Does my guest interface look OK and will my firewall rules work for my IoT and IoT-WAN zones?

Installing and Using OpenWrt
1

I added the iot and iot_wan interfaces today and noticed that they look different in /etc/config/network to the existing guest interface as that has "option device 'br-guest'" under it. They're all wireless-only interfaces and in /etc/config/wireless the Visuals-Guest SSID is assigned to Network: guest, so is that OK or do I need to change it?

The Visuals-IoT SSID is assigned to Network: iot and the the Visuals-IoT(WAN) SSID is assigned to Network: iot_wan and they'll be used for stuff like Echo Dots, Smart Plugs and Lights, etc.

There's also a Visuals-SRV SSID which is assigned to Network: srv_lan, which is a bridge/vlan on the lan4 port which a Proxmox server running a few things, including Frigate and Home Assistant, is connected to. I may use this SSID to connect any WiFi cameras to keep them separate from the other IoT devices.

What I want to achieve with my firewall rules is:

  1. allow devices connected to Visuals-IoT(WAN) to access the WAN and devices on Visuals-IoT but not the LAN or SRV, whilst allowing the LAN and SRV networks to access them.
  2. allow devices connected to Visuals-IoT to access devices on Visuals-IoT(WAN) but not the WAN, the LAN or SRV, whilst allowing the LAN and SRV networks to access them.
  3. allow devices connected to Visuals-SRV to access devices on SRV and vice-versa, but not the WAN or the LAN.

Are my Firewall rules correct to achieve this? I've installed the avahi-nodbus-daemon and edited /etc/avahi/avahi-daemon.conf to set enable-reflector=yes but is set allow-interfaces=br-lan,eth1 correct or do I need to add the wireless interfaces that the IoT devices are using too, like phy0-ap0?

ubus call system board

{
        "kernel": "6.6.86",
        "hostname": "OpenWrt",
        "system": "ARMv7 Processor rev 0 (v7l)",
        "model": "Netgear Nighthawk X4S R7800",
        "board_name": "netgear,r7800",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "24.10.1",
                "revision": "r28597-0425664679",
                "target": "ipq806x/generic",
                "description": "OpenWrt 24.10.1 r28597-0425664679",
                "builddate": "1744562312"
        }
}

cat /etc/config/network


config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd4c:dc35:91a9::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config bridge-vlan
        option device 'br-lan'
        option vlan '1'
        list ports 'lan1:u*'
        list ports 'lan2:u*'
        list ports 'lan3:u*'

config bridge-vlan
        option device 'br-lan'
        option vlan '55'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan.1'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'srv_lan'
        option proto 'static'
        option device 'br-lan.55'
        option ipaddr '10.10.55.1'
        option netmask '255.255.255.0'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config interface 'guest'
        option proto 'static'
        option device 'br-guest'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'

config route
        option interface 'srv_lan'
        option target '10.10.18.0'
        option netmask '255.255.255.0'
        option gateway '10.10.55.102'

config interface 'iot'
        option proto 'static'
        option ipaddr '192.168.30.1'
        option netmask '255.255.255.0'

config interface 'iot_wan'
        option proto 'static'
        option ipaddr '192.168.40.1'
        option netmask '255.255.255.0'

cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'soc/1b700000.pci/pci0001:00/0001:00:00.0/0001:01:00.0'
        option band '2g'
        option channel '6'
        option cell_density '0'
        option country 'GB'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'Visuals-X'
        option encryption 'psk2'
        option key 'x'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'soc/1b500000.pci/pci0000:00/0000:00:00.0/0000:01:00.0'
        option band '5g'
        option channel '161'
        option htmode 'VHT80'
        option cell_density '0'
        option country 'GB'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'Visuals'
        option encryption 'psk2'
        option key 'x'

config wifi-iface 'wifinet2'
        option device 'radio1'
        option mode 'ap'
        option ssid 'Visuals-SRV'
        option encryption 'psk2'
        option key 'x'
        option network 'srv_lan'

config wifi-iface 'wifinet3'
        option device 'radio0'
        option mode 'ap'
        option ssid 'Visuals-Guest'
        option encryption 'psk2'
        option key x'
        option network 'guest'

config wifi-iface 'wifinet4'
        option device 'radio0'
        option mode 'ap'
        option ssid 'Visuals-24G'
        option encryption 'psk2'
        option key 'x'
        option network 'lan'

config wifi-iface 'wifinet5'
        option device 'radio0'
        option mode 'ap'
        option ssid 'Visuals-IoT'
        option encryption 'psk2'
        option key 'x'
        option network 'iot'

config wifi-iface 'wifinet6'
        option device 'radio0'
        option mode 'ap'
        option ssid 'Visuals-SRV'
        option encryption 'psk2'
        option key 'x'
        option network 'srv_lan'

config wifi-iface 'wifinet7'
        option device 'radio0'
        option mode 'ap'
        option ssid 'Visuals-IoT(WAN)'
        option encryption 'sae-mixed'
        option hidden '1'
        option key 'x'
        option ocv '0'
        option network 'iot_wan'

cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'
        option confdir '/tmp/dnsmasq.d'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'IoT_WAN'
        option interface 'IoT_WAN'
        option start '100'
        option limit '50'
        option leasetime '12h'
        option dhcpv4 'server'

