Can you tell me if my network config is correct?

[trendy]

@Raskaipika

INFO3: I want to make a link aggregation with the LAN ports 1&2 (Ports 2&3) with a Linksys-LGS308 that I will purchase when I have configured the network correctly.

Trunk (2 port aggregation) possible?

hello to everyone and happy new 2021. can someone help: i have mikrotik sxt lte that has 2 100mbit ports. on the other side i have a mikrotik hex gateway (5 gbit ports). i would like to do link aggregation with 2 ports (by connecting 2 lan cables from hex to sxt). sxt has possibility to make a trunk that would be used for link aggregation, but not sure how to do it on openwrt? thing is my 4g speeds can be faster than 100mbit, but i'm limited to 100mbit because of single 100mbit lan connect…

@Raskaipika

INFO: I'm using VLSM for the local subnets, with CIDR /28, making a total of 16 subnets of 16 hosts each one, making possible to use 14 of them for both (networks and hosts).

There is no need to do that. Keep the default /24 for future expansion.

@Raskaipika

option mtu '1472'

Why is there everywhere mtu 1472?

@Raskaipika

option broadcast '192.168.10.7'

No need to use broadcast in any interface.

@Raskaipika

option dns '192.168.100.17'

You are supposed to fill in a different dns server there, not itself.

@Raskaipika

option dns '192.168.100.33'

Same here, and in interfaces hosts, wireless, wlessguests,

@Raskaipika

option local '/local.homedomainhsh.org/'

I wouldn't use this long name for local and domain.

@Raskaipika

config dhcp 'voip'
        option interface        'voip'
        option networkid        'eth0.25'
        option dhcpv4           'server'
        option dhcpv6           'disabled'
        option gateway          '192.168.100.17'
        option dns              '192.168.100.17'
        option netmask          '255.255.255.240'
        option dynamicdhcp      '0'
        option start            '19'
        option limit            '4'
        option leasetime        'infinite'
        list dhcp_option        '42,192.168.100.17'

gateway,dns, netmask are not needed. I would not give infinite leasetime, maybe 12h max. The same applies to the other dhcp pools too.

@Raskaipika

        option name     'wlessguests'
        option input    'ACCEPT'

You may want to change that to reject.

@Raskaipika

###################DENEGAR_GENERALES#################
config rule
        option name     'NoPing-WAN'
        option src      'wan'
        option src_ip   '0.0.0.0'
        option proto    'icmp'
        option icmp_type 'echo-request'
        option target   'REJECT'

config rule
        option name     'NoSSH-WAN'
        option src      'wan'
        option src_ip   '0.0.0.0'
        option proto    'tcp'
        option src_port '22'
        option target   'REJECT'

config rule
        option name     'NoHTTP/HTTPS-WAN'
        option src      'wan'
        option src_ip   '0.0.0.0'
        option proto    'tcp'
        option src_port '80 8080 443'
        option target   'REJECT'

They are all wrong. By default the input for wan zone is reject, so you don't need to add more rules to reject. Other than that you'll never get something from IP 0.0.0.0, since it is reserved, and source port means that a server is trying to send you traffic, which also doesn't happen.

DNAT is taking place before the blocking of the DNS, so it is not needed.