first IP address per device. However it will show alias device if you provided name (label) for it. The error proof method to list all IP addresses is:

ip addr

This "old" way works, at least, for OpenWrt 10.03.1 and 12.09.

Basically create an 'interface' section per IP, but alias interfaces may NOT be of type bridge

• For non-bridged interfaces (physdev , that is physical interfaces) the ifname is the <interface-of-network-for-same-phydev>
• For cases where the interface is bridged the ifname is br-base-interface, where base-interface is the name of the primary IP's config section (e.g. for a the default lan interface config, the first alias would use ifname br-lan).

A minimal alias definition for a bridged interface might be (for a scenario without vlans):

config interface lan
        option 'ifname' 'eth0'
        option 'type' 'bridge'
        option 'proto' 'static'
        option 'ipaddr' '192.168.1.1'
        option 'netmask' '255.255.255.0'

config interface lan2
       option 'ifname' 'br-lan'
       option 'proto' 'static'
       option 'ipaddr' '10.0.0.1'
       option 'netmask' '255.255.255.0'

or for a non-bridge interface

config interface lan
        option 'ifname' 'eth0'
        option 'proto' 'static'
        option 'ipaddr' '192.168.1.1'
        option 'netmask' '255.255.255.0'

config interface lan2
       option 'ifname' 'eth0'
       option 'proto' 'static'
       option 'ipaddr' '10.0.0.1'
       option 'netmask' '255.255.255.0'

To see a list of interfaces you can do ubus list network.interface.* and to view the ip of a particular interface (the UCI name not the physical interface), do ifstatus <interface> (e.g. ifstatus lan2).

Does not work on OpenWRT 10.03.x .

On openwrt 12.09, a lan interface that is first defined as dhcp interface and then has aliases with static ip address could cause problems in routing the lan traffic through the wan zone using the basic lan-wan forwarding provided by openwrt. A solution is: having the basic interface with static address and aliases with dhcp protocol.

Another note is related to 'how to refer to the ifname of an interface'. Normally the ifname is br-wan if the interface wan is bridged, else is ifname <nic_device> . Another way to avoid to list always the same device is using ifname @interface. In this way, even if the wan interface is not a bridge, one can refer to the physical device used by the wan interface indirectly.

Static IPv4 routes can be defined on specific interfaces using route sections. As for aliases, multiple sections can be attached to an interface.

A minimal example looks like this:

config 'route' 'name_your_route'
        option 'interface' 'lan'
        option 'target' '172.16.123.0'
        option 'netmask' '255.255.255.0'
        option 'gateway' '172.16.123.100'

• lan is the logical interface name of the parent interface
• 172.16.123.0 is the network address of the route
• 255.255.255.0 specifies the route netmask

Legal options for IPv4 routes are:

To disable a route quickly, the option enabled is not available. Just rewrite the route config section as disabled_route like:

config 'disabled_route' 'name_your_route'
        ...lines...

It seems that on openwrt 12.09 if a route is defined using a gateway in an address space where a gateway is already defined, it will be not added. Like the lan has the gateway 192.168.1.1 and we want to go to 1.2.3.4 over the gateway 192.168.1.5 within the interface lan, it will not be added. Could be added through ip route commands tough.

IPv6 routes can be specified as well by defining one or more route6 sections.

A minimal example looks like this:

config 'route6'
        option 'interface' 'lan'
        option 'target' '2001:0DB8:100:F00:BA3::1/64'
        option 'gateway' '2001:0DB8:99::1'

• lan is the logical interface name of the parent interface
• 2001:0DB8:100:F00:BA3::1/64 is the routed IPv6 subnet in CIDR notation
• 2001:0DB8:99::1 specifies the IPv6 gateway for this route

Legal options for IPv6 routes are:

Since OpenWrt Barrier Breaker, netifd supports IP rule declarations which are required to implement policy routing.
IPv4 rules can be defined by declaring one or more sections of type rule, IPv6 rules are denoted by sections of type rule6. Both types share the same set of defined options.

A simple IPv4 rule may look like:

config rule
	option mark   '0xFF'
        option in     'lan'
	option dest   '172.16.0.0/16'
	option lookup '100'

• 0xFF is a fwmark to be matched
• lan is the incoming logical interface name
• 172.16.0.0/16 is the destination subnet to match
• 100 is the routing table ID to use for the matched traffic

Similary, an IPv6 rule looks like:

config rule6
        option in     'vpn'
	option dest   'fdca:1234::/64'
	option action 'prohibit'

• vpn is the incoming logical interface name
• fdca:1234::/64 is the destination subnet to match
• prohibit is a routing action to take

The options below are defined for IP rule (rule and rule6) sections:

Below are a few examples for special, non-standard interface configurations.

config 'interface' 'example'
        option 'type'    'bridge'
        option 'proto'   'none'
        option 'ifname'  'eth0 eth1'
        option 'auto'    '1'

config 'interface' 'example'
        option 'proto'   'dhcp'
        option 'ifname'  'eth0'
        option 'defaultroute' '0'

