Can’t reach devices on same network

Installing and Using OpenWrt
1

Hi all i am just setting up my home network but i cant access or ping my NAS or other devices on the same LAN.
I tried using two different machines (macos and windows) and also using only cable to rule out any potential wireless problems since I have a mesh setup with two APs.
Both are using the same ip range e.g. my macos machine uses 192.168.1.175 and my NAS i would like to access 192.168.1.226

Another (probably unrelated) question: I added list dns '1.1.1.1' etc. to my wan interface but my clients still show the router 192.168.1.1 as a DNS server. For my understanding i dont need to broadcast it again via the DHCP server on lan if i have it set up as main DNS of the router?

arp -a on my machine returns this

zap-r.lan (192.168.1.1) at [REDACTED] on en7 ifscope [ethernet]
? (192.168.1.135) at [REDACTED] on en7 ifscope [ethernet]
my-nas.lan (192.168.1.226) at [REDACTED] on en7 ifscope [ethernet]
? (192.168.1.242) at (incomplete) on en7 ifscope [ethernet]
? (192.168.1.255) at [REDACTED] on en7 ifscope [ethernet]
mdns.mcast.net (224.0.0.251) at [REDACTED] on en7 ifscope permanent [ethernet]
System 
"kernel": "5.15.134",
"hostname": "ZAP-r",
"system": "MediaTek MT7621 ver:1 eco:3",
"model": "ZyXEL WSM20",
"board_name": "zyxel,wsm20",
"rootfs_type": "squashfs",
"release": {
	"distribution": "OpenWrt",
	"version": "23.05.0",
	"revision": "r23497-6637af95aa",
	"target": "ramips/mt7621",
	"description": "OpenWrt 23.05.0 r23497-6637af95aa"
}
/etc/config/network 
config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix '[REDACTED]'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'wan'
	option device 'wan'
	option proto 'pppoe'
	option username '[REDACTED]@t-online.de'
	option password '[REDACTED]'
	option ipv6 'auto'
	option peerdns '0'
	list dns '1.1.1.1'
	list dns '9.9.9.9'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'
	option reqaddress 'try'
	option reqprefix 'auto'
	option peerdns '0'
	list dns '2606:4700:4700::1111'
	list dns '2620:fe::fe'
/etc/config/dhcp 
config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option localservice '1'
	option ednspacket_max '1232'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'
/etc/config/firewall 
config defaults
	option input 'DROP'
	option output 'ACCEPT'
	option forward 'DROP'
	option synflood_protect '1'
	option drop_invalid '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'DROP'
	option output 'ACCEPT'
	option forward 'DROP'
	option masq '1'
	option mtu_fix '1'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config forwarding
	option src 'lan'
	option dest 'wan'
2

Correct. The clients use the OpenWrt - and it in turn uses the servers configured.

  • Does the device allow ping?
  • Verify all devices are using CIDR /24 (i.e. subnet mask 255.255.255.0)
  • Test ping via one machine by statically addressing and connecting directly to the device

What does arp -a on the OpenWrt return? :thinking:

Lastly:

Can you ping everything (i.e. the NAS, the Windows and Mac) from the OpenWrt itself? :bulb:

3

Thanks man i could ping my mac via openwrt so this made me suspicious to check the settings of my NAS and yea it was literally just restricting access to hosts that it doesn know (like i told it to). im so sorry