Firewall blocking traffic within lan zone

Arno · July 2, 2026, 8:32pm

Hi,

When I start the firewall some traffic is not forwarded within lan zone.

Setup:
OpenWRT 25.12.5 on a Netgear R7800
Interfaces: lan bridge and wifi networks attached, dmz and internet. All on separate subnets
Zones: internet, dmz and lan
Default policies: drop

lan to dmz and internet: input, output, forward: accept, accept, accept
dmz to internet: input, output, forward: drop, drop, accept
internet to dmz: input, output, forward: drop, drop, accept

Also have some traffic rules. Input and output accept only.

Why is traffic blocked within the lan zone? Can this be solved?

lleachii · July 2, 2026, 8:37pm

We need to know the LAN zone rules in order to answer your question. Please provide the output of:

cat /etc/config/firewall

Arno · July 3, 2026, 8:29am

config defaults
option input 'DROP'
option output 'DROP'
option forward 'DROP'
option synflood_protect '1'
option drop_invalid '1'

config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
option family 'ipv4'
option log '1'

config zone
option name 'dmz'
option input 'DROP'
option output 'DROP'
option forward 'ACCEPT'
list network 'dmz'
option family 'ipv4'
option log '1'

config zone
option name 'internet'
option input 'DROP'
option output 'DROP'
option forward 'ACCEPT'
list network 'internet'
option family 'ipv4'
option log '1'

config forwarding
option src 'lan'
option dest 'dmz'

config forwarding
option src 'lan'
option dest 'internet'

config forwarding
option src 'dmz'
option dest 'internet'

config forwarding
option src 'internet'
option dest 'dmz'

config rule
option dest 'internet'
option name 'NTP-out'
list proto 'udp'
option dest_port '123'
option target 'ACCEPT'
option family 'ipv4'
option enabled '1'

config rule
option dest 'dmz'
option name 'ICMP-out dmz'
list proto 'icmp'
option target 'ACCEPT'
option family 'ipv4'
option enabled '1'

config rule
option dest 'internet'
option name 'ICMP-out internet'
list proto 'icmp'
option target 'ACCEPT'
option family 'ipv4'
option enabled '1'

config rule
option dest 'internet'
option name 'HTTPS-out'
option family 'ipv4'
list proto 'tcp'
option dest_port '443'
option target 'ACCEPT'
option enabled '1'

config rule
option dest 'internet'
option name 'Remote logging'
list proto 'udp'
list dest_ip 'xxx.xxx.xxx.xxx'
option dest_port 'xxxx'
option target 'ACCEPT'
option family 'ipv4'
option enabled '1'

config rule
option src 'internet'
option dest 'lan'
option name 'Established-to-LAN'
option family 'ipv4'
option target 'ACCEPT'
option enabled '1'
list proto 'all'
option log '1'

psherman · July 3, 2026, 4:46pm

This firewall file looks really unusual.

How did you arrive at this configuration? (did you do this on your own, with help from others, guides on the web, AI assistance??)
What are your goals with the firewall?
Can you give us specific examples of the traffic that is seemingly blocked within the lan zone? (i.e. source address, destination address, method of testing/protocol)?
How are the source and destination hosts physically connected to the network (i.e. wifi, ethernet; are there any ethernet switches in the setup and/or any APs aside from the R7800)? a network topology diagram would be really useful.
And let's see the rest of the config.

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):

Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp

Arno · July 6, 2026, 9:39am

On my own. What is so unusual about this firewall?

What I did in the web interface was only setting default policy to DROP and edited the rules for zones at the bottom in General Settings.
Finally I added traffic rules (input/output) for NTP, HTTP (for package updates), ICMP and remote logging.
This R7800 OpenWRT router does not host any service, its only role is router and firewall on my home lan.

The firewall connects the wired internet, dmz and lan. Wireless is part of the lan bridge so I can use clients on lan via wifi. A unmanaged switch is connected to the lan port of the R7800.
All the interfaces have an different IP address (192.168.x.y). Here x is different for internet, dmz and lan. Subnetmask is /24.
There is no public IP address on this router. The wired internet port (port 1 of the R7800) is connected to an OPNsense server which connects to my ISP.

The internet zone should be able to access dmz but not lan. dmz should be able to access internet but not lan. And lan should be able to access dmz and internet.
Internet to lan should only be established, related connections.

Configuration:
ubus call system board
{
"kernel": "6.12.94",
"hostname": "XXXXXX",
"system": "ARMv7 Processor rev 0 (v7l)",
"model": "Netgear Nighthawk X4S R7800",
"board_name": "netgear,r7800",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "25.12.5",
"firmware_url": "``https://downloads.openwrt.org/``",
"revision": "r33051-f5dae5ece4",
"target": "ipq806x/generic",
"description": "OpenWrt 25.12.5 r33051-f5dae5ece4",
"builddate": "1782737960"
}
}

cat /etc/config/network

config interface 'loopback'
option device 'lo'
option proto 'static'
list ipaddr '127.0.0.1/8'

config globals 'globals'
option dhcp_default_duid '0004c48849b728a74ad7a68db58a85c4526f'
option ula_prefix 'fd95:6c90:c67a::/48'
option packet_steering '1'

config device
option name 'br-lan'
option type 'bridge'
list ports 'lan3'

config interface 'lan'
option device 'br-lan'
option proto 'static'
list ipaddr '192.168.c.xxx/24'
option multipath 'off'
list dns '192.168.c.yyy'

config interface 'dmz'
option proto 'static'
option device 'lan2'
option ipaddr '192.168.b.xxx'
option netmask '255.255.255.0'
option multipath 'off'
list dns '208.67.222.222'