Older versions of OpenWRT used this instead, but this method is deprecated and no longer works in Chaos Calmer:

config 'interface' 'example'
        option 'proto'   'dhcp'
        option 'ifname'  'eth0'
        option 'gateway' '0.0.0.0'

config 'interface' 'example'
        option 'proto'     'dhcp'
        option 'ifname'    'eth0'

config 'alias'
        option 'interface' 'example'
        option 'proto'     'static'
        option 'ip6addr'   '2001:0DB8:100:F00:BA3::1'

config 'interface' 'example'
        option 'proto'     'static'
        option 'ifname'    'eth0'
        option 'ipaddr'    '192.168.1.200'
        option 'netmask'   '255.255.255.0'
        list   'dns'       '192.168.1.1'
        list   'dns'       '192.168.10.1'
        # the priority is: the last dns listed will be the first one
        # to be chosen for the name resolution.

Openwrt will use the new dns configured only after a reboot or a /etc/init.d/dnsmasq restart.

config 'interface' 'example'
        option 'proto'     'static'
        option 'ifname'    'eth0'
        option 'ipaddr'    '192.168.1.200'
        option 'netmask'   '255.255.255.0'
        option 'dns'       '192.168.1.1'

config 'route'
        option 'interface' 'example'
        option 'target'    '0.0.0.0'
        option 'netmask'   '0.0.0.0'
        option 'gateway'   '192.168.1.1'
        option 'metric'    '100'

config 'interface' 'wan'
        option 'proto'     'pppoe'
        option 'ifname'    'eth1'
        option 'username'  'user'
        option 'password'  'pass'
        option 'timeout'   '10'

config 'interface' 'vpn'
        option 'proto'     'pptp'
        option 'ifname'    'vpn'
        option 'username'  'vpnuser'
        option 'password'  'vpnpass'
        option 'server'    'vpn.example.org'

Additionally the "wan" firewall zone must include both interfaces in /etc/config/firewall:

config 'zone'
        option 'name'      'wan'
        option 'network'   'wan vpn'  # Important
        option 'input'     'REJECT'
        option 'forward'   'REJECT'
        option 'output'    'ACCEPT'
        option 'masq'      '1'

config adsl-device 'adsl'
        option fwannex 'a'
        option annex 'a'

config interface 'wan'
        option proto 'pppoa'
        option username 'jbloggs@plusdsl.net'
        option password 'XXXXXXXXX'
        option vpi '0'
        option vci '38'
        option encaps 'vc'

For example, a vpn interface is normally "tun0". To list it in the uci config files (and therefore in luci):

config interface 'tun0'
        option ifname 'tun0'
        option proto 'none'

The example below illustrates a static tunnel configuration in /etc/config/network file for the Hurricane Electric (he.net) broker. Option ipaddr specifies the local IPv4 address, peeraddr is the broker IPv4 address and ip6addr the local IPv6 address routed via the tunnel.

config 'interface' 'henet'
        option 'proto'     '6in4'
        option 'ipaddr'    '178.24.115.19'
        option 'peeraddr'  '216.66.80.30'
        option 'ip6addr'   '2001:0DB8:1f0a:1359::2/64'

You should also add an address from your routed IPv6 network to the "lan" interface.

To apply IPv6 firewall rules to the tunnel interface, add it to the "wan" zone in /etc/config/firewall:

config 'zone'
        option 'name'      'wan'
        option 'network'   'wan henet'  # Important
        option 'input'     'REJECT'
        option 'forward'   'REJECT'
        option 'output'    'ACCEPT'
        option 'masq'      '1'

If you define a new, dedicated zone just for the tunnel interface, make sure to set option conntrack 1 in order to force enabling connection tracking, otherwise unidirectional forwarding rules will not work.

Don't forget to set up forwarding rules between the LAN and the tunnel if you want to route IPv6 traffic between them.

If your public IP, e.g. 178.24.115.19, is not matching the IP address on your WAN interface, your ISP is probably using one-to-one NAT (aka full-cone NAT) and you won't be able to establish static IPv6-in-IPv4 tunnel. IP address of your WAN interface can be obtained with the following command:

• Backfire

  uci -P/var/state get network.wan.ipaddr

• Trunk/Attitude Adjustment

  . /lib/functions/network.sh; network_get_ipaddr ip wan; echo $ip

If this is your case you should fill the WAN IP address into ipaddr option instead of your actual public IP that might have been provided to Hurricane Electric during tunnel creation.¹⁾ Or you may completely omit the optional ipaddr option and let auto configuration to handle the correct IP. ( Auto configuration is vague. Is uci handling this case?) That would be preferred solution if your WAN IP is dynamic (i.e. obtained via DHCP) or you are not sure. Example of /etc/config/network entry:

config 'interface' 'henet'
        option 'proto'     '6in4'
        option 'peeraddr'  '216.66.80.30'
        option 'ip6addr'   '2001:0DB8:1f0a:1359::2/64'

Note: you could probably try to define alias for WAN interface with your public IP address. Then you could use your public IP in ipaddr option and system would find its way to your WAN interface that has only private IP address because of the one-to-one NAT. ( However, it didn't really worked for me. I got this advice on IRC and it looks reasonable, thats why I put it here anyway. If it was not supposed to fix it, just delete this note.)

