Hi again,
I'm not sure if my luck has just been terrible or if I'm actually doing something wrong with my configuration that causes instability. I have another forum post about my Belkin RT3200 that would randomly crash and take the entire network down until it was power cycled. I've since been experimenting with this GL-MT3000 and a managed switch just to compare stability.
With this device, I got the following crash. The wireless remained operational which is how I was able to capture this log before I ended up having to reboot the device.
[2006799.605161] ------------[ cut here ]------------
[2006799.609963] NETDEV WATCHDOG: eth0 (mtk_soc_eth): transmit queue 0 timed out
[2006799.617111] WARNING: CPU: 1 PID: 0 at 0xffffffc0086c46d4
[2006799.622587] Modules linked in: pppoe ppp_async nft_fib_inet nf_flow_table_ipv6 nf_flow_table_ipv4 nf_flow_table_inet pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_objref nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_counter nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mt7915e mt76_connac_lib mt76 mac80211 iptable_mangle iptable_filter ipt_REJECT ipt_ECN ip_tables cfg80211 xt_time xt_tcpudp xt_tcpmss xt_statistic xt_multiport xt_mark xt_mac xt_limit xt_length xt_hl xt_ecn xt_dscp xt_comment xt_TCPMSS xt_LOG xt_HL xt_DSCP xt_CLASSIFY x_tables slhc sch_cake nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c compat crypto_safexcel sch_tbf sch_ingress sch_htb sch_hfsc em_u32 cls_u32 cls_route cls_matchall cls_fw cls_flow cls_basic act_skbedit act_mirred act_gact pwm_fan ifb sha1_generic seqiv md5 des_generic
[2006799.622796] libdes authencesn authenc leds_gpio xhci_plat_hcd xhci_pci xhci_mtk_hcd xhci_hcd gpio_button_hotplug usbcore usb_common aquantia crc_ccitt
[2006799.723531] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.15.150 #0
[2006799.729787] Hardware name: GL.iNet GL-MT3000 (DT)
[2006799.734651] pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[2006799.741776] pc : 0xffffffc0086c46d4
[2006799.745426] lr : 0xffffffc0086c46d4
[2006799.749076] sp : ffffffc00800bdb0
[2006799.752551] x29: ffffffc00800bdb0 x28: 0000000000000140 x27: 00000000ffffffff
[2006799.759851] x26: 0000000000000000 x25: 0000000000000001 x24: ffffff8000d594c0
[2006799.767149] x23: 0000000000000000 x22: 0000000000000001 x21: ffffffc008a36000
[2006799.774449] x20: ffffff8000d59000 x19: 0000000000000000 x18: ffffffc008a4a2a8
[2006799.781747] x17: ffffffc0174a3000 x16: ffffffc008008000 x15: 000000000000038d
[2006799.789045] x14: 000000000000012f x13: ffffffc00800bae8 x12: ffffffc008aa22a8
[2006799.796344] x11: 712074696d736e61 x10: ffffffc008aa22a8 x9 : 0000000000000000
[2006799.803642] x8 : ffffffc008a4a258 x7 : ffffffc008a4a2a8 x6 : 0000000000000001
[2006799.810940] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
[2006799.818238] x2 : 0000000000000040 x1 : 0000000000000002 x0 : 000000000000003f
[2006799.825537] Call trace:
[2006799.828145] 0xffffffc0086c46d4
[2006799.831447] 0xffffffc0080a5c50
[2006799.834750] 0xffffffc0080a64c8
[2006799.838052] 0xffffffc0080a6e18
[2006799.841355] 0xffffffc0080102bc
[2006799.844657] 0xffffffc00803b280
[2006799.847959] 0xffffffc00803b3a0
[2006799.851262] 0xffffffc008089564
[2006799.854564] 0xffffffc0080100e0
[2006799.857866] 0xffffffc00801584c
[2006799.861169] 0xffffffc00801614c
[2006799.864471] 0xffffffc008834770
[2006799.867773] 0xffffffc008834f24
[2006799.871076] 0xffffffc008011374
[2006799.874378] 0xffffffc008835504
[2006799.877681] 0xffffffc008069390
[2006799.880983] 0xffffffc0080695a0
[2006799.884286] 0xffffffc00801ebe0
[2006799.887588] 0xffffffc00883e2cc
[2006799.890892] ---[ end trace a27e720bd16ccd3f ]---
[2006799.895678] mtk_soc_eth 15100000.ethernet eth0: transmit timed out
[2006800.034305] mtk_soc_eth 15100000.ethernet eth0: Link is Down
[2006800.040207] mtk_soc_eth 15100000.ethernet eth1: Link is Down
[2006800.575925] mtk_soc_eth 15100000.ethernet: warm reset failed
[2006800.593091] mtk_soc_eth 15100000.ethernet eth0: PHY [mdio-bus:05] driver [Maxlinear Ethernet GPY211C] (irq=POLL)
[2006800.606287] mtk_soc_eth 15100000.ethernet eth0: configuring for phy/2500base-x link mode
[2006800.629960] mtk_soc_eth 15100000.ethernet eth1: PHY [mdio-bus:00] driver [MediaTek MT7981 PHY] (irq=POLL)
[2006800.639710] mtk_soc_eth 15100000.ethernet eth1: configuring for phy/gmii link mode
[2006800.650935] br-lan: port 1(eth1) entered disabled state
[2006803.764613] mtk_soc_eth 15100000.ethernet eth1: Link is Up - 1Gbps/Full - flow control off
[2006803.773086] br-lan: port 1(eth1) entered blocking state
[2006803.778503] br-lan: port 1(eth1) entered forwarding state
[2006804.804239] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control off
Here are the logs after the crashed occurred. I turned on my main PC (which is wired) and could not reach anything in the network. Setting a static IP address allowed me to access my switch and ping the router, but I could not access the LuCI page.
