Cant go outside my Lan to Wan

ez23 · May 25, 2025, 8:08am

Hi, I installed openwrt on raspberry pi 5.
Configured Lan + Wan and i guess i'm missing something because
i cant access outside to the internet.
Does some can please help?

ez23 · May 25, 2025, 8:10am

i'm adding a few screenshots.

ez23 · May 25, 2025, 8:11am

ez23 · May 25, 2025, 8:12am

frollic · May 25, 2025, 8:20am

Your wan doesn't appear to be in the wan firewall zone?

If it doesn't solve the problem;

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

ez23 · May 25, 2025, 9:45am

Hi @frollic Thanks for trying to help.
I'm adding the results.
XX= meaning i hide the address.

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fd15:5e74:XXXX::/48'

config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option ip6assign '60'
list ipaddr '192.168.X.X/24'
list dns '8.8.8.8'
list dns '8.8.4.4'
option force_link '0'

config interface 'WAN'
option proto 'dhcp'
option device 'eth1'

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
option type 'mac80211'
option path 'platform/axi/1001100000.mmc/mmc_host/mmc1/mmc1:0001/mmc1:0001:1'
option band '5g'
option channel '36'
option htmode 'VHT80'
option disabled '1'

config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'OpenWrt'
option encryption 'none'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
option filter_aaaa '0'
option filter_a '0'

config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'
option force '1'
option netmask '255.255.255.0'

config dhcp 'wan'
option interface 'wan'
option ignore '1'

config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
option syn_flood '1'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'

config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'

config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'

config forwarding
option src 'lan'
option dest 'wan'

config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'

config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'

config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'

lleachii · May 25, 2025, 10:04am

Try wan (lowercase).

ez23 · May 25, 2025, 10:25am

not working for me...

ez23 · May 25, 2025, 10:26am

lleachii · May 25, 2025, 10:33am

?

The command is vi /etc/config/network
edit WAN interface inside file

(Or use the web GUI to delete WAN and setup wan exactly the same way you did the first time - just using lowercase.)

ez23 · May 25, 2025, 11:10am

Thank you @lleachii, I tried that few times and still not working for me

lleachii · May 25, 2025, 11:11am

Tried what, exactly (your screenshot showed you typed erroneous commands)?
What's not working?

(Please provide clear information and details in order to better assist you.)

ez23 · May 25, 2025, 11:35am

@lleachii Sorry for that.
I tried to delete the WAN interface and reinstall it.

d687r02j8g · May 25, 2025, 11:38am

You still have WAN in capitals

Change this:

config interface 'WAN'
option proto 'dhcp'
option device 'eth1'

To this

config interface 'wan'
option proto 'dhcp'
option device 'eth1'

Also just noticed in your latest screenshot both wan and lan are on eth0 now?

Can you clarify which port your are plugging in your lan and wan?

ez23 · May 25, 2025, 11:47am

Hi, @d687r02j8g, Thanks for trying to help.
The results are from the command: vi /etc/config/network so i cant change it.
the Lan connected to ethernet port
the Wan connected to usb to ethernet port

frollic · May 25, 2025, 2:06pm

Sure you can, vi is a file editor.

You not knowing how to change it using vi, is a separate issue..

lleachii · May 25, 2025, 4:18pm

So why is it still uppercase?

We can't guess what you did or failed to do.

What prevents you from fixing it on command line - or deleting and reconfiguring on web GUI?

slh · May 25, 2025, 9:52pm

sed -i s/WAN/wan/g /etc/config/network /etc/config/firewall /etc/config/dhcp

might lead to positive results in a quicker way (you still should get some basic familiarity with vi, it's useful/ needed in many ways).

ez23 · May 26, 2025, 5:38am

I'll try to do everything from scratch and will update you. Thank you very much for your help.

ez23 · May 27, 2025, 6:11am

Hi guys, Thanks again for the help.
This is my status now after changing to 'wan'
still disconnected
any ideas?

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fd15:XXXX:ea2a::/48'

config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option ip6assign '60'
list ipaddr 'X.X.X.X/24'
list dns '8.8.8.8'
list dns '8.8.4.4'
option force_link '0'

config interface 'wan'
option proto 'dhcp'
option device 'eth0'

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
option type 'XXXX'
option path 'platform/axi/1001100000.mmc/mmc_host/mmc1/mmc1:0001/mmc1:0001:1'
option band '5g'
option channel '36'
option htmode 'VHT80'
option disabled '1'

config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'OpenWrt'
option encryption 'none'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
option filter_aaaa '0'
option filter_a '0'

config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'
option force '1'
option netmask '255.255.255.0'

config dhcp 'wan'
option interface 'wan'
option ignore '1'

config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'

config dhcp 'USBLAN'
option interface 'USBLAN'
option start '100'
option limit '150'
option leasetime '24h'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
option syn_flood '1'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'

config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'

config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
list network 'WAN'