DNS, DHCP Rule Not Working for Outbound IoT Network Devices

Installing and Using OpenWrt Network and Wireless Configuration
1

Can anyone see if I've done something wrong in configuring an IoT Wi-Fi network in addition to my main LAN network?

I'm running OpenWrt SNAPSHOT r24870-ced3fbcda1 from today I believe and I can't connect to my IoT Wi-Fi network, I presume because devices on IoT can't get through to DHCP.

I'm running Unbound on the router for DNS, and I believe I've disabled dnsmasq from doing DNS. The IoT network uses unbound for DNS as well.

My firewall zones are as follows. To work around Input being set to Reject on the IoT zone, I've added a firewall rule to allow DNS/DHCP (and NTP) through to the router only.

image
image1053×269 25.4 KB

image
image1047×97 12.1 KB

This worked when I was running 22.03.5, but since installing the snapshot today, I've started my configuration from scratch because of DSA, and I'm not entirely convinced I haven't messed something up.

I'm on the verge of just wiping it and trying again, but before I do a second pair of eyes would be much appreciated!

/etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        option ipv6 '0'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '10.19.90.1'
        option netmask '255.255.255.0'
        option delegate '0'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config interface 'iot'
        option proto 'static'
        option ipaddr '10.10.7.1'
        option netmask '255.255.255.0'
        list dns '10.19.90.1'
        option type 'bridge'
        option device 'br-iot'

config device
        option type 'bridge'
        option name 'br-iot'
        option bridge_empty '1'
        option ipv6 '0'

/etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'soc/1b500000.pci/pci0000:00/0000:00:00.0/0000:01:00.0'
        option channel 'auto'
        option band '5g'
        option htmode 'VHT80'
        option disabled '0'
        option cell_density '0'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'soc/1b700000.pci/pci0001:00/0001:00:00.0/0001:01:00.0'
        option channel 'auto'
        option band '2g'
        option htmode 'HT20'
        option disabled '0'
        option cell_density '0'

config wifi-iface 'main'
        option device 'radio0'
        option mode 'ap'
        option ssid 'PPN-Main'
        option encryption 'psk2'
        option key 'REDACTED'
        option network 'lan'

config wifi-iface 'iot'
        option device 'radio1'
        option mode 'ap'
        option ssid 'PPN-IoT'
        option encryption 'psk2'
        option key 'REDACTED'
        option isolate '1'
        option network 'iot'

/etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'
        option localuse '0'
        option port '0'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '100'
        option leasetime '12h'
        list dhcp_option '6,10.19.90.1'

config dhcp 'iot'
        option interface 'iot'
        option start '100'
        option limit '100'
        option leasetime '12h'
        list dhcp_option '6,10.19.90.1'

/etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'iot'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'iot'

config forwarding
        option src 'iot'
        option dest 'wan'

config forwarding
        option src 'lan'
        option dest 'iot'

config rule
        option name 'Allow-LAN-to-IOT-Inbound'
        list proto 'all'
        option src 'lan'
        option dest 'iot'
        option target 'ACCEPT'

config rule
        option name 'Allow-IoT-DHCP-DNS-NTP'
        option src 'iot'
        list proto 'tcp'
        list proto 'udp'
        option src_port '53 67 123'
        option target 'ACCEPT'

config rule
        option src 'iot'
        option dest '*'
        option target 'REJECT'
        option name 'Block-IoT-Outbound'
        list proto 'all'
        list src_mac 'REDACTED'
        list src_mac 'REDACTED'
        list src_mac 'REDACTED'
        list src_mac 'REDACTED'
        list src_mac 'REDACTED'
        list src_mac 'REDACTED'
        list src_mac 'REDACTED'
        list src_mac 'REDACTED'
        list src_mac 'REDACTED'
        list src_mac 'REDACTED'
        list src_mac 'REDACTED'

config redirect
        option target 'DNAT'
        list proto 'udp'
        option src 'iot'
        option src_dport '123'
        option dest_port '123'
        option name 'Forward-IoT-NTP'
2

You might have a dns problem
You can check with:

ping 8.8.8.8
ping google.com

If it is a dns problem try this:
Remove from iot interface

Remove from dhcp lan and dhcp iot

On the wan zone set a trusted dns server e.g. 9.9.9.9

3

A simple check would be to set iot firewall default to allow input, then on-router services like DHCP and DNS will not be firewalled. If they still don't work it's a problem with the service not the firewall.

Your firewall configuration is unconventional-- the typical syntax is a separate rule for each service.

NTP from the Internet will be allowed by the general iot->wan forward allowed. That is not how to write a DNAT rule, nor do you need a DNAT rule for this.

1 Like
4

I must have configured something wrong, after a factory reset, everything was working again.

Thanks for the info @mk24 good to know!

5

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.