...
Fri Jun 21 04:24:35 2024 daemon.notice netifd: Network device 'eth0' link is down
Fri Jun 21 04:24:35 2024 daemon.notice netifd: Interface 'wan' has link connectivity loss
Fri Jun 21 04:24:35 2024 daemon.notice netifd: Interface 'wan6' has link connectivity loss
Fri Jun 21 04:24:36 2024 daemon.notice netifd: wan (3793): udhcpc: received SIGTERM
Fri Jun 21 04:24:36 2024 daemon.notice netifd: wan (3793): udhcpc: unicasting a release of XX.XX.XX.XX to XX.XX.XX.XX
Fri Jun 21 04:24:36 2024 daemon.notice netifd: wan (3793): udhcpc: sending release
Fri Jun 21 04:24:36 2024 daemon.notice netifd: wan (3793): udhcpc: entering released state
Fri Jun 21 04:24:36 2024 daemon.notice netifd: wan6 (3792): Command failed: ubus call network.interface notify_proto { "action": 0, "link-up": false, "keep": false, "interface": "wan6" } (Permission denied)
Fri Jun 21 04:24:36 2024 daemon.notice netifd: wan (3793): Command failed: ubus call network.interface notify_proto { "action": 0, "link-up": false, "keep": false, "interface": "wan" } (Permission denied)
Fri Jun 21 04:24:36 2024 daemon.notice netifd: Interface 'wan' is now down
Fri Jun 21 04:24:36 2024 daemon.warn dnsmasq[1]: no servers found in /tmp/resolv.conf.d/resolv.conf.auto, will retry
Fri Jun 21 04:24:36 2024 daemon.notice netifd: Interface 'wan6' is now down
Fri Jun 21 04:24:36 2024 daemon.info dnsmasq[1]: read /etc/hosts - 12 names
Fri Jun 21 04:24:36 2024 daemon.info dnsmasq[1]: read /tmp/hosts/dhcp.cfg01411c - 13 names
Fri Jun 21 04:24:36 2024 daemon.info dnsmasq[1]: read /tmp/hosts/odhcpd - 6 names
Fri Jun 21 04:24:36 2024 daemon.info dnsmasq-dhcp[1]: read /etc/ethers - 0 addresses
Fri Jun 21 04:24:37 2024 daemon.warn odhcpd[1701]: No default route present, overriding ra_lifetime!
