I followed this tutorial to create a guest wifi zone isolated from my main wifi, but something failed at the end.
The info and screenshots are not updated, I deleted all the changes and came back to my previous config, but I could try again and give some logs.
let's see where you've currently landed with your configuration
Please copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall
# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'xxxxxxxxxxxxxxxxx'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0.1'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
config device
option name 'eth0.2'
option macaddr 'xxxxxxxxxxxxxxx'
config interface 'wan'
option proto 'pppoe'
option username 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
option password 'xxxxxxxxxxxxxxxxxx'
option ipv6 'auto'
option device 'eth0.835'
config interface 'wan6'
option device 'eth0.2'
option proto 'dhcpv6'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0t 2 3 4 5'
option vid '1'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '0t 1t'
option vid '835'
config interface 'Ghest'
option proto 'static'
option ipaddr '192.168.3.1'
option netmask '255.255.255.0'
option device 'wlan1-1'
# cat /etc/config/wireless
config wifi-device 'radio0'
option type 'mac80211'
option path 'pci0000:00/0000:00:00.0'
option band '5g'
option country 'IT'
option htmode 'VHT80'
option channel '36'
option cell_density '3'
config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'xxxxxxxxxxxxxxxx'
option encryption 'sae'
option key 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
config wifi-device 'radio1'
option type 'mac80211'
option path 'platform/ahb/18100000.wmac'
option band '2g'
option htmode 'HT20'
option country 'xx'
option cell_density '3'
option channel '6'
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
option encryption 'psk2'
option key 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;'
option hidden '1'
config wifi-iface 'wifinet2'
option device 'radio1'
option mode 'ap'
option encryption 'psk2'
option key 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
option isolate '1'
option network 'Gast'
option ssid 'xxxxxxxxxxxxxxxxxxxxxxxxx'
# cat /etc/config/dhcp
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option localservice '1'
option ednspacket_max '1232'
list server 'xxxxxxx'
list server 'xxxxxxxxx'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
option ra_slaac '1'
list ra_flags 'managed-config'
list ra_flags 'other-config'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
config host
option name 'xxxxxxxxxxxx'
option ip '192.168.1.xxx'
option mac 'xxxxxxxxxxxx'
config host
option name 'xxxxxxxxxxx'
option ip '192.168.1.xxx'
option mac 'xxxxxxxxxx'
config host
option ip '192.168.1.xxx'
option mac 'xxxxxxxxxxxxx'
root@OpenWrt:~# cat /etc/config/firewall
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config zone
option output 'ACCEPT'
option forward 'REJECT'
list network 'Gast'
option input 'REJECT'
option name 'Gast'
config rule
option dest_port '53'
option target 'ACCEPT'
option src 'Gast'
option name 'Gast DNS'
config rule
list proto 'udp'
option dest_port '67'
option target 'ACCEPT'
option src 'Gast'
option name 'Gast DHCP'
The network for this SSID is Gast but the network interface name below is Ghest -- they must match.
Change the network name below to Gast, and also delete the device line from this section:
you do not have a dhcp server for your guest network. Add one like this into your /etc/config/dhcp file:
config dhcp 'Gast'
option interface 'Gast'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
And your Gast network doesn't have forwarding to the wan allowed. Add this to your firewall config:
config forwarding
option src 'Gast'
option dest 'wan'
Thanks for the quick answer, I did all require changes, but still can't connect to Gast WLAN.
Let's see the latest config files.
Also, what happens when you attempt to connect? Is your device able to get an IP address? If so, what does it report for the IP, subnet mask, DNS, and router/gateway?
network
# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'xxxxxxxxxxxxxxxxxxx'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0.1'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
config device
option name 'eth0.2'
option macaddr 'b0:be:76:77:98:59'
config interface 'wan'
option proto 'pppoe'
option username 'xxxxxxxxxxxxxxxxxxxxxx'
option password 'xxxxxxxxxx'
option ipv6 'auto'
option device 'eth0.835'
config interface 'wan6'
option device 'eth0.2'
option proto 'dhcpv6'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0t 2 3 4 5'
option vid '1'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '0t 1t'
option vid '835'
config interface 'Gast'
option proto 'static'
option ipaddr '192.168.3.1'
option netmask '255.255.255.0'
# cat /etc/config/dhcp
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option localservice '1'
option ednspacket_max '1232'
list server 'xxxxxxxxx'
list server '9.9.9.9'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
option ra_slaac '1'
list ra_flags 'managed-config'
list ra_flags 'other-config'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
config host
option name 'xxxxxxxxxxxxxxxxxx'
option ip '192.168.1.236'
option mac 'xxxxxxxxxxxxxxxxxxx'
config host
option name 'xxxxxxxxxxxxxxxx'
option ip '192.168.1.164'
option mac 'xxxxxxxxxxxxxxxxx'
config host
option ip '192.168.1.153'
option mac 'xxxxxxxxxxxxxxxxxxx'
config dhcp 'Gast'
option interface 'Gast'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
# cat /etc/config/wireless
config wifi-device 'radio0'
option type 'mac80211'
option path 'pci0000:00/0000:00:00.0'
option band '5g'
option country 'xxxxxxxxx'
option htmode 'VHT80'
option channel '36'
option cell_density '3'
config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'xxxxxxxxxxxxxxxxxxxxxxxxxxx'
option encryption 'sae'
option key 'sssssssssssssssssssssssssssssssssssssssssssssssssss'
config wifi-device 'radio1'
option type 'mac80211'
option path 'platform/ahb/18100000.wmac'
option band '2g'
option htmode 'HT20'
option country 'IT'
option cell_density '3'
option channel '6'
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid xxxxxxxxxxxxxxxxx'
option encryption 'psk2'
option key 'sssssssssssssssssssssssssssssssssssssssssssssss'
option hidden '1'
config wifi-iface 'wifinet2'
option device 'radio1'
option mode 'ap'
option encryption 'psk2'
option key 'ssssssssssssssssssssssssssssssssssssssssssss'
option isolate '1'
option network 'Gast'
option ssid 'Gast'
# cat /etc/config/firewall
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config zone
option output 'ACCEPT'
option forward 'REJECT'
list network 'Gast'
option input 'REJECT'
option name 'Gast'
config rule
option dest_port '53'
option target 'ACCEPT'
option src 'Gast'
option name 'Gast DNS'
config rule
list proto 'udp'
option dest_port '67'
option target 'ACCEPT'
option src 'Gast'
option name 'Gast DHCP'
config forwarding
option src 'Gast'
option dest 'wan'
It seems to connect and only obtain a ipv6 address, no ipv4....but actually always connecting never connected.
For now, change the input rule below to ACCEPT
Still no connection
have you restarted the router since making the changes?
no, should I?
yes, please do. You at least need to restart the individual services... rebooting the router does all of that at the same time.
Now it works! Thanks so much for the help! should I revert the line input to reject on the firewall for security?