Thanks for the explanation.
I have now tried to configure this. But I don't really understand how to do that.
I have created the interfaces on both routers accordingly, configured with Static IP and added to firewall zone "lan"" I have created a separate network for 2,4g and 5g each.
Where I'm not quite sure how to create the interface for the wired connection, I don't have all the ports listed under devices. Does this need to be assigned to an exact port or is it eth0 or eth0.1?
And do I still need to add those to br-lan?
At least the route is not working currently.
Here are the outputs again.
Don't stone me if this is fundamentally wrong. These are my first steps with routing at this scale.
Router A
root@RouterA:~# ubus call system board; \
> uci export network; \
> uci export dhcp; uci export firewall; \
> ip -4 addr ; ip -4 ro li tab all ; ip -4 ru
{
"kernel": "5.10.146",
"hostname": "RouterA",
"system": "Atheros AR7161 rev 2",
"model": "Netgear WNDR3700",
"board_name": "netgear,wndr3700",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "22.03.2",
"revision": "r19803-9a599fee93",
"target": "ath79/generic",
"description": "OpenWrt 22.03.2 r19803-9a599fee93"
}
}
package network
config interface 'loopback'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
option device 'lo'
config globals 'globals'
option ula_prefix 'fd72:7341:3c62::/48'
config interface 'lan'
option proto 'static'
option ip6assign '60'
option ipaddr '10.0.0.1'
option delegate '0'
option stp '1'
option device 'br-lan'
option netmask '255.255.255.0'
config interface 'wan'
option _orig_ifname 'eth1'
option _orig_bridge 'false'
option proto 'static'
option ipaddr '141.3.xxx'
option netmask '255.255.254.0'
option gateway '141.3.xxx'
option dns '141.3.xxx'
option device 'eth1'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
option blinkrate '2'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0 1 2 3 5t'
config switch_port
option device 'switch0'
option port '1'
option led '6'
config switch_port
option device 'switch0'
option port '2'
option led '9'
config switch_port
option device 'switch0'
option port '5'
option led '2'
config route
option interface 'lan'
option target '192.168.1.0'
option netmask '255.255.255.0'
option gateway '10.0.1.2'
option metric '10'
config device
option name 'br-lan'
option type 'bridge'
option stp '1'
option hello_time '1'
option forward_delay '2'
option max_age '10'
list ports 'eth0.1'
option priority '20480'
config route
option interface 'lan'
option target '192.168.1.0/24'
option gateway '10.0.2.2'
option metric '25'
config route
option interface 'lan'
option target '192.168.1.0/24'
option gateway '10.0.3.2'
option metric '20'
option disabled '1'
config interface 'wifi_conn'
option proto 'static'
option ipaddr '10.0.2.1'
option netmask '255.255.255.0'
config interface 'wifi_5g_conn'
option proto 'static'
option ipaddr '10.0.3.1'
option netmask '255.255.255.0'
config interface 'wired_conn'
option proto 'static'
option ipaddr '10.0.1.1'
option netmask '255.255.255.0'
option device 'eth0'
package dhcp
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option localservice '1'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '200'
option leasetime '24h'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
config host
option name 'pc1'
option mac '28:ee:xx'
option ip '10.0.1.3'
config host
option name 'pc2'
option mac '00:1b:xx'
option ip '10.0.1.2'
config host
option name 'a3-vis'
option mac 'e0:cb:xx'
option ip '10.0.1.4'
package firewall
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
list network 'wifi_5g_conn'
list network 'wifi_conn'
list network 'wired_conn'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fe80::/10'
option src_port '547'
option dest_ip 'fe80::/10'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config rule
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP qlen 1000
inet 10.0.1.1/24 brd 10.0.1.255 scope global eth0
valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP qlen 1000
inet 141.3.xxx/23 brd 141.3.xxx scope global eth1
valid_lft forever preferred_lft forever
6: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
inet 10.0.0.1/24 brd 10.0.0.255 scope global br-lan
valid_lft forever preferred_lft forever
8: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
inet 10.0.2.1/24 brd 10.0.2.255 scope global wlan0
valid_lft forever preferred_lft forever
9: wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
inet 10.0.3.1/24 brd 10.0.3.255 scope global wlan1
valid_lft forever preferred_lft forever
default via 141.3.xxx dev eth1
10.0.0.0/24 dev br-lan scope link src 10.0.0.1
10.0.1.0/24 dev eth0 scope link src 10.0.1.1
10.0.2.0/24 dev wlan0 scope link src 10.0.2.1
10.0.3.0/24 dev wlan1 scope link src 10.0.3.1
141.3.xxx/23 dev eth1 scope link src 141.3.xxx
broadcast 10.0.0.0 dev br-lan table local scope link src 10.0.0.1
local 10.0.0.1 dev br-lan table local scope host src 10.0.0.1
broadcast 10.0.0.255 dev br-lan table local scope link src 10.0.0.1
broadcast 10.0.1.0 dev eth0 table local scope link src 10.0.1.1
local 10.0.1.1 dev eth0 table local scope host src 10.0.1.1
broadcast 10.0.1.255 dev eth0 table local scope link src 10.0.1.1
broadcast 10.0.2.0 dev wlan0 table local scope link src 10.0.2.1
local 10.0.2.1 dev wlan0 table local scope host src 10.0.2.1