Fri Jun 21 04:24:39 2024 daemon.notice netifd: Network device 'eth1' link is up
Fri Jun 21 04:24:40 2024 daemon.notice netifd: Network device 'eth0' link is up
Fri Jun 21 04:24:40 2024 daemon.notice netifd: Interface 'wan' has link connectivity
Fri Jun 21 04:24:40 2024 daemon.notice netifd: Interface 'wan' is setting up now
Fri Jun 21 04:24:40 2024 daemon.notice netifd: Interface 'wan6' has link connectivity
Fri Jun 21 04:24:40 2024 daemon.notice netifd: Interface 'wan6' is setting up now
Fri Jun 21 04:24:40 2024 daemon.notice netifd: wan (29732): udhcpc: started, v1.36.1
Fri Jun 21 04:24:40 2024 daemon.notice netifd: wan (29732): udhcpc: broadcasting discover
Fri Jun 21 04:24:40 2024 daemon.notice netifd: wan (29732): udhcpc: broadcasting select for XX.XX.XX.XX, server XX.XX.XX.XX
Fri Jun 21 04:24:40 2024 daemon.notice netifd: wan (29732): udhcpc: lease of XX.XX.XX.XX obtained from XX.XX.XX.XX, lease time 84219
Fri Jun 21 04:24:40 2024 daemon.notice netifd: Interface 'wan' is now up
Fri Jun 21 04:24:40 2024 daemon.info dnsmasq[1]: reading /tmp/resolv.conf.d/resolv.conf.auto
Fri Jun 21 04:24:40 2024 daemon.info dnsmasq[1]: using nameserver 1.1.1.1#53
Fri Jun 21 04:24:40 2024 daemon.info dnsmasq[1]: using nameserver 1.0.0.1#53
Fri Jun 21 04:24:40 2024 daemon.info dnsmasq[1]: using only locally-known addresses for test
Fri Jun 21 04:24:40 2024 daemon.info dnsmasq[1]: using only locally-known addresses for onion
Fri Jun 21 04:24:40 2024 daemon.info dnsmasq[1]: using only locally-known addresses for localhost
Fri Jun 21 04:24:40 2024 daemon.info dnsmasq[1]: using only locally-known addresses for local
Fri Jun 21 04:24:40 2024 daemon.info dnsmasq[1]: using only locally-known addresses for invalid
Fri Jun 21 04:24:40 2024 daemon.info dnsmasq[1]: using only locally-known addresses for bind
Fri Jun 21 04:24:40 2024 daemon.info dnsmasq[1]: using only locally-known addresses for mydomain.net
Fri Jun 21 04:24:40 2024 user.notice firewall: Reloading firewall due to ifup of wan (eth0)
Fri Jun 21 04:24:41 2024 daemon.notice netifd: Interface 'wan6' is now up
Fri Jun 21 04:24:41 2024 daemon.info dnsmasq[1]: reading /tmp/resolv.conf.d/resolv.conf.auto
Fri Jun 21 04:24:41 2024 daemon.info dnsmasq[1]: using nameserver 1.1.1.1#53
Fri Jun 21 04:24:41 2024 daemon.info dnsmasq[1]: using nameserver 1.0.0.1#53
Fri Jun 21 04:24:41 2024 daemon.info dnsmasq[1]: using nameserver XXXX:XXXX:XXX:X::1#53
Fri Jun 21 04:24:41 2024 daemon.info dnsmasq[1]: using nameserver XXXX:XXXX:XXX:X::1#53
Fri Jun 21 04:24:41 2024 daemon.info dnsmasq[1]: using only locally-known addresses for test
Fri Jun 21 04:24:41 2024 daemon.info dnsmasq[1]: using only locally-known addresses for onion
Fri Jun 21 04:24:41 2024 daemon.info dnsmasq[1]: using only locally-known addresses for localhost
Fri Jun 21 04:24:41 2024 daemon.info dnsmasq[1]: using only locally-known addresses for local
Fri Jun 21 04:24:41 2024 daemon.info dnsmasq[1]: using only locally-known addresses for invalid
Fri Jun 21 04:24:41 2024 daemon.info dnsmasq[1]: using only locally-known addresses for bind
Fri Jun 21 04:24:41 2024 daemon.info dnsmasq[1]: using only locally-known addresses for mydomain.net
Fri Jun 21 04:24:41 2024 daemon.info dnsmasq[1]: read /etc/hosts - 12 names
Fri Jun 21 04:24:41 2024 daemon.info dnsmasq[1]: read /tmp/hosts/dhcp.cfg01411c - 13 names
Fri Jun 21 04:24:41 2024 daemon.info dnsmasq[1]: read /tmp/hosts/odhcpd - 12 names
Fri Jun 21 04:24:41 2024 daemon.info dnsmasq-dhcp[1]: read /etc/ethers - 0 addresses
