Cant get out of local network

Installing and Using OpenWrt
1

I am baffled. I have a configuration where LAN2 is configured to support a special wireless modem on the 192.168.100.0 subnet. It suddenly stopped working. I can connect from my remote client and get an IP address. I can resolve hostnames but as soon as I try to access anything out the WAN port it fails (ping www.google.com resolves name but fails ping). I even swapped in a new modem and restored my last working archive even though I changed nothing. I have included my network and firewall settings. The message is "Destination host unreachable"

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd05:eaf1:8ae5::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'

	list ports 'lan3'
	list ports 'lan4'
	list ports 'lan5'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'wan'
	option device 'eth1'
	option proto 'dhcp'

config interface 'wan6'
	option device 'eth1'
	option proto 'dhcpv6'

config interface 'GuestWifi'
	option proto 'static'
	option ipaddr '192.168.2.1'
	option netmask '255.255.255.0'
	list dns '8.8.8.8'
	list dns '1.1.1.1'

config interface 'NPRmaaster'
	option proto 'static'
	option device 'lan2'
	list dns '8.8.8.8'
	list dns '1.1.1.1'
	option ipaddr '192.168.100.1'
	option netmask '255.255.255.0'


	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'GuestZone'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'GuestWifi'

config forwarding
	option src 'GuestZone'
	option dest 'wan'

config rule
	option src 'GuestZone'
	option name 'GuestDHCP'
	option dest_port '67'
	option target 'ACCEPT'

config rule
	option src 'NPRZone'
	option name 'NPR DHCP'
	option dest_port '67'
	option target 'ACCEPT'

config rule
	option src 'GuestZone'
	option name 'Guest DNS'
	option dest_port '53'
	option target 'ACCEPT'

config rule
	option src 'NPRZone'
	option name 'NPR DNS'
	option dest_port '53'
	option target 'ACCEPT'

config zone
	option name 'NPRZone'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'NPRmaaster'

config forwarding
	option src 'NPRZone'
	option dest 'wan'
2

Does your wan have an ip address? Can the router get to the internet?

Ssh into the router and run these commands… report back with the results:

ping 8.8.8.8
ping openwrt.org
3

I found the problem. It was windows defender. I kind of wondered what went wrong because I had changed nothing BUT I forgot about an win update that took place on the client. Thank you for your reply. BTW these are New Packet Radio UHF modems with a 30-50 mile range and I can get 500 kbps out of them.

4

Oops I should have Microsoft firewall.

5

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.