Guest and IOT are open

kpise · December 20, 2021, 6:33pm

Based on the video - the Below configuration is not working, everything is open - any idea ?

Video Link https://www.youtube.com/watch?v=UvniZs8q3eU

frollic · December 20, 2021, 6:54pm

everything is open from where to where ?

kpise · December 20, 2021, 7:11pm

2 SSID have been created - IOT and Guest. they are tagged to network guest and IOT respectively.

please see snaps

but from both SSID, I can browse the internet and local network as well. Looks like firewall zone is not working

psherman · December 20, 2021, 7:21pm

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

kpise · December 20, 2021, 7:39pm

Thanks for your help. I tried my best - to provide you info-

Network -
cat /etc/config/network

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fd2b:cb00:e70d::/48'

config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0.1'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'

config interface 'wan'
option device 'eth0.2'
option proto 'dhcp'

config interface 'wan6'
option device 'eth0.2'
option proto 'dhcpv6'

config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'

config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0 1 6t'

config switch_vlan
option device 'switch0'
option vlan '2'
option ports '4 6t'

config route
option interface 'lan'
option target '192.168.1.100'
option netmask '255.255.255.0'
option gateway '192.168.1.1'

config interface 'Guest'
option proto 'static'
option ipaddr '10.20.30.40'
option netmask '255.255.255.0'
option device 'br-lan'

config interface 'IOT'
option proto 'static'
option ipaddr '172.16.0.1'
option netmask '255.255.255.0'
option device 'br-lan'

cat /etc/config/wireless

config wifi-device 'radio0'
option type 'mac80211'
option channel '36'
option hwmode '11a'
option path 'pci0000:00/0000:00:00.0/0000:01:00.0'
option cell_density '0'
option country 'US'
option htmode 'VHT40'

config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option encryption 'sae-mixed'
option key XXXXXXXXX
option ssid 'XXXXXXXXXXX-5G'
option disassoc_low_ack '0'
option max_inactivity '1600'

config wifi-device 'radio1'
option type 'mac80211'
option channel '11'
option hwmode '11g'
option path 'platform/10180000.wmac'
option htmode 'HT20'
option cell_density '0'
option country 'US'

config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option key 'XXXXXXXX'
option ssid 'XXXXXXXXXXXe'
option encryption 'psk2'

config wifi-iface 'wifinet2'
option device 'radio1'
option mode 'ap'
option ssid 'XXXXXXXXX-Guest'
option encryption 'sae-mixed'
option key 'XXXXXXXXX'
option ieee80211r '1'
option mobility_domain '1234'
option ft_over_ds '1'
option ft_psk_generate_local '1'
option network 'Guest'

config wifi-iface 'wifinet3'
option device 'radio1'
option mode 'ap'
option ssid 'XXXXXXXXXX-IOT'
option encryption 'sae-mixed'
option key 'XXXXXXXX'
option network 'lan'

cat /etc/config/wireless

config wifi-device 'radio0'
option type 'mac80211'
option channel '36'
option hwmode '11a'
option path 'pci0000:00/0000:00:00.0/0000:01:00.0'
option cell_density '0'
option country 'US'
option htmode 'VHT40'

config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option encryption 'sae-mixed'
option key 'XXXXXXXXXXX'
option ssid 'XXXXXXXXXXXXXXX-5G'
option disassoc_low_ack '0'
option max_inactivity '1600'

config wifi-device 'radio1'
option type 'mac80211'
option channel '11'
option hwmode '11g'
option path 'platform/10180000.wmac'
option htmode 'HT20'
option cell_density '0'
option country 'US'

config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option key 'XXXXXXXXXXXXXXXXXX'
option ssid 'XXXXXXXXXXXXXXXXXXXXXXX'
option encryption 'psk2'

config wifi-iface 'wifinet2'
option device 'radio1'
option mode 'ap'
option ssid 'XXXXXXXXXXXXXXX-Guest'
option encryption 'sae-mixed'
option key XXXXXXXXXXXXXXXXX
option ieee80211r '1'
option mobility_domain '1234'
option ft_over_ds '1'
option ft_psk_generate_local '1'
option network 'Guest'

config wifi-iface 'wifinet3'
option device 'radio1'
option mode 'ap'
option ssid 'XXXXXXXXXXXXXXXXXXXXXXXX-IOT'
option encryption 'sae-mixed'
option key 'XXXXXXXXXXXXX'
option network 'lan'

cat /etc/config/dhcp

config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
option confdir '/tmp/dnsmasq.d'
list address '/angleXXXXX/192.168.1.100'
list address '/homeXXXXXX/10.10.10.1'
list address '/XXXXXX/192.168.1.100'

config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
option ra_slaac '1'
list ra_flags 'managed-config'
list ra_flags 'other-config'

config dhcp 'wan'
option interface 'wan'
option ignore '1'

config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'

config host
option name 'XXXXXXXXXXLantern'
option ip '192.168.1.226'
option mac 'XX:XX:XX:44:BA:7E'

config host
option name 'XXXXXXXXXXsurface'
option ip '192.168.1.200'
option mac 'XX:1X:XX:30:23:D7'

config dhcp 'Guest'
option interface 'Guest'
option start '100'
option limit '150'
option leasetime '12h'
list ra_flags 'none'

config dhcp 'IOT'
option interface 'IOT'
option start '100'
option limit '150'
option leasetime '12h'
list ra_flags 'none'

cat /etc/config/firewall

Firewall -

config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'

config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'

config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'

config forwarding
option src 'lan'
option dest 'wan'

config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'

config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'

config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'

config rule
option name 'Support-UDP-Traceroute'
option src 'wan'
option dest_port '33434:33689'
option proto 'udp'
option family 'ipv4'
option target 'REJECT'
option enabled '0'

config include
option path '/etc/firewall.user'

config zone
option name 'GuestZone'
option output 'ACCEPT'
option forward 'REJECT'
list network 'Guest'
option input 'REJECT'

config zone
option name 'IOTZone'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
list network 'IOT'

config forwarding
option src 'GuestZone'
option dest 'wan'

config rule
option name 'Guest DHCP DNS'
option src 'GuestZone'
option dest_port '53 67 68'
option target 'ACCEPT'

config forwarding
option src 'lan'
option dest 'IOTZone'

psherman · December 20, 2021, 7:45pm

You have assigned the guest and IoT networks to the br-lan -- this is the same bridge as the LAN. That is why things are not working the way you would expect.

There might be other potential issues in your config files (I've only done a very quick scan), but this is the big one. Are you using your guest and IoT networks for both wired and wireless, or just wireless?

Also, in the future, please make sure you use the formatting as described in my earlier post... it makes its much easier to read when properly formatted.

kpise · December 20, 2021, 7:52pm

It's ok to have it only on wireless.

Thanks for your suggestion. I will use <> . Most of my settings are from default. I have not done any modifications

psherman · December 20, 2021, 7:53pm