Hello all,
I have multiple vlans, these are guest, IOT and PEDs which I'd like to all have the same rules so i grouped them all together under the same firewall zone ("SafeZones"). My management vlan has 2 piholes - 10.10.1.2 & 10.10.1.5. They worked just fine inte-rvlan on the previous ubiquity router that I'm replacing with openwrt and they are properly configured to respond to "non-local network" requests (worked just fine with unifi).
I currently have an "allow DNS" firewall rule that works fine, and the DHCP servers have been set up properly and handing out the pihole addresses for the DNS, but i just can't figure out why my "Allow Custom DNS" rule isn't working. The requests aren't going through the firewall and getting to the pihole at all.
Any help would be greatly appreciated.
/etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'xx'
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
option ipv6 '0'
config interface 'lan'
option device 'br-lan.5'
option proto 'static'
option ipaddr '10.10.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
config interface 'wan'
option device 'wan'
option proto 'pppoe'
option username 'xxxxx'
option password 'xxxxx'
option ipv6 'auto'
config interface 'wan6'
option device 'wan'
option proto 'pppoe'
option username 'xxxx'
option password 'xxxx'
option ipv6 'auto'
config bridge-vlan
option device 'br-lan'
option vlan '5'
list ports 'lan1:u*'
config bridge-vlan
option device 'br-lan'
option vlan '10'
list ports 'lan1:t'
list ports 'lan2:t'
config bridge-vlan
option device 'br-lan'
option vlan '20'
list ports 'lan1:t'
list ports 'lan2:t'
config bridge-vlan
option device 'br-lan'
option vlan '30'
list ports 'lan1:t'
list ports 'lan2:t'
list ports 'lan4:u*'
config interface 'Guest'
option proto 'static'
option device 'br-lan.10'
option ipaddr '10.10.10.1'
option netmask '255.255.255.0'
config interface 'IOT'
option proto 'static'
option device 'br-lan.30'
option ipaddr '10.10.30.1'
option netmask '255.255.255.0'
config interface 'PEDs'
option proto 'static'
option device 'br-lan.20'
option ipaddr '10.10.20.1'
option netmask '255.255.255.0'
/etc/config/firewall
config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config zone
option name 'SafeZones'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
list network 'Guest'
list network 'IOT'
list network 'PEDs'
config forwarding
option src 'SafeZones'
option dest 'wan'
config forwarding
option src 'lan'
option dest 'SafeZones'
config rule
option name 'Allow DHCP'
list proto 'udp'
option src '*'
option dest_port '53 67 68'
option target 'ACCEPT'
config rule
option name 'Allow DNS'
list proto 'tcp'
option src '*'
option dest_port '53 67 68'
option target 'ACCEPT'
config ipset
option name 'DNS Servers'
option family 'ipv4'
list match 'ip'
list entry '10.10.1.2'
list entry '10.10.1.5'
config rule
option name 'Allow Custom DNS'
list proto 'tcp'
option src 'SafeZones'
list dest_ip '10.10.1.2'
list dest_ip '10.10.1.5'
option dest_port '53 67 68'
option target 'ACCEPT'
option dest 'lan'