Fri Jun 21 04:24:41 2024 user.notice firewall: Reloading firewall due to ifup of wan6 (eth0)
Fri Jun 21 04:28:52 2024 daemon.info dnsmasq-dhcp[1]: DHCPREQUEST(br-lan.13) 192.168.13.13 XX:XX:XX:XX:XX:XX
Fri Jun 21 04:28:52 2024 daemon.info dnsmasq-dhcp[1]: DHCPACK(br-lan.13) 192.168.13.13 XX:XX:XX:XX:XX:XX pc-1
Fri Jun 21 04:28:54 2024 daemon.info dnsmasq-dhcp[1]: DHCPREQUEST(br-lan.13) 192.168.13.13 XX:XX:XX:XX:XX:XX
Fri Jun 21 04:28:54 2024 daemon.info dnsmasq-dhcp[1]: DHCPACK(br-lan.13) 192.168.13.13 XX:XX:XX:XX:XX:XX pc-1
Fri Jun 21 04:28:57 2024 daemon.info dnsmasq-dhcp[1]: DHCPREQUEST(br-lan.13) 192.168.13.13 XX:XX:XX:XX:XX:XX
Fri Jun 21 04:28:57 2024 daemon.info dnsmasq-dhcp[1]: DHCPACK(br-lan.13) 192.168.13.13 XX:XX:XX:XX:XX:XX pc-1
Fri Jun 21 04:28:58 2024 daemon.info dnsmasq[1]: read /etc/hosts - 12 names
Fri Jun 21 04:28:58 2024 daemon.info dnsmasq[1]: read /tmp/hosts/dhcp.cfg01411c - 13 names
Fri Jun 21 04:28:58 2024 daemon.info dnsmasq[1]: read /tmp/hosts/odhcpd - 8 names
Fri Jun 21 04:28:58 2024 daemon.info dnsmasq-dhcp[1]: read /etc/ethers - 0 addresses
Fri Jun 21 04:29:03 2024 daemon.info dnsmasq-dhcp[1]: DHCPREQUEST(br-lan.13) 192.168.13.13 XX:XX:XX:XX:XX:XX
Fri Jun 21 04:29:03 2024 daemon.info dnsmasq-dhcp[1]: DHCPACK(br-lan.13) 192.168.13.13 XX:XX:XX:XX:XX:XX pc-1
Fri Jun 21 04:29:04 2024 daemon.info dnsmasq-dhcp[1]: DHCPREQUEST(br-lan.13) 192.168.13.13 XX:XX:XX:XX:XX:XX
Fri Jun 21 04:29:04 2024 daemon.info dnsmasq-dhcp[1]: DHCPACK(br-lan.13) 192.168.13.13 XX:XX:XX:XX:XX:XX pc-1
Fri Jun 21 04:29:08 2024 daemon.info dnsmasq-dhcp[1]: DHCPREQUEST(br-lan.13) 192.168.13.13 XX:XX:XX:XX:XX:XX
Fri Jun 21 04:29:08 2024 daemon.info dnsmasq-dhcp[1]: DHCPACK(br-lan.13) 192.168.13.13 XX:XX:XX:XX:XX:XX pc-1
Fri Jun 21 04:29:22 2024 daemon.info dnsmasq-dhcp[1]: DHCPDISCOVER(br-lan.13) 192.168.13.13 XX:XX:XX:XX:XX:XX
Fri Jun 21 04:29:22 2024 daemon.info dnsmasq-dhcp[1]: DHCPOFFER(br-lan.13) 192.168.13.13 XX:XX:XX:XX:XX:XX
Fri Jun 21 04:29:26 2024 daemon.info dnsmasq-dhcp[1]: DHCPDISCOVER(br-lan.13) 192.168.13.13 XX:XX:XX:XX:XX:XX
Fri Jun 21 04:29:26 2024 daemon.info dnsmasq-dhcp[1]: DHCPOFFER(br-lan.13) 192.168.13.13 XX:XX:XX:XX:XX:XX
Fri Jun 21 04:29:31 2024 daemon.info dnsmasq-dhcp[1]: DHCPDISCOVER(br-lan.13) 192.168.13.13 XX:XX:XX:XX:XX:XX
...
This crash seems awfully similar to what I was experiencing with my Belkin, but this time I'm able to at least see logs since the wireless remained up. Is there some kind of misconfiguration on my end that could cause a random crash like this? I don't exactly know what's happening in the stack trace. Could it at all be related to what I was experiencing in my other post with the Belkin?
I have nothing extra configured on this MT-3000 device besides a few static DHCP leases and 3 VLANs. This configuration seems to work just fine. The load average on the device never crosses 0.60. This device is also plugged into an AVR UPS, just like the Belkin was - which I explained in the linked post above.
I'm getting a bit discouraged as I'm now seeing instability with two devices with what seems to be a normal configuration. In total, this device was up for 22 days and my Belkin has only lasted about 30 days before a crash. I understand I could run a script to have the router reboot every so often, but I'd rather not have to do that and figure out the root cause especially since I have had crashes occur only after a couple of days on my Belkin.
