Hey guys, I followed this tutorial in order to get my IOT and guest networks setup (However what I did differently was setup the IOT interface exactly like how the guest interface is setup, expect using a different different ip address for the interface). Everything is working fine expect for accessing my devices connected to it through their hostname, I get a DNS_PROBE_FINISHED_NXDOMAIN error when I try to access my raspberry pi's web server. Any fix for this?
I have a Archer A7 v5 running Openwrt v19.07.7. Here's what my settings look like as of now (removed some settings to show only the changes I've made).
Network
config interface 'guest'
option type 'bridge'
option proto 'static'
option netmask '255.255.255.0'
option ipaddr '10.23.36.0'
config interface 'iot'
option type 'bridge'
option proto 'static'
option netmask '255.255.255.0'
option ipaddr '192.168.4.1'
config interface 'tun0'
option proto 'none'
option ifname 'tun0'
option auto '0'
Firewall
config zone
option name 'iot'
option output 'ACCEPT'
option input 'ACCEPT'
option network 'iot'
option forward 'REJECT'
config forwarding
option dest 'iot'
option src 'lan'
config forwarding
option dest 'wan'
option src 'iot'
config zone
option forward 'REJECT'
option name 'guest'
option output 'ACCEPT'
option input 'REJECT'
option network 'guest'
config forwarding
option dest 'wan'
option src 'guest'
config rule
option src 'guest'
option name 'Guest DHCP and DNS'
option target 'ACCEPT'
option dest_port '53 67-68'
config rule
option src 'iot'
option name 'IOT DHCP and DNS'
option dest_port '53 67-68'
option target 'ACCEPT'
config rule 'ovpn'
option name 'Allow-OpenVPN'
option dest_port '1194'
option proto 'udp'
option target 'ACCEPT'
option src 'wan'
config zone
option input 'ACCEPT'
option forward 'ACCEPT'
option name 'VPNZone'
option output 'ACCEPT'
option network 'tun0'
config forwarding
option dest 'iot'
option src 'VPNZone'
config forwarding
option dest 'wan'
option src 'VPNZone'
How do I set it up for different subnets then? I can't switch the domain to lan because my computers' file explorer does not recognize .lan for some reason, they by default use .local and I can't change them to use .lan
In any case, you should not mix mDNS and DNS as they are completely different technologies.
It is not trivial to pass/resolve mDNS across subnets, instead you can set up static leases.
The hostnames configured with active static leases can be resolved from any downstream subnet.
If you also need to resolve inactive leases/hostnames, set up hostnames as well.
I do have hostnames setup for the devices on the router's side, but they still do not work. And the interface also has a static DHCP setup for it aswell, and that didn't fix the issues at all
DNS relies on the unicast traffic.
The .local domain uses mDNS which relies on the multicast traffic.
Dnsmasq cannot resolve multicast mDNS queries.
You must not use nslookup to check the .local domain records.
Change your domain and try again.
But how do I make my computers not use .local? For some reason with Windows 10 in particular it forces .local in the beginning of all of the hostname urls, even when I specifiy .lan. If that can't be changed, then what's an alternative to dnsmasq? Before I had Openwrt, the network was setup to use .local and it worked then, why is it impossible to set it up now that way?
When you try to access a .local domain in a file manager, it sends a multicast query.
This query is answered by the neighbor hosts directly, bypassing all DNS servers.
Since you split the network to different subnets, it's becomes problematic.
The multicast traffic cannot reach hosts in a different subnet.
Either forget about mDNS and use plain DNS, or try to configure mDNS routing.
The relevant links for both cases are posted above.
The guide's not working for me, followed everything but my devices on my lan network still can't ping to the devices on teh IOT network. And when I reload the firewall, it just says this
* Rule 'Allow mDNS'
! Skipping due to different family of ip address
I enabled reflector in avahi and I also added allowed interfaces (br-lan and br-iot), but it's not working still
Config for Avahi firewall rules
config rule
option src_port '5353'
option src 'lan'
option name 'Allow mDNS for LAN'
option target 'ACCEPT'
list dest_ip '224.0.0.251'
option dest_port '5353'
list proto 'udp'
option dest 'iot'
config rule
option src_port '5353'
option src 'iot'
option name 'Allow mDNS for IOT'
option target 'ACCEPT'
list dest_ip '224.0.0.251'
option dest_port '5353'
list proto 'udp'
option dest 'lan'
config rule
option src_port '5353'
option src '*'
option name 'Allow mDNS'
option target 'ACCEPT'
option dest_port '5353'
list proto 'udp'
list dest_ip '224.0.0.251'
option enabled '0'