Failed to send request: Operation not permitted

Installing and Using OpenWrt
1

I can't install/update my packages

# opkg update
Downloading https://downloads.openwrt.org/releases/24.10.0/targets/ramips/mt7621/packages/Packages.gz
Failed to send request: Operation not permitted
...

# nslookup www.google.com
nslookup: write to '127.0.0.1': Connection refused
nslookup: write to '::1': Connection refused
;; connection timed out; no servers could be reached

Now, I clearly can connect to the internet, what am I missing? I do have several subnets configured, and each of them have 8.8.8.8 and 1.1.1.1 specified under custom DNS.

2

You are missing dnsmasq on localhost.

3

I think this is a misconception about how OpenWrt works...

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall
1 Like
5 
BusyBox v1.36.1 (2025-02-03 23:09:37 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 24.10.0, r28427-6df0e3d02a
 -----------------------------------------------------
root@Hall:~# ubus call system board
config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall{
        "kernel": "6.6.73",
        "hostname": "Hall",
        "system": "MediaTek MT7621 ver:1 eco:3",
        "model": "Linksys EA8100",
        "board_name": "linksys,ea8100-v1",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "24.10.0",
                "revision": "r28427-6df0e3d02a",
                "target": "ramips/mt7621",
                "description": "OpenWrt 24.10.0 r28427-6df0e3d02a",
                "builddate": "1738624177"
        }
}
root@Hall:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd63:3d37:2f9b::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config device
        option name 'lan1'
        option macaddr 'AA:BB:CC:E4:F9:00'

config device
        option name 'lan2'
        option macaddr 'AA:BB:CC:E4:F9:00'

config device
        option name 'lan3'
        option macaddr 'AA:BB:CC:E4:F9:00'

config device
        option name 'lan4'
        option macaddr 'AA:BB:CC:E4:F9:00'

config interface 'lan'
        option device 'br-lan.1'
        option proto 'static'
        option ip6assign '60'
        list ipaddr '192.168.214.1/24'
        list dns '8.8.8.8'
        list dns '1.1.1.1'

config device
        option name 'wan'
        option macaddr 'AA:BB:CC:E4:F9:00'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config bridge-vlan
        option device 'br-lan'
        option vlan '1'
        list ports 'lan1:u*'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config bridge-vlan
        option device 'br-lan'
        option vlan '2'
        list ports 'lan1:t'

config device 'device_home'
        option type 'bridge'
        option name 'br-home'

config interface 'subnet_home'
        option proto 'static'
        option device 'br-home'
        option ipaddr '192.168.9.1/24'
        list dns '8.8.8.8'
        list dns '1.1.1.1'

config device 'device_guest'
        option type 'bridge'
        option name 'br-guest'

config interface 'subnet_guest'
        option proto 'static'
        option device 'br-guest'
        option ipaddr '192.168.247.1/24'
        list dns '8.8.8.8'
        list dns '1.1.1.1'

config device 'device_iot'
        option type 'bridge'
        option name 'br-iot'

config interface 'subnet_iot'
        option proto 'static'
        option device 'br-iot'
        option ipaddr '192.168.249.1/24'
        list dns '8.8.8.8'
        list dns '1.1.1.1'

root@Hall:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
        option channel '1'
        option band '2g'
        option htmode 'HT20'
        option country 'SG'

config wifi-device 'radio1'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
        option channel 'auto'
        option band '5g'
        option htmode 'HT20'
        option cell_density '0'
        option country 'SG'

config wifi-iface 'wifinet3'
        option device 'radio1'
        option mode 'ap'
        option ssid '3ux50'
        option encryption 'sae-mixed'
        option key 'aaaaaaaaaaaaaaaaaaaaaaaaaa'
        option network 'lan'
        option ieee80211r '1'
        option nasid '123f'
        option ft_over_ds '0'
        option ocv '0'

