Can't connect to LAN clients on WiFi?

Hi,

I can connect to the Internet on WiFi but I can't connect to other clients on the LAN - like a NAS box. However I can connect to the NAS box once I plug in an Ethernet cable. If I reboot the OpenWrt 19.07 router WiFi will connect to the NAS box. Is there some setting I can change? I only have two interfaces: LAN and an interface for an Android phone to PROVIDE internet.

I read the post twice and didn't understand what happens.

I can't access my NAS drive while connected to my home network via WiFi. It only works with a wired connection.

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall
1 Like
root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
   option ifname 'lo'
   option proto 'static'
   option ipaddr '127.0.0.1'
   option netmask '255.0.0.0'

config globals 'globals'
   option ula_prefix 'fdbd:c5d5:b1a9::/48'

config interface 'lan'
   option type 'bridge'
   option ifname 'eth0.1'
   option proto 'static'
   option netmask '255.255.255.0'
   option ip6assign '60'
   list dns '192.168.1.16'
   option ipaddr '192.168.1.1'
   option gateway '255.255.255.0'
   option broadcast '192.168.1.255'
   option igmp_snooping '1'
   option stp '1'

config device 'lan_eth0_1_dev'
   option name 'eth0.1'
   option macaddr 'd4:ee:07:61:ac:86'

config device 'wan_eth0_2_dev'
   option name 'eth0.2'
   option macaddr 'd4:ee:07:61:ac:87'

config switch
   option name 'switch0'
   option reset '1'
   option enable_vlan '1'

config switch_vlan
   option device 'switch0'
   option vlan '1'
   option ports '0 1 2 3 6t'

config switch_vlan
   option device 'switch0'
   option vlan '2'
   option ports '4 6t'

config interface 'Tethering4G'
   option ifname 'usb0'
   option proto 'dhcp'
   option type 'bridge'
   list dns '192.168.1.16'
   option peerdns '0'
   option igmp_snooping '1'
   option stp '1'
   option delegate '0'

config interface 'WAN'
   option proto 'dhcp'
   option ifname 'eth0 eth0.1 eth0.2 usb0 radio1.network2 wlan0 wlan1'
   option type 'bridge'
   list dns '192.168.1.16'
   option peerdns '0'
   
***************************************************************************************************
***************************************************************************************************
root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
   option ifname 'lo'
   option proto 'static'
   option ipaddr '127.0.0.1'
   option netmask '255.0.0.0'

config globals 'globals'
   option ula_prefix 'fdbd:c5d5:b1a9::/48'
root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
   option type 'mac80211'
   option channel '11'
   option hwmode '11g'
   option path 'pci0000:00/0000:00:01.0/0000:02:00.0'
   option htmode 'HT20'
   option country 'IE'

config wifi-iface 'default_radio0'
   option device 'radio0'
   option mode 'ap'
   option key ##############
   option encryption ##############
   option ssid 'Ganymede'
   option isolate '1'
   option network 'lan Tethering4G'

config wifi-device 'radio1'
   option type 'mac80211'
   option channel '36'
   option hwmode '11a'
   option path 'pci0000:00/0000:00:00.0/0000:01:00.0'
   option htmode 'VHT80'
   option country 'IE'

config wifi-iface 'default_radio1'
   option device 'radio1'
   option network 'lan'
   option mode 'ap'
   option key ##############
   option ssid 'Ganymede'
   option isolate '1'
   option encryption '##############

config wifi-iface 'wifinet2'
   option ssid 'OpenWrt'
   option encryption 'none'
   option device 'radio1'
   option mode 'ap'
   option disabled '1'

