Can ping WAN router but not beyond

I am trying to setup a multi-wan - I have two ISP LTE routers connected to my OpenWRT router (EdgeRouterX). Main WAN (on eth0) is working fine, but for WANB (on eth4) I cannot ping beyond the ISP router.

# ping -c 1 -I eth0 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: seq=0 ttl=117 time=44.740 ms

--- 8.8.8.8 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 44.740/44.740/44.740 ms
# ping -c 1 -I eth4 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes

--- 8.8.8.8 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss

I can however ping the WANB router itself and I can also kind of connect to its WebUI from LAN (because webpage keeps refreshing).

# ping -c 1 -I eth4 192.168.145.1
PING 192.168.145.1 (192.168.145.1): 56 data bytes
64 bytes from 192.168.145.1: seq=0 ttl=64 time=1.121 ms

--- 192.168.145.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 1.121/1.121/1.121 ms

In my understanding, the problem is almost certainly with the configuration of OpenWRT because of how the traceroute output:

# traceroute -i eth4 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 46 byte packets
 1  192.168.145.2 (192.168.145.2)  3135.483 ms !H  3110.007 ms !H  3110.017 ms !H

Theoretically OpenWRT has connection to WANB but also I doesn't... I absolutely don't understand what's happening here. Both WANs are set up the same and are in the same firewall zone, so I don't know what's the difference and why one doesn't work.

Interestingly, I has very similar issue yesterday with the main WAN (so different ISP router) - I solved it by factory resetting OpenWRT router and changing ip for the default WAN. But for obvious reasons I cannot do that in this case. And I also would like to understand what am I doing wrong.

# cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option packet_steering '1'
	option ula_prefix 'fd29:****:****::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth1'
	list ports 'eth2'
	list ports 'eth3'

config interface 'wan'
	option device 'eth0'
	option proto 'static'
	option ipaddr '192.168.144.2'
	option netmask '255.255.255.248'
	option gateway '192.168.144.1'
	list dns '9.9.9.9'
	list dns '149.112.112.112'
	option metric '10'

config bridge-vlan
	option device 'br-lan'
	option vlan '16'
	list ports 'eth1:t'
	list ports 'eth2:u*'
	list ports 'eth3:u*'

config interface 'secured'
	option proto 'static'
	option device 'br-lan.16'
	option ipaddr '172.16.16.1'
	option netmask '255.255.255.192'

config bridge-vlan
	option device 'br-lan'
	option vlan '32'
	list ports 'eth1:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '64'
	list ports 'eth1:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '128'
	list ports 'eth1:t'

config interface 'home'
	option proto 'static'
	option device 'br-lan.64'
	option ipaddr '172.16.64.1'
	option netmask '255.255.255.192'

config interface 'iot'
	option proto 'static'
	option device 'br-lan.32'
	option ipaddr '172.16.32.1'
	option netmask '255.255.255.192'

config interface 'guest'
	option proto 'static'
	option device 'br-lan.128'
	option ipaddr '172.16.128.1'
	option netmask '255.255.255.192'

config interface 'wanb'
	option device 'eth4'
	option proto 'static'
	option ipaddr '192.168.145.2'
	option netmask '255.255.255.0'
	option gateway '192.168.145.1'
	option metric '20'
	list dns '9.9.9.9'
	list dns '142.112.112.12'
# cat /etc/config/firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option input 'ACCEPT'
	option output 'ACCEPT'
	list network 'secured'
	option name 'secured'
	option forward 'REJECT'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wanb'

config forwarding
	option dest 'wan'
	option src 'secured'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option proto 'esp'
	option target 'ACCEPT'
	option dest 'secured'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'
	option dest 'secured'

config zone
	option name 'home'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'home'
	option input 'REJECT'

config zone
	option name 'iot'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'iot'
	option input 'REJECT'

config zone
	option name 'guest'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'guest'
	option input 'REJECT'