broadcast 10.0.2.255 dev wlan0 table local scope link src 10.0.2.1
broadcast 10.0.3.0 dev wlan1 table local scope link src 10.0.3.1
local 10.0.3.1 dev wlan1 table local scope host src 10.0.3.1
broadcast 10.0.3.255 dev wlan1 table local scope link src 10.0.3.1
broadcast 127.0.0.0 dev lo table local scope link src 127.0.0.1
local 127.0.0.0/8 dev lo table local scope host src 127.0.0.1
local 127.0.0.1 dev lo table local scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local scope link src 127.0.0.1
broadcast 141.3.xxx dev eth1 table local scope link src 141.3.xxx
local 141.3.xxx dev eth1 table local scope host src 141.3.xxx
broadcast 141.3.xxx dev eth1 table local scope link src 141.3.89.35
0: from all lookup local
32766: from all lookup main
32767: from all lookup default
Router B
root@RouterB:~# ubus call system board; \
> uci export network; \
> uci export dhcp; uci export firewall; \
> ip -4 addr ; ip -4 ro li tab all ; ip -4 ru
{
"kernel": "5.10.146",
"hostname": "RouterB",
"system": "Atheros AR7161 rev 2",
"model": "Netgear WNDR3700",
"board_name": "netgear,wndr3700",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "22.03.2",
"revision": "r19803-9a599fee93",
"target": "ath79/generic",
"description": "OpenWrt 22.03.2 r19803-9a599fee93"
}
}
package network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd68:882c:819e::/48'
config interface 'wan'
option device 'eth1'
option proto 'static'
option ipaddr '10.0.1.2'
option netmask '255.255.255.0'
config device
option name 'br-lan'
option type 'bridge'
option ipv6 '0'
option stp '1'
option hello_time '1'
option forward_delay '2'
option max_age '10'
list ports 'eth0'
option priority '28672'
config device
option name 'eth0'
option macaddr 'c2:3f:0e:7a:ae:fb'
option ipv6 '0'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option ipaddr '192.168.1.254'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
option blinkrate '2'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0 1 2 3 5'
config switch_port
option device 'switch0'
option port '1'
option led '6'
config switch_port
option device 'switch0'
option port '2'
option led '9'
config switch_port
option device 'switch0'
option port '5'
option led '2'
config interface 'wwan'
option proto 'static'
option ipaddr '10.0.2.2'
option netmask '255.255.255.0'
config device
option name 'eth1'
config interface 'wwan_5g'
option proto 'static'
option ipaddr '10.0.3.2'
option netmask '255.255.255.0'
package dhcp
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option localservice '1'
option ednspacket_max '1232'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
option start '100'
option limit '150'
option leasetime '12h'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
config host
option name 'a3-vis'
option dns '1'
option mac 'e0:cb:xxx'
option ip '192.168.1.133'
config host
option name 'a3a-2'
option dns '1'
option mac '00:01:xxx'
option ip '192.168.1.2'
config host
option name 'a3a-3'
option dns '1'
option mac '00:01:xxx'
option ip '192.168.1.3'
config host
option name 'a3a-4'
option dns '1'
option mac 'E0:CB:xxx'
option ip '192.168.1.4'
config host
option name 'a3a-master'
option dns '1'
option mac 'E0:CB:xxx'
option ip '192.168.1.1'
config host
option name 'pc1'
option dns '1'
option mac '28:ee:xxx'
option ip '192.168.1.131'
config boot
option filename 'pxelinux.0'
option servername 'a3a-master'
option serveraddress '192.168.1.1'
package firewall
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
list network 'wwan'
list network 'wwan_5g'
list network 'wan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow all from Robot Network'
list proto 'all'
option src 'wan'
option dest 'lan'
option target 'ACCEPT'
config rule
option name 'Allow Webinterface'
option src 'wan'
option target 'ACCEPT'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP qlen 1000
inet 10.0.1.2/24 brd 10.0.1.255 scope global eth1
valid_lft forever preferred_lft forever
6: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
inet 192.168.1.254/24 brd 192.168.1.255 scope global br-lan
valid_lft forever preferred_lft forever
7: wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
inet 10.0.3.2/24 brd 10.0.3.255 scope global wlan1
valid_lft forever preferred_lft forever
10.0.1.0/24 dev eth1 scope link src 10.0.1.2
10.0.3.0/24 dev wlan1 scope link src 10.0.3.2
192.168.1.0/24 dev br-lan scope link src 192.168.1.254
broadcast 10.0.1.0 dev eth1 table local scope link src 10.0.1.2
local 10.0.1.2 dev eth1 table local scope host src 10.0.1.2
broadcast 10.0.1.255 dev eth1 table local scope link src 10.0.1.2
broadcast 10.0.3.0 dev wlan1 table local scope link src 10.0.3.2
local 10.0.3.2 dev wlan1 table local scope host src 10.0.3.2
broadcast 10.0.3.255 dev wlan1 table local scope link src 10.0.3.2
broadcast 127.0.0.0 dev lo table local scope link src 127.0.0.1
local 127.0.0.0/8 dev lo table local scope host src 127.0.0.1
local 127.0.0.1 dev lo table local scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local scope link src 127.0.0.1
broadcast 192.168.1.0 dev br-lan table local scope link src 192.168.1.254
local 192.168.1.254 dev br-lan table local scope host src 192.168.1.254
broadcast 192.168.1.255 dev br-lan table local scope link src 192.168.1.254
0: from all lookup local
32766: from all lookup main
32767: from all lookup default