***************************************************************************************************
***************************************************************************************************


root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
   option domainneeded '1'
   option localise_queries '1'
   option rebind_protection '1'
   option rebind_localhost '1'
   option local '/lan/'
   option domain 'lan'
   option expandhosts '1'
   option authoritative '1'
   option readethers '1'
   option leasefile '/tmp/dhcp.leases'
   option resolvfile '/tmp/resolv.conf.auto'
   option localservice '1'
   list server '192.168.1.16'
   option enable_tftp '1'

config dhcp 'lan'
   option interface 'lan'
   option start '100'
   option limit '150'
   option ra 'server'

config dhcp 'wan'
   option interface 'wan'
   option ignore '1'

config odhcpd 'odhcpd'
   option maindhcp '0'
   option leasefile '/tmp/hosts/odhcpd'
   option leasetrigger '/usr/sbin/odhcpd-update'
   option loglevel '4'
   
***************************************************************************************************
***************************************************************************************************
root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
   option ifname 'lo'
   option proto 'static'
   option ipaddr '127.0.0.1'
   option netmask '255.0.0.0'

config globals 'globals'
   option ula_prefix 'fdbd:c5d5:b1a9::/48'
root@OpenWrt:~# cat /etc/config/firewall

config defaults
   option syn_flood '1'
   option input 'ACCEPT'
   option output 'ACCEPT'
   option forward 'REJECT'

config zone
   option name 'lan'
   option input 'ACCEPT'
   option output 'ACCEPT'
   option forward 'ACCEPT'
   option network 'lan'

config zone
   option name 'wan'
   option input 'REJECT'
   option output 'ACCEPT'
   option forward 'REJECT'
   option masq '1'
   option mtu_fix '1'
   option network 'Tethering4G'

config forwarding
   option src 'lan'
   option dest 'wan'

config rule
   option name 'Allow-DHCP-Renew'
   option src 'wan'
   option proto 'udp'
   option dest_port '68'
   option target 'ACCEPT'
   option family 'ipv4'

config rule
   option name 'Allow-Ping'
   option src 'wan'
   option proto 'icmp'
   option icmp_type 'echo-request'
   option family 'ipv4'
   option target 'ACCEPT'

config rule
   option name 'Allow-IGMP'
   option src 'wan'
   option proto 'igmp'
   option family 'ipv4'
   option target 'ACCEPT'

config rule
   option name 'Allow-DHCPv6'
   option src 'wan'
   option proto 'udp'
   option src_ip 'fc00::/6'
   option dest_ip 'fc00::/6'
   option dest_port '546'
   option family 'ipv6'
   option target 'ACCEPT'

config rule
   option name 'Allow-MLD'
   option src 'wan'
   option proto 'icmp'
   option src_ip 'fe80::/10'
   list icmp_type '130/0'
   list icmp_type '131/0'
   list icmp_type '132/0'
   list icmp_type '143/0'
   option family 'ipv6'
   option target 'ACCEPT'

config rule
   option name 'Allow-ICMPv6-Input'
   option src 'wan'
   option proto 'icmp'
   list icmp_type 'echo-request'
   list icmp_type 'echo-reply'
   list icmp_type 'destination-unreachable'
   list icmp_type 'packet-too-big'
   list icmp_type 'time-exceeded'
   list icmp_type 'bad-header'
   list icmp_type 'unknown-header-type'
   list icmp_type 'router-solicitation'
   list icmp_type 'neighbour-solicitation'
   list icmp_type 'router-advertisement'
   list icmp_type 'neighbour-advertisement'
   option limit '1000/sec'
   option family 'ipv6'
   option target 'ACCEPT'

config rule
   option name 'Allow-ICMPv6-Forward'
   option src 'wan'
   option dest '*'
   option proto 'icmp'
   list icmp_type 'echo-request'
   list icmp_type 'echo-reply'
   list icmp_type 'destination-unreachable'
   list icmp_type 'packet-too-big'
   list icmp_type 'time-exceeded'
   list icmp_type 'bad-header'
   list icmp_type 'unknown-header-type'
   option limit '1000/sec'
   option family 'ipv6'
   option target 'ACCEPT'

config rule
   option name 'Allow-IPSec-ESP'
   option src 'wan'
   option dest 'lan'
   option proto 'esp'
   option target 'ACCEPT'

config rule
   option name 'Allow-ISAKMP'
   option src 'wan'
   option dest 'lan'
   option dest_port '500'
   option proto 'udp'
   option target 'ACCEPT'

config include
   option path '/etc/firewall.user'


You have a really messes up configuration, I wonder how it works at all... ae you sure you only have issues with wifi clients connecting to the NAS?

