Configuration sanity check

Installing and Using OpenWrt
1

G'day All,

I have just set up a new GL-MT6000 running OpenWrt 24.10.3 r28872.

Could someone from the brain trust please tell me if I have configured it properly.

My objective is to have:
• lan: 192.168.44.1-255, can connect to wan/wan6, can see other devices on lan, can connect to IoT devices but not guest devices
• Guest: 192.168.45.1-255, can connect to wan/wan6, is isolated from other devices on lan/Guest/IoT.
• IoT: 192.168.46.1-255, can connect to wan/wan6, is isolated from other devices on lan/Guest/IoT.

Here are my configuration files:

/etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fde7:a8a0:205c::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'
	list ports 'lan5'

config interface 'lan'
	option proto 'static'
	option ipaddr '192.168.44.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option device 'br-lan'
  
config interface 'wan'
	option device 'eth1'
	option proto 'dhcp'

config interface 'wan6'
	option device 'eth1'
	option proto 'dhcpv6'

config interface 'IoT'
	option proto 'static'
	option ipaddr '192.168.46.1'
	option netmask '255.255.255.0'

config interface 'Guest'
	option proto 'static'
	option ipaddr '192.168.45.1'
	option netmask '255.255.255.0'

/etc/config/wireless: option key's redacted

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi'
	option band '2g'
	option channel 'auto'
	option htmode 'HE20'
	option cell_density '0'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi+1'
	option band '5g'
	option channel 'auto'
	option htmode 'HE80'
	option cell_density '0'
	option country 'AU'

config wifi-iface 'wifinet2'
	option device 'radio0'
	option mode 'ap'
	option ssid 'kgr24'
	option encryption 'psk2'
	option key 'XXXX'
	option network 'lan'

config wifi-iface 'wifinet3'
	option device 'radio0'
	option mode 'ap'
	option ssid 'Guest'
	option encryption 'psk2'
	option key 'YYYY'
	option network 'Guest'

config wifi-iface 'wifinet4'
	option device 'radio0'
	option mode 'ap'
	option ssid 'IoT'
	option encryption 'psk2'
	option key 'ZZZZ'
	option network 'IoT'

config wifi-iface 'wifinet5'
	option device 'radio1'
	option mode 'ap'
	option ssid 'kgr5g'
	option encryption 'psk2'
	option key 'XXXX'
	option network 'lan'

/etc/config/firewall: I have added the last four (IoT DNS, IoT Isolate, Guest DNS - DHCP, Guest Isolate) in my attempt to achieve the above stated objectives. I can't recall why I didn't make 'IoT DNS' and 'Guest DNS - DHCP' the same but it was on the advice of something I read on the interweb

config defaults
	option input 'DROP'
	option output 'ACCEPT'
	option forward 'DROP'
	option synflood_protect '1'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'DROP'
	option output 'ACCEPT'
	option forward 'DROP'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'IoT'
	option input 'DROP'
	option output 'ACCEPT'
	option forward 'DROP'
	list network 'IoT'

config forwarding
	option src 'IoT'
	option dest 'wan'

config forwarding
	option src 'lan'
	option dest 'IoT'

config zone
	option name 'guest'
	option input 'DROP'
	option output 'ACCEPT'
	option forward 'DROP'
	list network 'Guest'

config forwarding
	option src 'guest'
	option dest 'wan'

config rule
	option src 'IoT'
	option name 'IoT DNS'
	option dest_port '53'
	option target 'ACCEPT'

config rule
	option src 'IoT'
	option dest '*'
	option name 'IoT Isolate'
	list dest_ip '192.168.44.0/24'
	list dest_ip '192.168.45.0/24'
	option target 'DROP'

config rule
	option src 'guest'
	option name 'Guest DNS - DHCP'
	option dest_port '53 67 68'
	option target 'ACCEPT'

config rule
	option src 'guest'
	option dest '*'
	option name 'Guest Isolate'
	option target 'DROP'
2

Because you're not using bridges, these networks will only work with a single band (1 radio)... either 2.4G or 5G, but not both.

If you want to have both bands available, create empty bridges and use those as the respective devices for each network.

This is unnecessary and can be deleted:

Same with this:

Your IoT network doesn't have a rule allowing DHCP... you may want to add that (either duplicate the rule you have for the guest network, or add one for udp port 67).

2 Likes
3

@psherman, thank you.

I have created and added the empty bridges and I have duplicated the DHCP as you have suggested.

Why are the two network traffic rules (IoT Isolate and Guest Isolate) unnecessary?

4

By default, the firewall does not permit inter-zone forwarding unless you create a forwarding rule for it (for example, lan > wan). Therefore, you don't need to create any new rules, just simply omit the forwarding rule (which you've already done).

5

Thankyou @psherman , I didn't know the default no inter-zone forwarding.

6

You might want to allow icmp ping on guest and iot networks, some of them “ping gateway” - thats also helpful for generic users.

7

@brada4 Excuse my ignorance, but what would the rule be for allowing icmp ping on guest and iot networks

8 

config rule
        option src 'lan'
        list proto 'icmp'
        list icmp_type 'echo-request'
        option target 'ACCEPT'