First config, review possible (on AX6S)?

Installing and Using OpenWrt
1

I just did my first openwrt setup (on an AX6S).
It corresponds to an old network that I had to manage. This config will never work in real life but I will have very similar configurations in principle.
I have read a lot of things and tried to do it right but could you please criticize the config ?

Everything seems to be working fine but there may be a big security issue or bad practice.

Thank you very much

dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'cra'
	option interface 'cra'
	option leasetime '12h'
	option start '50'
	option limit '100'

config dhcp 'fael'
	option interface 'fael'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'sury'
	option interface 'sury'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'VMa'
	option interface 'VMa'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'Iot'
	option interface 'Iot'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'reil'
	option interface 'reil'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'Touty'
	option interface 'Touty'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'guij'
	option interface 'guij'
	option start '100'
	option limit '150'
	option leasetime '12h'

Firewall


config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip '4444::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config zone
	option name 'cra'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'cra'

config forwarding
	option src 'cra'
	option dest 'wan'

config forwarding
	option src 'wan'
	option dest 'cra'

config zone
	option name 'guij'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'guij'
	option input 'REJECT'

config forwarding
	option src 'guij'
	option dest 'wan'

config forwarding
	option src 'wan'
	option dest 'guij'

config zone
	option name 'fael'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'fael'
	option input 'REJECT'

config forwarding
	option src 'fael'
	option dest 'wan'

config forwarding
	option src 'wan'
	option dest 'fael'

config zone
	option name 'sury'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'sury'
	option input 'REJECT'

config zone
	option name 'VMa'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'VMa'
	option input 'REJECT'

config forwarding
	option src 'VMa'
	option dest 'wan'

config forwarding
	option src 'wan'
	option dest 'VMa'

config zone
	option name 'serveurs'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'Serveurs'
	option input 'REJECT'

config zone
	option name 'Iot'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'Iot'
	option input 'REJECT'

config zone
	option name 'reil'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'reil'
	option input 'REJECT'

config zone
	option name 'Touty'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'Touty'
	option input 'REJECT'

config forwarding
	option src 'serveurs'
	option dest 'wan'

config forwarding
	option src 'wan'
	option dest 'serveurs'

config forwarding
	option src 'Iot'
	option dest 'wan'

config forwarding
	option src 'wan'
	option dest 'Iot'

config forwarding
	option src 'reil'
	option dest 'wan'

config forwarding
	option src 'wan'
	option dest 'reil'

config forwarding
	option src 'Touty'
	option dest 'wan'

config forwarding
	option src 'wan'
	option dest 'Touty'

config forwarding
	option src 'cra'
	option dest 'sury'

config forwarding
	option src 'fael'
	option dest 'sury'

config rule
	option name 'Allow-DHCP-DNS-guij'
	option src 'guij'
	option dest_port '53 67 68'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCP-DNS'
	option src 'sury'
	option dest_port '53 67 68'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCP-DNS-fael'
	option src 'fael'
	option dest_port '53 67 68'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCP-DNS-VMa'
	option src 'VMa'
	option dest_port '53 67 68'
	option target 'ACCEPT'

config rule
	option name 'Allow-DNS-Serveur'
	option src 'serveurs'
	option dest_port '53'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCP-DNS-Iot'
	option src 'Iot'
	option dest_port '53 67 68'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCP-DNS-reil'
	option src 'reil'
	option dest_port '53 67 68 '
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCP-Touty'
	option src 'Touty'
	option dest_port '53 67 68 '
	option target 'ACCEPT'

config rule
	option name 'TimeGard-Childrens'
	option src 'guij'
	option dest 'wan'
	option target 'REJECT'
	option weekdays 'Sun Mon Tue Wed Thu Fri Sat'
	option start_time '20:00:00'
	option stop_time '07:30:00'

config forwarding
	option src 'cra'
	option dest 'Touty'

network


config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdfb:4444:4444::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan3'

config device
	option name 'wan'
	option macaddr '44:44:44:44:44:44'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

config device
	option name 'wlan0'

config interface 'cra'
	option proto 'static'
	option device 'br-lan.1'
	option ipaddr '192.168.0.1'
	option netmask '255.255.255.0'