1 Like

Yes, only problem is not being able connect from a WiFi to NAS device (or other network locations).

I only have a LAN interface and a interface for a USB connection to phone. I deleted the WAN interface to bridge the two so I'm at stock settings now. There is a Pi-hole @ 192.168.1.16

BusyBox v1.30.1 () built-in shell (ash)

 _______                     ________        __
|       |.-----.-----.-----.|  |  |  |.----.|  |_
|   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
|_______||   __|_____|__|__||________||__|  |____|
         |__| W I R E L E S S   F R E E D O M
-----------------------------------------------------
OpenWrt 19.07.2, r10947-65030d81f3
-----------------------------------------------------
root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
   option ifname 'lo'
   option proto 'static'
   option ipaddr '127.0.0.1'
   option netmask '255.0.0.0'

config globals 'globals'
   option ula_prefix 'fdbd:c5d5:b1a9::/48'

config interface 'lan'
   option type 'bridge'
   option ifname 'eth0.1'
   option proto 'static'
   option netmask '255.255.255.0'
   option ip6assign '60'
   list dns '192.168.1.16'
   option ipaddr '192.168.1.1'
   option gateway '255.255.255.0'
   option broadcast '192.168.1.255'
   option igmp_snooping '1'
   option stp '1'

config device 'lan_eth0_1_dev'
   option name 'eth0.1'
   option macaddr 'd4:ee:07:61:ac:86'

config device 'wan_eth0_2_dev'
   option name 'eth0.2'
   option macaddr 'd4:ee:07:61:ac:87'

config switch
   option name 'switch0'
   option reset '1'
   option enable_vlan '1'

config switch_vlan
   option device 'switch0'
   option vlan '1'
   option ports '0 1 2 3 6t'

config switch_vlan
   option device 'switch0'
   option vlan '2'
   option ports '4 6t'

config interface 'Tethering4G'
   option ifname 'usb0'
   option proto 'dhcp'
   option type 'bridge'
   list dns '192.168.1.16'
   option peerdns '0'
   option igmp_snooping '1'
   option stp '1'
   option delegate '0'
   
***************************************************************************************************
***************************************************************************************************	


root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
   option type 'mac80211'
   option channel '11'
   option hwmode '11g'
   option path 'pci0000:00/0000:00:01.0/0000:02:00.0'
   option htmode 'HT20'
   option country 'IE'

config wifi-iface 'default_radio0'
   option device 'radio0'
   option mode 'ap'
   option key ##############
   option encryption ##############
   option ssid 'Ganymede'
   option isolate '1'
   option network 'lan Tethering4G'

config wifi-device 'radio1'
   option type 'mac80211'
   option channel '36'
   option hwmode '11a'
   option path 'pci0000:00/0000:00:00.0/0000:01:00.0'
   option htmode 'VHT80'
   option country 'IE'

config wifi-iface 'default_radio1'
   option device 'radio1'
   option network 'lan'
   option mode 'ap'
   option key ##############
   option ssid 'Ganymede'
   option isolate '1'
   option encryption ##############

config wifi-iface 'wifinet2'
   option ssid 'OpenWrt'
   option encryption 'none'
   option device 'radio1'
   option mode 'ap'
   option disabled '1'
   
***************************************************************************************************
***************************************************************************************************

