Firewall configuration questions

Installing and Using OpenWrt
1

I'm new to Open-WRT and new to firewall configuration in any kind of linux. My router is running OpenWrt 24.10.0 r28427-6df0e3d02a.

I just configured wifi with what I believe should be three VLANs: 'OpenWRT' (lan), 'OpenWRT Guest' (guest), and 'OpenWRT Video' (video).

Here's how I think I have the router configured:

The lan network, 'OpenWRT':

  • must not access anything on 'guest'
  • must not access anything on 'video'
  • otherwise should perform just like any unmodified, consumer wifi router

The guest network, 'OpenWRT Guest':

  • must not access router login at http(s)://192.168.1.1
  • must not access anything on 'lan'
  • must not access anything on 'video'
  • otherwise should perform just like any unmodified, consumer wifi router

The video network, 'OpenWRT Video':

  • must not access any other device on the 'video' network
  • must not access router login at http(s)://192.168.1.1
  • must not access anything on 'lan'
  • must not access anything on 'guest'
  • otherwise should perform just like any unmodified, consumer wifi router

My questions:

  1. Considering the below included router firewall, network, and wireless configurations, have I achieved my goal?
  2. If I am reading the firewall rules correctly it looks like both DHCP and DNS are allowed from the internet (wan.) Is that correct?
  3. Again, if I am reading the rules correctly I don't see any restrictions on what the lan can access. Should the lan rules be changed or new rules added?
  4. Is DHCPv6 allowed for 'guest' and 'video'?

/etc/config/firewall


config defaults
	option syn_flood '1'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'video'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'video'

config forwarding
	option src 'video'
	option dest 'wan'

config rule
	option name 'Video Allow DNS Queries'
	option src 'video'
	option dest_port '53'
	option target 'ACCEPT'

config rule
	option name 'Video Allow DHCP request'
	list proto 'udp'
	option src 'video'
	option dest_port '67'
	option target 'ACCEPT'

config rule
	option name 'Video Deny on LAN'
	option target 'DROP'
	option src 'video'
	option dest 'lan'

config zone
	option name 'guest'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'guest'

config forwarding
	option src 'guest'
	option dest 'wan'

config rule
	option name 'Guest Allow DNS Queries'
	option src 'guest'
	option dest_port '53'
	option target 'ACCEPT'

config rule
	option name 'Guest Allow DHCP request'
	list proto 'udp'
	option src 'guest'
	option dest_port '67'
	option target 'ACCEPT'

config rule
	option name 'Guest Deny on LAN'
	option target 'DROP'
	option src 'guest'
	option dest 'lan'

/etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd9d:4d2c:b709::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

config device
	option type 'bridge'
	option name 'br-guest'
	option bridge_empty '1'

config interface 'guest'
	option proto 'static'
	option device 'br-guest'
	option ipaddr '192.168.2.1'
	option netmask '255.255.255.0'

config interface 'video'
	option proto 'static'
	option ipaddr '192.168.3.1'
	option netmask '255.255.255.0'
	option device 'br-video'

config device
	option type 'bridge'
	option name 'br-video'
	option bridge_empty '1'

/etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
	option band '2g'
	option channel 'auto'
	option htmode 'HT20'
	option txpower '30'
	option country 'US'
	option cell_density '0'

config wifi-iface 'wifinet3'
	option device 'radio0'
	option mode 'ap'
	option ssid 'OpenWrt'
	option encryption 'sae-mixed'
	option key '****************'
	option ocv '0'
	option network 'lan'

config wifi-iface 'wifinet7'
	option device 'radio0'
	option mode 'ap'
	option ssid 'OpenWrt Guest'
	option encryption 'sae-mixed'
	option key '*********************'
	option ocv '0'
	option network 'guest'

config wifi-iface 'wifinet9'
	option device 'radio0'
	option mode 'ap'
	option ssid 'OpenWrt Video'
	option encryption 'sae-mixed'
	option key '*******************'
	option ocv '0'
	option network 'video'

config wifi-device 'radio1'
	option type 'mac80211'
	option path '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0+1'
	option band '5g'
	option channel 'auto'
	option htmode 'VHT80'
	option txpower '24'
	option country 'US'
	option cell_density '0'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option ssid 'OpenWrt'
	option encryption 'sae-mixed'
	option key '****************'
	option ocv '0'

config wifi-iface 'wifinet5'
	option device 'radio1'
	option mode 'ap'
	option ssid 'OpenWrt Guest'
	option encryption 'sae-mixed'
	option key '*********************'
	option ocv '0'
	option network 'guest'

config wifi-iface 'wifinet8'
	option device 'radio1'
	option mode 'ap'
	option ssid 'OpenWrt Video'
	option encryption 'sae-mixed'
	option key '*******************'
	option ocv '0'
	option network 'video'

config wifi-device 'radio2'
	option type 'mac80211'
	option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
	option band '5g'
	option channel 'auto'
	option htmode 'VHT80'
	option txpower '23'
	option country 'US'
	option cell_density '0'

config wifi-iface 'default_radio2'
	option device 'radio2'
	option network 'lan'
	option mode 'ap'
	option ssid 'OpenWrt'
	option encryption 'sae-mixed'
	option key '****************'
	option ocv '0'

config wifi-iface 'wifinet6'
	option device 'radio2'
	option mode 'ap'
	option ssid 'OpenWrt Guest'
	option encryption 'sae-mixed'
	option key '*********************'
	option ocv '0'
	option network 'guest'

config wifi-iface 'video_radio2'
	option device 'radio2'
	option network 'video'
	option mode 'ap'
	option ssid 'OpenWrt Video'
	option encryption 'sae-mixed'
	option key '*******************'
	option isolate '1'
	option ocv '0'
2

The rules above are not necessary as there is no default access from guest to lan or video to lan this also answers question no 3 there is only access from lan to wan and not from lan to anything else

Regarding 2 the router usually must get a WAN IP address and DNS server so that is allowed by default

Regarding 4 see: https://openwrt.org/docs/guide-user/network/wifi/guestwifi/extras how to enable that

1 Like
3

Thanks! Your response helped. I'm now running my first Open-WRT router

1 Like
4

Great to hear you are running OpenWRT.

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Thanks! :slight_smile:

1 Like