config host
        option name 'Mums-i5'
        option dns '1'
        option mac 'x'
        option ip '192.168.1.101'

config host
        option name 'Dads-PC'
        option dns '1'
        option mac 'x'
        option ip '192.168.1.100'

config host
        option name 'Wiser-Hub'
        option dns '1'
        option mac 'x'
        option ip '192.168.1.136'

config host
        option name 'Wyze-1'
        option dns '1'
        option mac 'x'
        option ip '192.168.1.110'

config host
        option name 'Wyze-2'
        option dns '1'
        option mac 'x'
        option ip '192.168.1.111'

config host
        option name 'Wyze-3'
        option dns '1'
        option mac 'x'
        option ip '192.168.1.112'

config host
        option name 'KASA-KP303-PlugStrip'
        option dns '1'
        option mac 'x'
        option ip '192.168.1.120'

config host
        option name 'Tapo-P110-Plug'
        option dns '1'
        option mac 'x
        option ip '192.168.1.121'

config host
        option name 'Tapo-L900-Lightstrip'
        option dns '1'
        option mac 'x'
        option ip '192.168.1.130'

config host
        option name 'TPLink-HS100-Plug'
        option dns '1'
        option mac 'x'
        option ip '192.168.1.122'

config host
        option name 'TP-Link-HS100-Plug-2'
        option dns '1'
        option mac 'x'
        option ip '192.168.1.123'

config dhcp 'SRVLAN'
        option interface 'SRVLAN'
        option start '250'
        option limit '3'
        option leasetime '12h'

config dhcp 'srv_lan'
        option interface 'srv_lan'
        option start '200'
        option limit '50'
        option leasetime '12h'

config dhcp 'guest'
        option interface 'guest'
        option start '100'
        option limit '50'
        option leasetime '12h'

config host
        option name 'Redmi-Note-14.lan'
        list mac 'x'
        option ip '192.168.1.102'

config host
        option name 'POCO-X6-5G.lan'
        list mac 'x
        option ip '192.168.1.103'

config host
        option name 'POCO-X3-Pro.lan'
        list mac 'x'
        option ip '192.168.1.104'

config dhcp 'iot'
        option interface 'iot'
        option start '100'
        option limit '150'
        option leasetime '12h'

config dhcp 'iot_wan'
        option interface 'iot_wan'
        option start '100'
        option limit '150'
        option leasetime '12h'

cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        list network 'srv_lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config include 'nss_ecm'
        option type 'script'
        option path '/etc/firewall.d/qca-nss-ecm'
        option family 'any'
        option reload '1'

config zone
        option name 'Guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'guest'

config zone
        option name 'IoT_WAN'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'iot_wan'

config forwarding
        option src 'IoT_WAN'
        option dest 'wan'

config forwarding
        option src 'lan'
        option dest 'IoT_WAN'

config zone
        option name 'IoT'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'iot'

config rule
        option name 'Guest DNS'
        option src 'Guest'
        option dest_port '53'
        option target 'ACCEPT'

config forwarding
        option src 'lan'
        option dest 'IoT'

config rule
        option name 'IoT DNS'
        option src 'IoT'
        option target 'ACCEPT'
        option dest_port '53'

config rule
        option name 'IoT-WAN DNS'
        option src 'IoT_WAN'
        option dest_port '53'
        option target 'ACCEPT'

config zone
        option name 'SRVLAN'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'srv_lan'

config forwarding
        option src 'SRVLAN'
        option dest 'wan'

config forwarding
        option src 'lan'
        option dest 'SRVLAN'

config forwarding
        option src 'Guest'
        option dest 'wan'

config rule
        option name 'Guest DHCP'
        list proto 'udp'
        option src 'Guest'
        option dest_port '67'
        option target 'ACCEPT'

config rule
        option name 'IoT DHCP'
        list proto 'udp'
        option src 'IoT'
        option dest_port '67'
        option target 'ACCEPT'

config rule
        option name 'IoT-WIN DHCP'
        list proto 'udp'
        option src 'IoT_WAN'
        option dest_port '67'
        option target 'ACCEPT'

config rule
        option src 'SRVLAN'
        option dest_port '53'
        option target 'ACCEPT'
        option name 'SRV DNS'

config forwarding
        option src 'SRVLAN'
        option dest 'lan'

config nat
        option name 'Prevent MAS for 10.10.18.0/24'
        option family 'ipv4'
        list proto 'all'
        option src 'wan'
        option src_ip '10.10.55.0/24'
        option dest_ip '10.10.18.0/24'
        option target 'ACCEPT'

config rule
        option src '*'
        option name 'allow mDNS'
        list proto 'udp'
        option src_port '5353'
        list dest_ip '224.0.0.251'
        option dest_port '5353'
        option target 'ACCEPT'

config forwarding
        option src 'IoT_WAN'
        option dest 'IoT'

config forwarding
        option src 'IoT'
        option dest 'IoT_WAN'

config forwarding
        option src 'SRVLAN'
        option dest 'IoT'

config forwarding
        option src 'SRVLAN'
        option dest 'IoT_WAN'
2

unrelated, but this release have been EOL:ed.

3

Thanks, yeah I'll update it soon.