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
   option domainneeded '1'
   option localise_queries '1'
   option rebind_protection '1'
   option rebind_localhost '1'
   option local '/lan/'
   option domain 'lan'
   option expandhosts '1'
   option authoritative '1'
   option readethers '1'
   option leasefile '/tmp/dhcp.leases'
   option resolvfile '/tmp/resolv.conf.auto'
   option localservice '1'
   list server '192.168.1.16'
   option enable_tftp '1'

config dhcp 'lan'
   option interface 'lan'
   option start '100'
   option limit '150'
   option ra 'server'

config dhcp 'wan'
   option interface 'wan'
   option ignore '1'

config odhcpd 'odhcpd'
   option maindhcp '0'
   option leasefile '/tmp/hosts/odhcpd'
   option leasetrigger '/usr/sbin/odhcpd-update'
   option loglevel '4'
   
***************************************************************************************************
***************************************************************************************************

config interface 'loopback'
root@OpenWrt:~# cat /etc/config/firewall

config defaults
   option syn_flood '1'
   option input 'ACCEPT'
   option output 'ACCEPT'
   option forward 'REJECT'

config zone
   option name 'lan'
   option input 'ACCEPT'
   option output 'ACCEPT'
   option forward 'ACCEPT'
   option network 'lan'

config zone
   option name 'wan'
   option input 'REJECT'
   option output 'ACCEPT'
   option forward 'REJECT'
   option masq '1'
   option mtu_fix '1'
   option network 'Tethering4G'

config forwarding
   option src 'lan'
   option dest 'wan'

config rule
   option name 'Allow-DHCP-Renew'
   option src 'wan'
   option proto 'udp'
   option dest_port '68'
   option target 'ACCEPT'
   option family 'ipv4'

config rule
   option name 'Allow-Ping'
   option src 'wan'
   option proto 'icmp'
   option icmp_type 'echo-request'
   option family 'ipv4'
   option target 'ACCEPT'

config rule
   option name 'Allow-IGMP'
   option src 'wan'
   option proto 'igmp'
   option family 'ipv4'
   option target 'ACCEPT'

config rule
   option name 'Allow-DHCPv6'
   option src 'wan'
   option proto 'udp'
   option src_ip 'fc00::/6'
   option dest_ip 'fc00::/6'
   option dest_port '546'
   option family 'ipv6'
   option target 'ACCEPT'

config rule
   option name 'Allow-MLD'
   option src 'wan'
   option proto 'icmp'
   option src_ip 'fe80::/10'
   list icmp_type '130/0'
   list icmp_type '131/0'
   list icmp_type '132/0'
   list icmp_type '143/0'
   option family 'ipv6'
   option target 'ACCEPT'

config rule
   option name 'Allow-ICMPv6-Input'
   option src 'wan'
   option proto 'icmp'
   list icmp_type 'echo-request'
   list icmp_type 'echo-reply'
   list icmp_type 'destination-unreachable'
   list icmp_type 'packet-too-big'
   list icmp_type 'time-exceeded'
   list icmp_type 'bad-header'
   list icmp_type 'unknown-header-type'
   list icmp_type 'router-solicitation'
   list icmp_type 'neighbour-solicitation'
   list icmp_type 'router-advertisement'
   list icmp_type 'neighbour-advertisement'
   option limit '1000/sec'
   option family 'ipv6'
   option target 'ACCEPT'

config rule
   option name 'Allow-ICMPv6-Forward'
   option src 'wan'
   option dest '*'
   option proto 'icmp'
   list icmp_type 'echo-request'
   list icmp_type 'echo-reply'
   list icmp_type 'destination-unreachable'
   list icmp_type 'packet-too-big'
   list icmp_type 'time-exceeded'
   list icmp_type 'bad-header'
   list icmp_type 'unknown-header-type'
   option limit '1000/sec'
   option family 'ipv6'
   option target 'ACCEPT'

config rule
   option name 'Allow-IPSec-ESP'
   option src 'wan'
   option dest 'lan'
   option proto 'esp'
   option target 'ACCEPT'

config rule
   option name 'Allow-ISAKMP'
   option src 'wan'
   option dest 'lan'
   option dest_port '500'
   option proto 'udp'
   option target 'ACCEPT'

config include
   option path '/etc/firewall.user'

I added the WiFi to the LAN connection, it seems to work initially

The AP should be only in the lan network. This will bridge it to your wired NAS. Everything on lan inherently has access to the Internet via the forwarding rule.

option gateway '255.255.255.0' is wrong that's the netmask. Don't put extra config in the lan network. The gateway is automatically configured by the wan network taking dhcp from the phone. To use a different dns server configure it in the wan (tethering) network.