config wifi-iface 'wifinet4'
        option device 'radio1'
        option mode 'mesh'
        option encryption 'sae'
        option mesh_id 'mesh50@TSM'
        option mesh_fwding '1'
        option mesh_rssi_threshold '0'
        option key 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'
        option network 'lan'

config wifi-iface 'mesh_hall24'
        option mode 'mesh'
        option encryption 'sae'
        option mesh_fwding '1'
        option mesh_rssi_threshold '0'
        option network 'lan'
        option mesh_id 'mesh24@TSM'
        option key 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'
        option device 'radio0'

config wifi-iface 'mesh_hall50'
        option mode 'mesh'
        option encryption 'sae'
        option mesh_fwding '1'
        option mesh_rssi_threshold '0'
        option network 'lan'
        option mesh_id 'mesh50@TSM'
        option key 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'
        option device 'radio1'

config wifi-iface 'wifi_home'
        option device 'radio0'
        option mode 'ap'
        option network 'subnet_home'
        option ssid 'rtfckut'
        option encryption 'sae-mixed'
        option key 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'

config wifi-iface 'wifi_guest'
        option device 'radio0'
        option mode 'ap'
        option network 'subnet_guest'
        option ssid 'G@TSM'
        option encryption 'sae-mixed'
        option key 'guestnetwork'

config wifi-iface 'wifi_iot'
        option device 'radio0'
        option mode 'ap'
        option network 'subnet_iot'
        option ssid 'I@TSM'
        option encryption 'sae-mixed'
        option key 'iotnetwork'

root@Hall:~# cat /etc/config/dhcp

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config host
[redacted]    

config dnsmasq 'dns_lan'
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases.lan'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'
        option logqueries '1'
        list interface 'lan'
        list notinterface 'loopback'
        list addnhosts '/root/blocked/214-dns-records'

config dhcp 'net_lan'
        option instance 'dns_lan'
        option interface 'lan'
        option start '10'
        option limit '250'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dnsmasq 'dns_subnet_home'
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/subnet_home/'
        option domain 'subnet_home'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases.subnet_home'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'
        option logqueries '1'
        list interface 'subnet_home'
        list notinterface 'loopback'

config dhcp 'net_subnet_home'
        option instance 'dns_subnet_home'
        option interface 'subnet_home'
        option start '10'
        option limit '250'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

root@Hall:~# cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option flow_offloading '1'
        option flow_offloading_hw '1'
        option synflood_protect '1'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config forwarding
        option src 'zone_home'
        option dest 'wan'

config forwarding
        option src 'zone_home'
        option dest 'lan'

config forwarding
        option src 'lan'
        option dest 'zone_home'

config zone 'zone_home'
        option name 'zone_home'
        option network 'subnet_home'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config forwarding 'rule_home_wan'
        option src 'zone_home'
        option dest 'lan'

config rule 'rule_home_dns'
        option name '[home] Allow-DNS'
        option src 'zone_home'
        option dest_port '53'
        option proto 'tcp udp'
        option target 'ACCEPT'

config rule 'rule_home_dhcp'
        option name '[home] Allow-DHCP'
        option src 'zone_home'
        option dest_port '67'
        option proto 'udp'
        option family 'ipv4'
        option target 'ACCEPT'

config zone 'zone_guest'
        option name 'zone_guest'
        option network 'subnet_guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config forwarding 'rule_guest_wan'
        option src 'zone_guest'
        option dest 'lan'

config rule 'rule_guest_dns'
        option name '[guest] Allow-DNS'
        option src 'zone_guest'
        option dest_port '53'
        option proto 'tcp udp'
        option target 'ACCEPT'

config rule 'rule_guest_dhcp'
        option name '[guest] Allow-DHCP'
        option src 'zone_guest'
        option dest_port '67'
        option proto 'udp'
        option family 'ipv4'
        option target 'ACCEPT'