config forwarding
	option src 'secured'
	option dest 'home'

config forwarding
	option src 'secured'
	option dest 'iot'

config forwarding
	option src 'home'
	option dest 'iot'

config forwarding
	option src 'home'
	option dest 'wan'

config forwarding
	option src 'iot'
	option dest 'wan'

config forwarding
	option src 'guest'
	option dest 'wan'

config rule
	option name 'Home DHCP and DNS'
	option src 'home'
	option dest_port '53 67 68'
	option target 'ACCEPT'

config rule
	option name 'Guest DHCP and DNS'
	option src 'guest'
	option dest_port '53 67 68'
	option target 'ACCEPT'

config rule
	option name 'IoT DHCP and DNS'
	option src 'iot'
	option dest_port '53 67 68'
	option target 'ACCEPT'

config rule
	option name 'Home block modems'
	option src 'home'
	option dest 'wan'
	list dest_ip '192.168.144.1'
	list dest_ip '192.168.145.1'
	option target 'REJECT'

config rule
	option name 'Guest block modems'
	option src 'guest'
	option dest 'wan'
	list dest_ip '192.168.144.1'
	list dest_ip '192.168.145.1'
	option target 'REJECT'

config rule
	option name 'IoT block modems'
	option src 'iot'
	list dest_ip '192.168.144.1'
	list dest_ip '192.168.145.1'
	option target 'REJECT'
	option dest 'wan'
# cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'
	option start '100'
	option limit '150'
	option leasetime '12h'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'secured'
	option interface 'secured'
	option leasetime '12h'
	option start '10'
	option limit '50'

config dhcp 'home'
	option interface 'home'
	option leasetime '12h'
	option start '10'
	option limit '50'

config dhcp 'iot'
	option interface 'iot'
	option leasetime '12h'
	option start '10'
	option limit '50'

config dhcp 'guest'
	option interface 'guest'
	option leasetime '12h'
	option start '10'
	option limit '50'

I have set up all settings in mwan3 configuration and now both WANs work. Does anyone know what could have changed?

I'm interested in the cause of the behaviour above because of my issue from yesterday

One of the problems I can see is that WANB loses first 4 packets during ping:

# ping -c 8 -I eth4 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: seq=4 ttl=114 time=40.132 ms
64 bytes from 8.8.8.8: seq=5 ttl=114 time=28.831 ms
64 bytes from 8.8.8.8: seq=6 ttl=114 time=42.883 ms
64 bytes from 8.8.8.8: seq=7 ttl=114 time=85.934 ms

--- 8.8.8.8 ping statistics ---
8 packets transmitted, 4 packets received, 50% packet loss
round-trip min/avg/max = 28.831/49.445/85.934 ms

# ping -c 8 -I eth0 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: seq=0 ttl=117 time=44.191 ms
64 bytes from 8.8.8.8: seq=1 ttl=117 time=38.480 ms
64 bytes from 8.8.8.8: seq=2 ttl=117 time=49.043 ms
64 bytes from 8.8.8.8: seq=3 ttl=117 time=46.960 ms
64 bytes from 8.8.8.8: seq=4 ttl=117 time=39.085 ms
64 bytes from 8.8.8.8: seq=5 ttl=117 time=38.906 ms
64 bytes from 8.8.8.8: seq=6 ttl=117 time=48.550 ms
64 bytes from 8.8.8.8: seq=7 ttl=117 time=38.620 ms

--- 8.8.8.8 ping statistics ---
8 packets transmitted, 8 packets received, 0% packet loss
round-trip min/avg/max = 38.480/42.979/49.043 ms

I remember I have seen this behaviour before in another topic.
Also the successful pinging from all available upstream interfaces must be achieved already before installing mwan3 according to the documentation.

Unfortunately, after quite thorough research here and on Google I couldn't find any description of a similar problem.

Well... that's my fault. But maybe it's still problem to resolve this issue even with mwan3 already installed.

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.