You don't need a wan network at all since tethering4g is the wan. I would merely change the interface from eth to usb0 on the existing wan rather than create a new network.

Your use case is almost identical to a default use case except for two things:

  • The ISP is a tethered phone not an Ethernet connection to a modem.
  • There is a pi-hole.

So it makes sense to start with a true default configuration and change just enough to make it work. As @eduperez said what you have now is seriously messed up and it would be a good idea to start over.

2 Likes

I have had the same or at least a very similar problem for some time.

Wifi clients cannot communicate with each other and wired devices cannot reach other Wifi clients. The only client-to-client communication works from wired to wired and from wireless to wired.

Wifi client --> Wired client WORKS
Wifi client --> Wifi client DOESN'T WORK
Wired client --> Wired client WORKS
Wired client --> Wifi client DOESN'T WORK

I have changed very little of the default settings.

Device Linksys WRT1200AC
Firmware OpenWrt 19.07.4 r11208-ce6496d796 / LuCI openwrt-19.07 branch git-20.287.57033-3d52019

/etc/config/network
config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd35:e857:30a2::/48'

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'wan'
	option ifname 'eth1.2'
	option proto 'dhcp'

config interface 'wan6'
	option ifname 'eth1.2'
	option proto 'dhcpv6'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0 1 2 3 5t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '4 6t'

/etc/config/wireless
config wifi-device 'radio0'
	option type 'mac80211'
	option hwmode '11a'
	option path 'soc/soc:pcie/pci0000:00/0000:00:01.0/0000:01:00.0'
	option legacy_rates '0'
	option country 'DE'
	option htmode 'VHT80'
	option channel '48'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option macaddr '***'
	option key '***'
	option ieee80211w '1'
	option ssid '***'
	option encryption 'sae-mixed'

config wifi-device 'radio1'
	option type 'mac80211'
	option hwmode '11g'
	option path 'soc/soc:pcie/pci0000:00/0000:00:02.0/0000:02:00.0'
	option legacy_rates '0'
	option htmode 'HT40'
	option country 'DE'
	option channel '9'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option macaddr '***'
	option key '***'
	option ieee80211w '1'
	option ssid '***'
	option encryption 'sae-mixed'
	option isolate '0'
/etc/config/dhcp
config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.auto'
	option localservice '1'
	list server '1.1.1.1'
	list server '8.8.8.8'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '1'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'
/etc/config/firewall
config defaults
	option syn_flood	1
	option input		ACCEPT
	option output		ACCEPT
	option forward		REJECT
# Uncomment this line to disable ipv6 rules
#	option disable_ipv6	1

config zone
	option name		lan
	list   network		'lan'
	option input		ACCEPT
	option output		ACCEPT
	option forward		ACCEPT

config zone
	option name		wan
	list   network		'wan'
	list   network		'wan6'
	option input		REJECT
	option output		ACCEPT
	option forward		REJECT
	option masq		1
	option mtu_fix		1

config forwarding
	option src		lan
	option dest		wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
	option name		Allow-DHCP-Renew
	option src		wan
	option proto		udp
	option dest_port	68
	option target		ACCEPT
	option family		ipv4

# Allow IPv4 ping
config rule
	option name		Allow-Ping
	option src		wan
	option proto		icmp
	option icmp_type	echo-request
	option family		ipv4
	option target		ACCEPT

config rule
	option name		Allow-IGMP
	option src		wan
	option proto		igmp
	option family		ipv4
	option target		ACCEPT

