I have created two other LANs, so I have three total Lets call them LAN1, LAN2 and LAN3. I would like to allow certain traffic between the LAN1 and LAN2 and LAN1 and LAN3. But none between LAN2 and LAN3.
How do I do this?
Typically the issue lies in the firewall (did you set up forward statements from each lan to the others?)
But without seeing your config, we cannot say for sure.
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):
Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall
Being honest, I don't know where to start.
I can't figure out how to allow traffic to say LAN2 with out allow the same traffic to LAN3. Under port forward both the source and destination zones have all three and I cannot deselect any of them.
How did you create the additional networks?
Looking at your config will allow us to point you in the right direction. Please post what was requested earlier.
Since this output reveals the names of my networks, LAN1 I referenced above is the BR_LAN, LAN2 is WoodStock and LAN3 is DNS_Servers
LAN2 or WoodStock is my guest network, I have three routers on this LAN I use as WAPs I want to be able to access from the BR_LAN
LAN3 is DNS_Servers, I have two Pi-Hole DNS servers, I want to allow all relevant traffic between BR_LAN and DNS_Servers, IE 53, 80, 443
I created the interfaces by going to Network --> Interfaces and clicking "Add new interface"
root@IFW:~# ubus call system board
{
"kernel": "6.12.74",
"hostname": "IFW",
"system": "Intel(R) Core(TM) i3-8100T CPU @ 3.10GHz",
"model": "LENOVO 10RRS3DT00",
"board_name": "lenovo-10rrs3dt00",
"rootfs_type": "ext4",
"release": {
"distribution": "OpenWrt",
"version": "25.12.2",
"firmware_url": "https://downloads.openwrt.org/",
"revision": "r32802-f505120278",
"target": "x86/64",
"description": "OpenWrt 25.12.2 r32802-f505120278",
"builddate": "1774469393"
}
}
root@IFW:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fdef:b53d:a189::/48'
option packet_steering '1'
option dhcp_default_duid '00042890ac9d8b36405385522218d5b0b757'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.107.1'
option netmask '255.255.255.0'
option ip6assign '60'
option gateway '10.0.17.2'
config interface 'wan'
option device 'eth3'
option proto 'static'
option ipaddr '10.78.239.2'
option gateway '10.78.239.1'
option broadcast '10.78.239.255'
option netmask '255.255.255.0'
list dns '8.8.8.8'
list dns '8.8.4.4'
config interface 'wan6'
option device 'eth3'
option proto 'dhcpv6'
option reqaddress 'try'
option reqprefix 'auto'
option norelease '1'
config interface 'WoodStock'
option proto 'static'
option device 'eth4'
option ipaddr '192.168.214.1'
option netmask '255.255.255.0'
option multipath 'off'
config interface 'DNS_Servers'
option proto 'static'
option device 'eth2'
option ipaddr '10.168.107.1'
option multipath 'off'
option netmask '255.255.255.0'
root@IFW:~# cat /etc/config/wireless
cat: can't open '/etc/config/wireless': No such file or directory
root@IFW:~# cat /etc/config/dhcp
config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
option filter_aaaa '0'
option filter_a '0'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'
option ignore '1'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
option start '100'
option limit '150'
option leasetime '12h'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/odhcpd.leases'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
option piodir '/tmp/odhcpd-piodir'
option hostsdir '/tmp/hosts'
config dhcp 'WoodStock'
option interface 'WoodStock'
option start '100'
option limit '150'
option leasetime '12h'
This doesn’t appear to be the main router. Can you provide a topology diagram (or detailed description).
You also neglected to post the firewall.
Apologies I copied the commands you provide and did not realize, I needed/didn't press enter to get the firewall
oot@IFW:~# cat /etc/config/firewall
config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
list network 'WoodStock'
list network 'DNS_Servers'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
option masq '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
option enabled '0'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config redirect
option dest 'lan'
option target 'DNAT'
option name 'HTTPS'
option src 'wan'
option src_dport '443'
option dest_ip '192.168.107.10'
config ipset
option name 'Snoopy/Woodstock'
option family 'ipv4'
list match 'ip'
list entry '192.168.107.90'
list entry '192.168.107.91'
list entry '192.168.214.1'
list entry '192.168.214.2'
list entry '192.168.214.3'
config redirect
option dest 'lan'
option target 'DNAT'
option src 'wan'
option src_dport '80'
option dest_ip '192.168.107.10'
option dest_port '80'
option name 'HTTP'
config redirect
option dest 'lan'
option target 'DNAT'
option name 'PVR'
option src 'wan'
option src_dport '8096'
option dest_ip '192.168.107.93'
option family 'ipv4'
option dest_port '8096'
config redirect
option dest 'lan'
option target 'DNAT'
option name 'SMTP'
option src 'wan'
option src_dport '25'
option dest_ip '192.168.107.10'
option dest_port '25'
root@IFW:~#
No, OpenWRT is not my only Firewall, I also use OPNSense to sent up a DMZ. This the diagram of my network, The best I can do at the moment. Sometimes it is not very easy to get Visio to do what you want it to do. Hopefully it makes since
Ok. So this network is quite a bit more complex than originally anticipated.
It is necessary for you to elaborate with network names (if you consider those to be sensitive information, just use lan-x where x is a number or letter).
For example:
- lan-A 10.78.239.0/24 can access lan-b, not lan-c.
- lan-B x.y.z.0/24 can access…
- …
Also - is there any specific reason that you are using 2 routers in this network? Both opnsense and openwrt can support VLANs and all the firewall capabilities needed here, so consolidating to a single router would be a valid (and possibly easier) approach.
BR_LAN (Network address 192.168.107.0) is my main network.
WoodStock (Network address 192.168.214.0) is my guest network where I have three routers I use as WAPs. I want to be able to access these from BR_LAN, so I need to be able to access port 80 on all three devices. but want no traffic from this network to access any other LAN. Devices on this network will not use the Pi-Hole DNS servers.
DNS_Servers (Network address 10.168.107.0) I have two Pi-Hole DNS servers that I want to be able to access from BR_LAN. So I need to be able to access ports 53, 80, and 443.
My two domain controllers will quarry the PI-hole DNS servers, which will then quarry my Ubound servers.
Why are the APs on the guest network? Typically you want the infrastructure devices on a trusted network.
Do the APs run openWrt or another VLAN-aware firmware?
The drawing attached is not my entire network
WoodStock is my GUEST network, not my main network. My main Network has its own WAPS.
A VLAN-aware AP (or multiple units) is typically the best approach here.
- You can have a single AP broadcasting multiple SSIDs (each SSID tied to its own network/VLAN).
- Properly placed, this method provides all the necessary SSIDs in a given area while also reducing RF noise/interference/congestion relative to having multiple AP devices each broadcasting one SSID.
- This also reduces the attack surface -- each infrastructure device (switches, APs, etc.) will be managed on a trusted/management network, and will have no address on the other network(s). This means that untrusted networks cannot gain access to the network infrastructure (unless you've got mistakes in your upstream firewall).
- You also gain efficiencies in managing the devices -- fewer hardware devices to manage and it becomes much more straightforward on a per-device basis.
- VLANs also have benefits in that you need with fewer switches and routers since the hardware can safely serve multiple network segments.
I'd highly recommend that you consider re-architecting your network topology for all of the above reasons. What you have appears to be sub-optimal in many ways.