Here is the MT-3000's configuration:
ubus call system board
{
"kernel": "5.15.150",
"hostname": "OpenWrt",
"system": "ARMv8 Processor rev 4",
"model": "GL.iNet GL-MT3000",
"board_name": "glinet,gl-mt3000",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "23.05.3",
"revision": "r23809-234f1a2efa",
"target": "mediatek/filogic",
"description": "OpenWrt 23.05.3 r23809-234f1a2efa"
}
}
cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd6a:a542:bb32::/48'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth1'
config interface 'lan'
option device 'br-lan.13'
option proto 'static'
option ipaddr '192.168.13.1'
option netmask '255.255.255.0'
option ip6assign '60'
config interface 'wan'
option device 'eth0'
option proto 'dhcp'
option peerdns '0'
list dns '1.1.1.1'
list dns '1.0.0.1'
config interface 'wan6'
option device 'eth0'
option proto 'dhcpv6'
config bridge-vlan
option device 'br-lan'
option vlan '13'
list ports 'eth1:t'
config bridge-vlan
option device 'br-lan'
option vlan '69'
list ports 'eth1:t'
config bridge-vlan
option device 'br-lan'
option vlan '420'
list ports 'eth1:t'
config interface 'dmz'
option proto 'static'
option device 'br-lan.69'
option ipaddr '192.168.69.1'
option netmask '255.255.255.0'
config interface 'guest'
option proto 'static'
option device 'br-lan.420'
option ipaddr '192.168.42.1'
option netmask '255.255.255.0'
cat /etc/config/wireless
config wifi-device 'radio0'
option type 'mac80211'
option path 'platform/18000000.wifi'
option channel '9'
option band '2g'
option htmode 'HE20'
option country 'US'
option cell_density '0'
config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'WiFi Main'
option encryption 'sae'
option key 'password'
config wifi-device 'radio1'
option type 'mac80211'
option path 'platform/18000000.wifi+1'
option channel '132'
option band '5g'
option htmode 'HE80'
option country 'US'
option cell_density '0'
config wifi-iface 'wifinet1'
option device 'radio1'
option mode 'ap'
option ssid 'WiFi Main'
option encryption 'sae'
option key 'password'
option network 'lan'
config wifi-iface 'wifinet2'
option device 'radio0'
option mode 'ap'
option ssid 'WiFi Guest'
option encryption 'sae'
option isolate '1'
option key 'password'
option network 'guest'
cat /etc/config/dhcp
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/mydomain.net/'
option domain 'lan'
option expandhosts '1'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option localservice '1'
option ednspacket_max '1232'
list address '/mydomain.net/192.168.69.69'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '48h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
config host
option name 'pc-1'
option dns '1'
list mac 'XX:XX:XX:XX:XX:XX'
option ip '192.168.13.13'
config host
option name 'switch'
list mac 'XX:XX:XX:XX:XX:XX'
option ip '192.168.13.2'
config dhcp 'dmz'
option interface 'dmz'
option start '100'
option limit '150'
option leasetime '12h'
config host
option name 'server'
option dns '1'
list mac 'XX:XX:XX:XX:XX:XX'
option ip '192.168.69.69'
config host
option name 'printer'
option dns '1'
list mac 'XX:XX:XX:XX:XX:XX'
option ip '192.168.13.75'
config host
option name 'firestick'
option dns '1'
list mac 'XX:XX:XX:XX:XX:XX'
option ip '192.168.13.50'
config host
option name 'pc-2'
option dns '1'
list mac 'XX:XX:XX:XX:XX:XX'
option ip '192.168.13.12'
config dhcp 'guest'
option interface 'guest'
option start '100'
option limit '150'
option leasetime '12h'
cat /etc/config/firewall
config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config zone
option name 'guest'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
list network 'guest'
config zone
option name 'dmz'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
list network 'dmz'
config forwarding
option src 'dmz'
option dest 'wan'
config forwarding
option src 'lan'
option dest 'dmz'
config forwarding
option src 'guest'
option dest 'wan'
config forwarding
option src 'lan'
option dest 'guest'
config rule
option name 'Allow-DHCP-DNS-guest'
option src 'guest'
option dest_port '67 547 53'
option target 'ACCEPT'
config rule
option name 'Allow-DHCP-DNS-dmz'
option src 'dmz'
option dest_port '67 547 53'
option target 'ACCEPT'
config rule
option name 'Allow-server-guest'
option src 'guest'
option dest 'dmz'
list dest_ip '192.168.69.69'
option dest_port '80 443'
option target 'ACCEPT'
list proto 'tcp'
list proto 'udp'
Thank you for the help.