# Allow DHCPv6 replies
# see https://dev.openwrt.org/ticket/10381
config rule
	option name		Allow-DHCPv6
	option src		wan
	option proto		udp
	option src_ip		fc00::/6
	option dest_ip		fc00::/6
	option dest_port	546
	option family		ipv6
	option target		ACCEPT

config rule
	option name		Allow-MLD
	option src		wan
	option proto		icmp
	option src_ip		fe80::/10
	list icmp_type		'130/0'
	list icmp_type		'131/0'
	list icmp_type		'132/0'
	list icmp_type		'143/0'
	option family		ipv6
	option target		ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
	option name		Allow-ICMPv6-Input
	option src		wan
	option proto	icmp
	list icmp_type		echo-request
	list icmp_type		echo-reply
	list icmp_type		destination-unreachable
	list icmp_type		packet-too-big
	list icmp_type		time-exceeded
	list icmp_type		bad-header
	list icmp_type		unknown-header-type
	list icmp_type		router-solicitation
	list icmp_type		neighbour-solicitation
	list icmp_type		router-advertisement
	list icmp_type		neighbour-advertisement
	option limit		1000/sec
	option family		ipv6
	option target		ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
	option name		Allow-ICMPv6-Forward
	option src		wan
	option dest		*
	option proto		icmp
	list icmp_type		echo-request
	list icmp_type		echo-reply
	list icmp_type		destination-unreachable
	list icmp_type		packet-too-big
	list icmp_type		time-exceeded
	list icmp_type		bad-header
	list icmp_type		unknown-header-type
	option limit		1000/sec
	option family		ipv6
	option target		ACCEPT

config rule
	option name		Allow-IPSec-ESP
	option src		wan
	option dest		lan
	option proto		esp
	option target		ACCEPT

config rule
	option name		Allow-ISAKMP
	option src		wan
	option dest		lan
	option dest_port	500
	option proto		udp
	option target		ACCEPT

# include a file with users custom iptables rules
config include
	option path /etc/firewall.user


### EXAMPLE CONFIG SECTIONS
# do not allow a specific ip to access wan
#config rule
#	option src		lan
#	option src_ip	192.168.45.2
#	option dest		wan
#	option proto	tcp
#	option target	REJECT

# block a specific mac on wan
#config rule
#	option dest		wan
#	option src_mac	00:11:22:33:44:66
#	option target	REJECT

# block incoming ICMP traffic on a zone
#config rule
#	option src		lan
#	option proto	ICMP
#	option target	DROP

root@OpenWrt:~# cat /etc/config/firewall
config defaults
	option syn_flood	1
	option input		ACCEPT
	option output		ACCEPT
	option forward		REJECT
# Uncomment this line to disable ipv6 rules
#	option disable_ipv6	1

config zone
	option name		lan
	list   network		'lan'
	option input		ACCEPT
	option output		ACCEPT
	option forward		ACCEPT

config zone
	option name		wan
	list   network		'wan'
	list   network		'wan6'
	option input		REJECT
	option output		ACCEPT
	option forward		REJECT
	option masq		1
	option mtu_fix		1

config forwarding
	option src		lan
	option dest		wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
	option name		Allow-DHCP-Renew
	option src		wan
	option proto		udp
	option dest_port	68
	option target		ACCEPT
	option family		ipv4

# Allow IPv4 ping
config rule
	option name		Allow-Ping
	option src		wan
	option proto		icmp
	option icmp_type	echo-request
	option family		ipv4
	option target		ACCEPT

config rule
	option name		Allow-IGMP
	option src		wan
	option proto		igmp
	option family		ipv4
	option target		ACCEPT

