Firewall rules between 2 LANs on the same box

Installing and Using OpenWrt
1

Hi
I have in my property 2 separated LAN (home and Valley)
I managed to make them connected both on one device as follows
image

I made so to be able to place some limitations on the traffic between the lans

However, before putting limitation, I would like those 2 to, for now, at least ping each other

The firewall is et as follows

image
image1049×566 38.3 KB

but no commuinciations between the lan

What I am missing ?

2

One more thing

"home" is 192.168.1.0/24 (netmask is 255.255.0.0)
"valley" is 192.168.2.0/24 (netmask is 255.255.0.0)

from any device on home LAN, the ping to any device on valley times out and vice versa

3

Networks overlap. You need /23 or more to route between them

1 Like
4

@brada4 Can you explain a bit more ?

5

It is same subnet in both networks 192.168/16
You can google for TCP/IP basics.

1 Like
6

do you have 255.255.255.0 or 255.255.0.0 ?
you need to have 255.255.255.0 (/24) in order for that to work

2 Likes
7
  • This is 192.168.0.0/16 - or 192.168.0.0-192.168.255.255 (mask 255.255.0.0)
  • That means you told your router that 192.168.1.0/24 and 192.168.2.0/24 could be [reached] in the same [physical] network
  • Yet you assigned them to different physical interfaces
  • This is incorrect
  • 255.255.0.0 is not the OpenWrt default
  • Multiple users have suggested you fix this

See: https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#IPv4_CIDR_blocks

1 Like
8

Picture has /16 not /24

1 Like
9

And that part - you configured /16, not /24.

1 Like
10

o wow, so many wrongs on the first pics
like people state, do your settings with /24 (255.255.255.0)

if you still have prb come back after that

11

So I put them all in one zone

image
image964×210 19.6 KB

and put the following rule

image
image1065×166 14.4 KB

However, DHCP request coming from phy0-sta0 are not blocked

# nc -vz -u 192.168.2.1 67
Connection to 192.168.2.1 67 port [udp/bootps] succeeded!

Why ?

12

cat /etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config rule
        option name 'DHCP'
        option direction 'in'
        option device 'phy0-sta0'
        option family 'ipv4'
        option src 'lan'
        option target 'REJECT'
        option dest 'lan'
        list proto 'udp'
        option dest_port '67-68'
13

The same test with TCP 80 gives the same result (packets not dropped/rejected)

14

You can not filter bridge members with inet table. Thanks. You fixed your subnets so question is over.

15

Why are you so impolite and unfriendly?

16

What? You think you can stare at your misconfigurations until they go away?

17

Simple.

  • DHCP requests aren't forwarded anyway
  • So a rule specifying from LAN to LAN (or home/valley) won't work
  • Now you only have one interface and firewall zone, there's nowhere to forward

Perhaps you should explain the goal of your firewall rule so we can better assist you.

  • From what SRC - to what DST?
  • Where's this firewall rule?
18

Let's take a slightly different approach:

  1. What are the specific goals you have in terms of how you want to allow/limit traffic between the two networks?
  2. let's take a look at the configuration as it stands now to figure out if there are any current misconfigurations and/or recommended changes to make this easier.

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall
1 Like
19

Just in general, anything but /24 subnets is almost always a mistake and a kludge to paper over a real bug, at least as long as you are in a 'home' environment.

Yes, there are reasons for a different subnetting (particularly in the business sector with many (>>256) clients) and there are valid configurations using those, but only if you really know what you're doing and why.

1 Like
20

While I appreciate the effort, all these response have little to do with the question

To rephrase:

  • The openwrt box has several interfaces (ethx, and phy0-ap0/1/2 and phy-sta0/1)
  • One of those interfaces is phy0-sta0, reaching the other lan (another openwrt box across the forest)

->I want to block (drop/reject) some packet going through this interface

What is the best configuration on OpenWrt ?

Thank you