config interface 'internet'
option proto 'static'
option device 'lan1'
option ipaddr '192.168.a.yyy'
option netmask '255.255.255.0'
option multipath 'off'
list dns '208.67.222.222'

config route
option interface 'internet'
option target '0.0.0.0/0'
option gateway '192.168.a.xxx'

cat /etc/config/wireless

config wifi-device 'radio0'
option type 'mac80211'
option path 'soc/1b500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
option band '5g'
option channel '44'
option htmode 'HT20'
option cell_density '0'

config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'xxxxxx'
option encryption 'psk2+ccmp'
option hidden '1'
option key 'xxxxxx'
option macfilter 'allow'
list maclist 'laptop'
list maclist 'pi1'
list maclist 'pi2'

config wifi-device 'radio1'
option type 'mac80211'
option path 'soc/1b700000.pcie/pci0001:00/0001:00:00.0/0001:01:00.0'
option band '2g'
option channel '11'
option cell_density '0'
option htmode 'HT20'

config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid 'xxxxxx'
option encryption 'psk2+ccmp'
option macfilter 'allow'
option hidden '1'
option key 'xxxxxx'
list maclist 'printer'
list maclist 'laptop'

This router doesn't host dhcp or dns:

cat /etc/config/dhcp

config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
option filter_aaaa '0'
option filter_a '0'

config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'disabled'

config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/odhcpd.leases'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
option piodir '/tmp/odhcpd-piodir'
option hostsdir '/tmp/hosts'

Example of blocked traffic:
Ping from laptop (wifi) to Proxmox server (wired).
WebGUI from laptop (wifi) to Proxmox server (wired).
Both on lan.

lleachii · July 6, 2026, 10:42am

Quite a bit. BTW, the other user said "configuration" - not just the firewall.

Zone rule containing option family
You configured a default route instead of simply specifying a gateway
Adding DNS to all interfaces
You altered the default rules to drop (which makes me wonder if I missed something else affecting what should be LAN zone traffic)

~~Can you provide an example of 'traffic blocked within the LAN zone'?~~

I see you edited:

The firewall doesn't cover the wireless to wired traffic you listed (it's same bridge, hence the same interface, so it doesn't traverse the firewall).

lleachii · July 6, 2026, 10:59am

I should also add:

Your rules don't specify a source (meaning the SRC is ANY)

Arno · July 6, 2026, 11:01am

I disabled IPv6 so the rule has to be IPv4 only.

What should this be instead?

The internet and dmz has to use a different dns server.
When updating OpenWRT the interface used is in the internet zone and has to use a different dns server. Not my private one on my lan but a public one.

Yes. Everything should be blocked except what what I want to be allowed.

Arno · July 6, 2026, 11:04am

But traffic is blocked when the firewall is started so the firewall does something.

lleachii · July 6, 2026, 11:06am

No, it could have been left at default
You have that listed in other locations than just rules

config interface 'lan'
     option device 'br-lan'
     option proto 'static'
     list ipaddr '192.168.c.xxx/24'
     option multipath 'off'
     list dns '192.168.c.yyy'
     option gateway '192.168.a.xxx'

OK.*

BTW - "Everything" should be specified in your zones, hence my remark about possibility missing something.

OK.*

*- If you insist

Arno · July 6, 2026, 11:10am

Yes. My thought was I specified the firewall zones and how traffic is allowed between firewall zones.
So I don't have to specify SRC or DST. because traffic on one interface is all from one subnet.
Specifying SRC and DST addresses felt unnecessary.

lleachii · July 6, 2026, 11:13am

I don't understand your rationale. The rules are "exceptions" to any zone rules. Hence specifying 'any' would have a wider scope than you intended.

Also, I don't understand the subnet discussion when mentioning firewall zones.

Lastly, I didn't mean specifying SRC or DST subnets, I meant specifying SRC or DST zones. Failure to specify a SRC [zone] means Any [zone] is the source.

Arno · July 6, 2026, 11:25am

When I set the default policy to drop then there has to be exceptions for outgoing traffic (ntp, https, icmp).
In those rules firewall zones are specified (from this device to internet).
And under General Settings the zone forwards are specified.

lleachii · July 6, 2026, 11:37am

Let's use NTP:

Where's the SRC specified?

Now ICMP:

Do you wish to allow pings from the Internet here?

As I noted, the default policy would not be used in the case of properly configured zones.

Edit:

(For clarification, I want to be sure you're not confusing "zone rule" with "default" or "global" rule.)

Arno · July 6, 2026, 11:49am

Arno · July 6, 2026, 11:52am

This rule should allow pings from dmz to internet.

lleachii · July 6, 2026, 11:53am

Your NTP server is in the DMZ...interesting.

I stand corrected, no SRC specifies "this device".

OK, that was your intention. Pardon my confusion.

Returning to:

Can you access the Proxmox sever via any other protocols?
Have you tested pinging the Wireless devices from the Proxmox?
And it's plugged into port LAN3 (br-lan in your config)

Arno · July 6, 2026, 11:59am

As I understand firewalls when you set default policy to ACCEPT the firewall is wide open to everything.
To me it is more logical to block everything and then allow some traffic instead of allow everything and block bad traffic. With the latter there is a big chance I forget to block bad traffic I didn't think of.

lleachii · July 6, 2026, 12:03pm

I agree with your statement. What I disagree is that the global rules have any affect, unless there's some misconfiguration.

I agree with @psherman - something is odd with your configurations. I need more time to review.

Arno · July 6, 2026, 12:05pm

When the firewall on the R7800 is stopped I can ping, ssh and use the webGUI.
When the firewall on the R7800 is started I can't.