Can't access my WAN network from LAN/WiFi interface

motoko-kusanagi · December 10, 2024, 9:51pm

So I have a main router, with network 192.168.88.X where 192.168.88.1 is my main router with internet connection.

I have OpenWRT router, which is connected with WAN to this network. WAN is setup as 192.168.88.2, while my LAN is 192.168.1.1.

When I log via SSH to my OpenWRT router I can ping my default GW 192.168.88.1 I can ping other devices like 192.168.88.4 and so on, but when I'm trying to do this from my laptop connected to WiFi with address 192.168.1.XXX I can't ping default gw 192.168.88.1 and any other device.

I know I supposed to have firewall with option to allow routing to WAN network, but I'm pretty sure I have, and it doesnt work. Here is my config.

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Allow-LAN-WAN'
        option family 'ipv4'
        option src 'lan'
        option dest 'wan'
        option target 'ACCEPT'
        list proto 'all'

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd3e:456d:20bf::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device
        option name 'wan'
        option macaddr '4c:c6:4c:a9:7f:98'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config route
        option interface 'wan'
        option target '192.168.88.0/24'
        option gateway '192.168.88.1'

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option channel '1'
        option band '2g'
        option country 'PL'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'XXX'
        option encryption 'sae'
        option key 'XXX'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi+1'
        option channel 'auto'
        option band '5g'
        option htmode 'HE160'
        option country 'PL'
        option cell_density '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'XXX'
        option encryption 'sae'
        option key 'XXX'

root@OpenWrt:~# ip route show
default via 192.168.88.1 dev wan  src 192.168.88.2
192.168.1.0/24 dev br-lan scope link  src 192.168.1.1
192.168.88.0/24 via 192.168.88.1 dev wan

psherman · December 10, 2024, 9:57pm

This can be deleted.

Restart after deleting and then test again.

motoko-kusanagi · December 10, 2024, 10:05pm

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd3e:456d:20bf::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option delegate '0'

config device
        option name 'wan'
        option macaddr '4c:c6:4c:a9:7f:98'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'
        option type 'bridge'

root@OpenWrt:~# ping 192.168.88.4
PING 192.168.88.4 (192.168.88.4): 56 data bytes
64 bytes from 192.168.88.4: seq=0 ttl=63 time=0.884 ms
64 bytes from 192.168.88.4: seq=1 ttl=63 time=0.712 ms
^C
--- 192.168.88.4 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 0.712/0.798/0.884 ms

wifi

ping 192.168.88.4 -t

Pinging 192.168.88.4 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

psherman · December 10, 2024, 10:07pm

What IP address does your device (phone/computer/tablet) have when connected to wifi?

psherman · December 10, 2024, 10:07pm

Remove the bridge line from here:

motoko-kusanagi · December 10, 2024, 10:09pm

IP from local network, so 192.168.1.X

For example : 192.168.1.205

The funny thing is that Internet works, and internet is coming from 192.168.88.1 (WAN), but I can't ping that address from my wifi.

psherman · December 10, 2024, 10:10pm

There is no difference in your network between wifi and wired lan, so it doesn't make sense that you would experience this issue only on wifi. Did you test with another device? And did you test wired?

motoko-kusanagi · December 10, 2024, 10:17pm

I know. I have no idea what is going on.

This is my config now

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd3e:456d:20bf::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option delegate '0'

config device
        option name 'wan'
        option macaddr '4c:c6:4c:a9:7f:98'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

I'm connected to router with cable and wifi.

Wireless LAN adapter Wi-Fi:

   Connection-specific DNS Suffix  . : lan
   IPv6 Address. . . . . . . . . . . : fd3e:456d:20bf::cba
   IPv6 Address. . . . . . . . . . . : fd3e:456d:20bf:0:d4ca:8982:d01f:176f
   Temporary IPv6 Address. . . . . . : fd3e:456d:20bf:0:b4b5:a70:4a46:d8e9
   Link-local IPv6 Address . . . . . : fe80::b4d:ef70:dac6:ec59%25
   IPv4 Address. . . . . . . . . . . : 192.168.1.205
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.1.1

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : lan
   IPv6 Address. . . . . . . . . . . : fd3e:456d:20bf::68d
   IPv6 Address. . . . . . . . . . . : fd3e:456d:20bf:0:8cbd:e8cf:495d:1477
   Temporary IPv6 Address. . . . . . : fd3e:456d:20bf:0:8844:3914:f843:bbde
   Link-local IPv6 Address . . . . . : fe80::3a2a:b483:4085:bb08%3
   IPv4 Address. . . . . . . . . . . : 192.168.1.147
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.1.1

Tomorrow I will take my wife laptop and see then.
Thanks for help!

psherman · December 10, 2024, 10:19pm

Are you using Windows? Do you have another OS you can use (Mac, Linux, ChromeOS, or iPhone or Android)?