# Allow DHCPv6 replies
# see https://dev.openwrt.org/ticket/10381
config rule
	option name		Allow-DHCPv6
	option src		wan
	option proto		udp
	option src_ip		fc00::/6
	option dest_ip		fc00::/6
	option dest_port	546
	option family		ipv6
	option target		ACCEPT

config rule
	option name		Allow-MLD
	option src		wan
	option proto		icmp
	option src_ip		fe80::/10
	list icmp_type		'130/0'
	list icmp_type		'131/0'
	list icmp_type		'132/0'
	list icmp_type		'143/0'
	option family		ipv6
	option target		ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
	option name		Allow-ICMPv6-Input
	option src		wan
	option proto	icmp
	list icmp_type		echo-request
	list icmp_type		echo-reply
	list icmp_type		destination-unreachable
	list icmp_type		packet-too-big
	list icmp_type		time-exceeded
	list icmp_type		bad-header
	list icmp_type		unknown-header-type
	list icmp_type		router-solicitation
	list icmp_type		neighbour-solicitation
	list icmp_type		router-advertisement
	list icmp_type		neighbour-advertisement
	option limit		1000/sec
	option family		ipv6
	option target		ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
	option name		Allow-ICMPv6-Forward
	option src		wan
	option dest		*
	option proto		icmp
	list icmp_type		echo-request
	list icmp_type		echo-reply
	list icmp_type		destination-unreachable
	list icmp_type		packet-too-big
	list icmp_type		time-exceeded
	list icmp_type		bad-header
	list icmp_type		unknown-header-type
	option limit		1000/sec
	option family		ipv6
	option target		ACCEPT

config rule
	option name		Allow-IPSec-ESP
	option src		wan
	option dest		lan
	option proto		esp
	option target		ACCEPT

config rule
	option name		Allow-ISAKMP
	option src		wan
	option dest		lan
	option dest_port	500
	option proto		udp
	option target		ACCEPT

# include a file with users custom iptables rules
config include
	option path /etc/firewall.user


### EXAMPLE CONFIG SECTIONS
# do not allow a specific ip to access wan
#config rule
#	option src		lan
#	option src_ip	192.168.45.2
#	option dest		wan
#	option proto	tcp
#	option target	REJECT

# block a specific mac on wan
#config rule
#	option dest		wan
#	option src_mac	00:11:22:33:44:66
#	option target	REJECT

# block incoming ICMP traffic on a zone
#config rule
#	option src		lan
#	option proto	ICMP
#	option target	DROP

# port redirect port coming in on wan to lan
#config redirect
#	option src			wan
#	option src_dport	80
#	option dest			lan
#	option dest_ip		192.168.16.235
#	option dest_port	80
#	option proto		tcp

# port redirect of remapped ssh port (22001) on wan
#config redirect
#	option src		wan
#	option src_dport	22001
#	option dest		lan
#	option dest_port	22
#	option proto		tcp

### FULL CONFIG SECTIONS
#config rule
#	option src		lan
#	option src_ip	192.168.45.2
#	option src_mac	00:11:22:33:44:55
#	option src_port	80
#	option dest		wan
#	option dest_ip	194.25.2.129
#	option dest_port	120
#	option proto	tcp
#	option target	REJECT

#config redirect
#	option src		lan
#	option src_ip	192.168.45.2
#	option src_mac	00:11:22:33:44:55
#	option src_port		1024
#	option src_dport	80
#	option dest_ip	194.25.2.129
#	option dest_port	120
#	option proto	tcp

Many thanks in advance for the help!

@morphy2k, welcome to the community!

You may wish to create a new thread for your issue.

Thanks for the feedback @mk24 I'm going to implement your reply now.

The AP should be only in the lan network. This will bridge it to your wired NAS. Everything on lan inherently has access to the Internet via the forwarding rule.

I removed the WiFi AP from 4GTethering and I couldn't access the internet, so they need to be in both the LAN and 4GTethering.

I removed option gateway '255.255.255.0' but it did nothing.

I'm still having trouble that I can't access a NAS box via WiFi.

****Edit I re added the WiFi (2GHz & 5GHz) to both LAN & 4GTethering and it worked again.

That is not how it works. The wan network should be by itself and only used to forward Internet requests from the lan.