config bridge-vlan
	option device 'br-lan'
	option vlan '1'
	list ports 'lan1'
	list ports 'lan3'

config bridge-vlan
	option device 'br-lan'
	option vlan '2'
	list ports 'lan3:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '3'
	list ports 'lan3:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '4'
	list ports 'lan3:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '5'
	list ports 'lan3:t'

config interface 'fael'
	option proto 'static'
	option device 'wlan1'
	option ipaddr '192.168.3.1'
	option netmask '255.255.255.0'
	option gateway '192.168.0.1'

config interface 'sury'
	option proto 'static'
	option device 'wlan0-2'
	option netmask '255.255.255.0'
	option ipaddr '192.168.2.1'
	option gateway '192.168.0.1'

config interface 'VMa'
	option proto 'static'
	option ipaddr '192.168.4.1'
	option netmask '255.255.255.0'
	option gateway '192.168.0.1'

config interface 'Serveurs'
	option proto 'static'
	option device 'br-lan.2'
	option ipaddr '192.168.5.1'
	option netmask '255.255.255.0'
	option gateway '192.168.0.1'

config interface 'Iot'
	option proto 'static'
	option device 'br-lan.3'
	option ipaddr '192.168.6.1'
	option netmask '255.255.255.0'
	option type 'bridge'
	option gateway '192.168.0.1'

config interface 'reil'
	option proto 'static'
	option device 'br-lan.4'
	option ipaddr '192.168.7.1'
	option netmask '255.255.255.0'
	option gateway '192.168.0.1'

config interface 'Touty'
	option proto 'static'
	option device 'br-lan.5'
	option ipaddr '192.168.8.1'
	option netmask '255.255.255.0'
	option gateway '192.168.0.1'

config interface 'guij'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option gateway '192.168.0.1'

wireless


config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/18000000.wmac'
	option band '2g'
	option htmode 'HT20'
	option cell_density '0'
	option country 'FR'
	option channel '1'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option mode 'ap'
	option ssid 'guij-n'
	option key 'Toto'
	option encryption 'psk2'
	option network 'guij'

config wifi-device 'radio1'
	option type 'mac80211'
	option path '1a143000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
	option channel '36'
	option band '5g'
	option htmode 'HE80'
	option cell_density '0'
	option country 'FR'
	option distance '5'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option mode 'ap'
	option ssid 'fael'
	option encryption 'sae'
	option key 'Toto'
	option network 'fael'

config wifi-iface 'wifinet2'
	option device 'radio0'
	option mode 'ap'
	option ssid 'cra-n'
	option encryption 'sae-mixed'
	option network 'cra'
	option key 'Toto9'

config wifi-iface 'wifinet3'
	option device 'radio0'
	option mode 'ap'
	option ssid 'sury-n'
	option network 'sury'
	option key 'Toto'
	option encryption 'psk2'

config wifi-iface 'wifinet4'
	option device 'radio0'
	option mode 'ap'
	option ssid 'vma'
	option network 'VMa'
	option encryption 'psk2'
	option key 'Toto'

config wifi-iface 'wifinet5'
	option device 'radio0'
	option mode 'ap'
	option ssid 'Iot-n'
	option network 'Iot'
	option encryption 'sae-mixed'
	option key 'Toto'

config wifi-iface 'wifinet6'
	option device 'radio0'
	option mode 'ap'
	option ssid 'cra2'
	option encryption 'psk2'
	option key 'Toto'
	option network 'Touty'
	option disabled '1'
2

Remove all the gateways from the internal interfaces.

Firewall is full of wan->internal zone forwardings. This is not secure.

Port 68 is not needed

3 Likes
3

Thank you very much for your answer.

I saw my mistake for the other 2 but I don't understand

if these networks must access the internet how can I do it otherwise?

I don't have to understand anything because I don't understand why it's not secure.

Thanks

4

The firewall is statefull, so if a client in the lan initiates a connection to the internet, the return traffic will be automatically allowed.
Traffic from wan to the lan shouldn't be generally allowed, only specific exceptions with port forwards or ports allowed on the router.

2 Likes
5

Yes ! I see, so it's a monstrous mistake :woozy_face: , I did well to ask review

Thank you very much

1 Like