config zone 'zone_iot'
        option name 'zone_iot'
        option network 'subnet_iot'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config forwarding 'rule_iot_wan'
        option src 'zone_iot'
        option dest 'lan'

config rule 'rule_iot_dns'
        option name '[iot] Allow-DNS'
        option src 'zone_iot'
        option dest_port '53'
        option proto 'tcp udp'
        option target 'ACCEPT'

config rule 'rule_iot_dhcp'
        option name '[iot] Allow-DHCP'
        option src 'zone_iot'
        option dest_port '67'
        option proto 'udp'
        option family 'ipv4'
        option target 'ACCEPT'

config redirect
        option target 'DNAT'
        option src 'wan'
        option dest 'lan'
        option dest_ip '192.168.214.3'
        option src_dport '80'
        option dest_port '80'
        option name 'HAProxy HTTP'

config redirect
        option target 'DNAT'
        option src 'wan'
        option dest 'lan'
        option dest_ip '192.168.214.3'
        option src_dport '443'
        option dest_port '443'
        option name 'HAProxy HTTPS'

config redirect
        option target 'DNAT'
        option src 'wan'
        option dest 'lan'
        option dest_ip '192.168.214.111'
        option src_dport '1443'
        option dest_port '443'
        option name 'WhatsApp'

config redirect
        option target 'DNAT'
        option src 'wan'
        option dest 'lan'
        option dest_ip '192.168.214.111'
        option src_dport '1587'
        option dest_port '587'
        option name 'WhatsApp Media'

config redirect
        option target 'DNAT'
        option src 'wan'
        option dest 'lan'
        option dest_ip '192.168.214.111'
        option src_dport '1188'
        option dest_port '1188'
        option name 'Telegram SOCKS5'

config redirect
        option target 'DNAT'
        option src 'wan'
        option dest 'lan'
        option dest_ip '192.168.214.111'
        option src_dport '1993'
        option dest_port '1993'
        option name 'docker mail'

config redirect
        option target 'DNAT'
        option src 'wan'
        option dest 'lan'
        option dest_ip '192.168.214.111'
        option src_dport '1465'
        option dest_port '1465'
        option name 'docker mail'

config redirect
        option target 'DNAT'
        option src 'wan'
        option dest 'lan'
        option dest_ip '192.168.214.111'
        option src_dport '4190'
        option dest_port '4190'
        option name 'docker mail' 

root@Hall:~#
6

Anything I can do to fix it?

7

You need to remove this from one of the dnsmasq instances.

3 Likes
8

thanks that worked, I had them all deleted. Would you mind explaining what that statement did to prevent DNS lookups?

9

This prevents dnsmasq from listening on the loopback interface, to which the router itself initiates the DNS queries (if the service is active).

3 Likes
10

Just curious, is there a reason you added that configuration?

1 Like
11

You can use HT40 in 5GHz , there is no channel scarcity in there.

1 Like
12

I used LuCI to configure what I want (multiple subnets) and then extracted the config into a script using uci. I think every additional subnet has that loopback, but not in the primary LAN.

Earlier, I removed list notinterface 'loopback' from every subnet, however, that caused the additional subnets to stop issuing IP addresses, so right now, I have it removed only on the primary LAN.

13

This statement is unclear. Loopback is it's own interface. You don't need to "remove loopback" from anywhere.

Glad you fixed it!

14

What I still don't understand is, why the primary LAN is able to issue IP addresses without that line of config but the secondary subnets cannot.

15

It is fairly simple:
by default dnsmasq listens on all interfaces
if you specify listen interface, then selected interface and loopback (127.1 and ::1) are kept
Once you start second dnsmasq with other interface selected it also wants to listen on loopback, but can not, so for subsequent dnsmasq-s you have to disable loopback listener for them.

16

As I suspected... list dns a.b.c.d is used to tell OpenWrt what DNS are available through that interface, not what DNS should use the clients on that interface; that option should be moved to the WAN interface.

1 Like