Please start over from defaults. You can do this without erasing the USB cell modem drivers by letting the firstboot scripts regenerate config files.

rm /etc/config/network
rm /etc/config/wireless
cp /rom/etc/config/firewall /etc/config/firewall
reboot

Now log in to edit /etc/config/network; in the wan section change eth0.2 to usb0. Set up your wifi AP(s) connected to lan. Option isolate should not be set if you want a full LAN where wifi clients can reach each other. Run service network restart or reboot again. This should be a basic router(*) with Internet access through the phone.

Only after having that work properly you can set up the pi-hole. I haven't actually done that myself but it should just be adding option peerdns 0 and option dns '192.168.1.16' to the wan section.

  • The WAN Ethernet port is not logically connected to anything at this point, so it isn't usable. You can make it a fifth LAN port if you want by reconfiguring the switch. Change option ports to '0 1 2 3 4 6t' in the vlan1 section and remove the vlan2 section.
3 Likes

I carried out your instructions and it seems to have worked but I'm going to give it a few hours.

rm /etc/config/network
rm /etc/config/wireless
cp /rom/etc/config/firewall /etc/config/firewall
reboot

I rebooted after the above commands and then edited /etc/config/network to the usb0 in the WAN section only (see full listing):

                                                                                                                                                                                              
config globals 'globals'                                                                                                                                                                      
                                                                                                                                                                                              
config interface 'lan'                                                                                                                                                                        
        option type 'bridge'                                                                                                                                                                  
        option ifname 'eth0.1'                                                                                                                                                                
        option proto 'static'                                                                                                                                                                 
        option ipaddr '192.168.1.1'                                                                                                                                                           
        option netmask '255.255.255.0'                                                                                                                                                        
        option ip6assign '60'                                                                                                                                                                 
                                                                                                                                                                                              
config device 'lan_eth0_1_dev'                                                                                                                                                                
        option name 'eth0.1'                                                                                                                                                                  
        option macaddr 'd4:ee:07:61:ac:86'                                                                                                                                                    
                                                                                                                                                                                              
config interface 'wan'                                                                                                                                                                        
        option ifname 'usb0'                                                                                                                                                                  
        option proto 'dhcp'                                                                                                                                                                   
        list dns '192.168.1.16'                                                                                                                                                               
        option peerdns '0'                                                                                                                                                                    
                                                                                                                                                                                              
config device 'wan_eth0_2_dev'                                                                                                                                                                
        option name 'eth0.2'                                                                                                                                                                  
        option macaddr 'd4:ee:07:61:ac:87'                                                                                                                                                    
                                                                                                                                                                                              
config interface 'wan6'                                                                                                                                                                       
        option ifname 'eth0.2'                                                                                                                                                                
        option proto 'dhcpv6'                                                                                                                                                                 
                                                                                                                                                                                              
config switch                                                                                                                                                                                 
        option name 'switch0'                                                                                                                                                                 
        option reset '1'                                                                                                                                                                      
        option enable_vlan '1'                                                                                                                                                                
                                                                                                                                                                                              
config switch_vlan                                                                                                                                                                            
        option device 'switch0'                                                                                                                                                               
        option vlan '1'                                                                                                                                                                       
        option ports '0 1 2 3 6t'                                                                                                                                                             
                                                                                                                                                                                              
config switch_vlan                                                                                                                                                                            
        option device 'switch0'                                                                                                                                                               
        option vlan '2'                                                                                                                                                                       
        option ports '4 6t'  

I added the two AP (2GHz & 5GHz) to the LAN - screenshot

In the WAN interface I changed the DNS to pi-hole. Everything else left blank. Everything still working.

I thought isolate clients would stop cross talk and improve speeds but take your point that it stops them talking to each other.

Now there are two WANs, one of them is DHCPv6 and isn't doing anything.

The solution by @mk24 is still working after 24 hours so I think its fixed! (I had something working before but it would stop after about 12 hours).

Thanks for all the help, not having to erase the USB modem drivers was most appreciated. :smiley:

Thank you!
The thread can be found here

1 Like