DNS resolution not working (VLANs)

tren · March 9, 2026, 8:05pm

Hi there,

I’m new to OpenWrt and currently running version 25.10. I’m trying to separate my network using VLANs and firewall rules. I’ve run into an issue: when I connect to VLAN 30 (port LAN3), I don’t get an IP. That’s intended, since I’m using a static IP rather than DHCP.

However, I’m unable to ping the router at 192.168.30.1. Ping to 8.8.8.8 works fine. DNS doesn’t work either, but if I manually set a DNS server on the client, it works. I’ve set up a firewall rule to allow clients in VLAN 30 to reach the router, but DNS still isn’t working.

I’ve set up VLAN 40 with the same configuration for clients, and everything works fine there.

Does anyone have any ideas on what might be causing this? I’m open to any recommendations or suggestions!

# cat /etc/config/network 

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	list ipaddr '127.0.0.1/8'

config globals 'globals'
	option dhcp_default_duid '00040e0ba9aab24e4a378841fe4fc3d8616e'
	option ula_prefix 'fdbf:37f2:374b::/48'
	option packet_steering '1'

config atm-bridge 'atm'
	option vpi '1'
	option vci '32'
	option encaps 'llc'
	option payload 'bridged'
	option nameprefix 'dsl'

config dsl 'dsl'
	option annex 'j'
	option tone 'b'
	option ds_snr_offset '0'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config interface 'lan'
	option device 'br-lan.10'
	option proto 'static'
	option ip6assign '60'
	list ipaddr '192.168.10.1/24'
	option multipath 'off'

config interface 'wan'
	option device 'lan1'
	option proto 'dhcp'

config bridge-vlan
	option device 'br-lan'
	option vlan '10'
	list ports 'lan2:t'
	list ports 'lan4'

config bridge-vlan
	option device 'br-lan'
	option vlan '20'
	list ports 'lan2:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '30'
	list ports 'lan2:t'
	list ports 'lan3'

config bridge-vlan
	option device 'br-lan'
	option vlan '40'
	list ports 'lan2:t'

config interface 'Clients'
	option proto 'static'
	option device 'br-lan.40'
	option ipaddr '192.168.40.1'
	option netmask '255.255.255.0'
	option multipath 'off'

config interface 'Guest_IoT'
	option proto 'static'
	option device 'br-lan.20'
	option ipaddr '192.168.20.1'
	option netmask '255.255.255.0'
	option multipath 'off'

config interface 'Server'
	option proto 'static'
	option device 'br-lan.30'
	option ipaddr '192.168.30.1'
	option netmask '255.255.255.0'
	option multipath 'off'

root@OpenWrt:~# cat /etc/config/firewall 

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'DROP'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'clients'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'Clients'

config forwarding
	option src 'clients'
	option dest 'wan'

config rule
	option src 'clients'
	option name 'Allow_DHCP_Clients'
	list proto 'udp'
	option dest_port '67-68'
	option target 'ACCEPT'

config rule
	option src 'clients'
	option name 'Allow_DNS_Clients'
	option dest_port '53'
	option target 'ACCEPT'

config zone
	option name 'server'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'Server'

config forwarding
	option src 'server'
	option dest 'wan'

config zone
	option name 'guestIoT'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'Guest_IoT'

config forwarding
	option src 'guestIoT'
	option dest 'wan'

config rule
	option src 'guestIoT'
	option name 'Allow_DHCP_GuestIoT'
	list proto 'udp'
	option dest_port '67-68'
	option target 'ACCEPT'

config rule
	option src 'guestIoT'
	option name 'Allow_DNS_GuestIoT'
	option dest_port '53'
	option target 'ACCEPT'

config rule
	option src 'server'
	option name 'Allow_DNS_Server'
	option dest_port '53'
	option target 'ACCEPT'


# cat /etc/config/dhcp 

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'disabled'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'
	option ignore '1'
	option ra_preference 'medium'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/odhcpd.leases'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'
	option piodir '/tmp/odhcpd-piodir'
	option hostsdir '/tmp/hosts'

config dhcp 'Clients'
	option interface 'Clients'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'

config dhcp 'Guest_IoT'
	option interface 'Guest_IoT'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'

Thanks in advance!

anon63541380 · March 9, 2026, 8:14pm

is dns server listening on those interfaces?

golialive · March 9, 2026, 8:43pm

I don’t know if that’s part of your problem, but you named your interface “Server”, starting with an upper case letter S but the firweal rule allowes incoming traffic on port 53 on “server”, starting with a lower case s.

pavelgl · March 9, 2026, 8:50pm

Since there is no DHCP pool created for VLAN 30 (Server), you need to set
everything manually on the clients - IP address, DNS, gateway.

The default input policy of the zone is set to REJECT, so you won't be able to access or ping the router unless you create permissive firewall rules.

tren · March 10, 2026, 2:16pm

Thank you for your responses.

What would you recommend to ensure that DNS works correctly and the gateway is set properly? Would it be best to create a DHCP pool and then disable the DHCP service?

tren · March 11, 2026, 6:35pm

My idea was to use static IP addresses on the management and server networks. One reason is that no one could simply plug into a port, obtain an IP, and gain access to the network. Another reason is that the server should always have the same IP. What would you recommend as a good setup?

From what I understand, DNS works only if DHCP is enabled. So, I could either disable DHCP and configure the IP, gateway, and DNS statically on the device, or enable DHCP and use static leases for the devices. Is my understanding correct?

golialive · March 11, 2026, 7:02pm

If you really want that: Enable DHCP in general but disable the “Dynamic DHCP” checkbox (which has the help text “Dynamically allocate DHCP addresses for clients. If disabled, only clients having static leases will be served”) and add fixed leases for known devices.

But frankly: I’d enable DHCP in general and use the start+limit settings to push dynamic clients to the upper area from 200 to 250 but still allow dynamic clients. Once or twice a year I’m debugging something by connecting a client device to my otherwise static VLAN, and I really like being able to use DHCP instead of manually switching to whatever static IP it’s in the VLAN I’m debugging.

I don’t consider not having DHCP enabled a security feature at all.

_bernd · March 11, 2026, 11:43pm

Nameserver can be distributed via router advertisement. No dhcpv6 needed.