The example below illustrates a dynamic tunnel configuration for the Hurricane Electric (he.net) broker with enabled IP update. The local IPv4 address is automatically determined and tunnelid, username and password are provided for IP update.

config 'interface' 'henet'
        option 'proto'     '6in4'
        option 'peeraddr'  '216.66.80.30'
        option 'ip6addr'   '2001:0DB8:1f0a:1359::2/64'
        option 'tunnelid'  '12345'
        option 'username'  'myusername'
        option 'password'  '098f6bcd4621d373cade4e832627b4f6'

You should also add an address from your routed IPv6 network to the "lan" interface.

To apply IPv6 firewall rules to the tunnel interface, add it to the "wan" firewall zone, see example above for details.

The password entered above should be the md5sum of the password you use to log in to tunnelbroker.net.

This example establishes a Pseudowire Tunnel and bridges it to the LAN ports. The existing lan interface is reused with protocol l2tp instead of static.

config 'interface' 'lan'
        option 'proto'     'l2tp'
        option 'type'      'bridge'
        option 'ifname'    'eth0'
        option 'ipaddr'    '192.168.1.1'
        option 'netmask'   '255.255.255.0'
        option 'localaddr' '178.24.154.19'
        option 'peeraddr'  '89.44.33.61'
        option 'encap'     'udp'
        option 'sport'     '4000'
        option 'dport'     '5410'

This example sets up a relayd pseudo bridge between a wireless client network and LAN, so that it works similarly to the Broadcom Bridged Client mode.

Wireless configuration (excerpt):

config wifi-iface
        option 'device'     'radio0'
        option 'mode'       'sta'
        option 'ssid'       'Some Wireless Network'
        option 'encryption' 'psk2'
        option 'key'        '12345678'
        option 'network'    'wwan'

Network configuration (excerpt):
Note that the LAN subnet must be different from the one used by wireless network's DHCP.

config 'interface' 'lan'
        option 'ifname'     'eth0.1'
        option 'proto'      'static'
        option 'ipaddr'     '192.168.1.1'
        option 'netmask'    '255.255.255.0'

config 'interface' 'wwan'
        option 'proto'      'dhcp'

config 'interface' 'stabridge'
        option 'proto'      'relay'
        option 'network'    'lan wwan'

In contrast to true bridging, traffic forwarded in this manner is affected by firewall rules, therefore both the wireless client network and the lan network should be covered by the same LAN firewall zone with forward policy set to accept to allow traffic flow between both interfaces:

config 'zone'
        option 'name'        'lan'
        option 'network'     'lan wwan'  # Important
        option 'input'       'ACCEPT'
        option 'forward'     'ACCEPT'    # Important
        option 'output'      'ACCEPT'

Create a GRE tunnel with static address 10.42.0.253/30, adding it to an existing firewall zone called tunnels:

config interface mytunnel                 
        option proto    gre            
        option zone     tunnels                                
        option peeraddr 198.51.100.42           
                                                            
config interface mytunnel_addr                                                      
        option proto    static                                     
        option ifname   @mytunnel                             
        option ipaddr   10.42.0.253                       
        option netmask  255.255.255.252                     
        # Fixes IPv6 multicast (long-standing bug in kernel).
        # Useful if you run Babel or OSPFv3.
        option ip6addr  'fe80::42/64'

The complete network configuration can be re-applied by running /etc/init.d/network restart. Individual interfaces can be brought up with ifup name or down with ifdown name where name corresponds to the logical interface name of the corresponding config interface section. An ifup implies a prior ifdown so there is no need to invoke both when reloading an interface.

Note that wireless interfaces are managed externally and ifup may break the relation to existing bridges. In such a case it is required to run wifi up after ifup in order to re-establish the bridge connection.

In order to derive a Linux interface name like eth1 from a logical network name like wan for use in scripts or tools like ifconfig and route the uci utility can be used as illustrated in the example below which opens port 22 on the interface.

WANIF=$(uci -P/var/state get network.wan.ifname)
iptables -I INPUT -i $WANIF -p tcp --dport 22 -j ACCEPT

The uci state vars are deprecated and not used anymore for network related information Quoting jow in the forum.
Use /lib/functions/network.sh:

source /lib/functions/network.sh
 
if network_get_ipaddr addr "wan"; then
    echo "IP is $addr"
fi

Assigning multiple ip addresses to the same interface:

config interface foo
  option ifname eth1
  list ipaddr 10.8.0.1/24
  list ipaddr 10.9.0.1/24
  list ip6addr fdca:abcd::1/64
  list ip6addr fdca:cdef::1/64

config interface foo
  option ifname eth1
  option ipaddr 10.8.0.1
  option netmask 255.255.255.0
  option ip6addr fdca:abcd::1/64

config interface foo2
  option ifname eth1
  option ipaddr 10.9.0.1
  option netmask 255.255.255.0
  option ip6addr fdca:cdef::1/64