Guest Network and Wireguard

Hi,
I basically want to do the same as @AGL in his Topic: Creating a second network on single router for VPN

I want LAN traffic to go through the VPN and a guest network fully detached from LAN and the VPN.

My Setup:


Editable: APU2 setup

So I disabled route_allowed_ips:

uci set network.wgserver.route_allowed_ips="0"
uci commit network
/etc/init.d/network restart

But I still can't get Internet Access from the Guest network.
Also if I'm not setting Input, Output and Forward to 'ACCEPT' in the Guest to WAN rule, the clients in the Guest Network won't get an IP Adress from the DHCP Server:

openwrt Error sending DHCP packet to 10.19.88.176: Operation not permitted

I'm pretty inexperienced with most "low level" network/IP-Tables stuff. I'm eager to learn it, but after googling for 6 hours I think I may need a hint :wink:

uci show network
network.loopback=interface
network.loopback.ifname='lo'
network.loopback.proto='static'
network.loopback.ipaddr='127.0.0.1'
network.loopback.netmask='255.0.0.0'
network.globals=globals
network.globals.ula_prefix='fda8:2149:e3a8::/48'
network.WAN=interface
network.WAN.proto='dhcp'
network.WAN.macaddr='00:0D:B9:4C:A3:44'
network.WAN.ifname='eth1'
network.LAN=interface
network.LAN.proto='static'
network.LAN.type='bridge'
network.LAN.netmask='255.255.255.0'
network.LAN.ipaddr='10.19.89.1'
network.LAN.ifname='eth0 eth2'
network.MULLVAD=interface
network.MULLVAD.proto='wireguard'
network.MULLVAD.addresses='X.X.X.X/32'
network.MULLVAD.private_key='***'
network.MULLVAD.force_link='1'
network.@wireguard_MULLVAD[0]=wireguard_MULLVAD
network.@wireguard_MULLVAD[0].persistent_keepalive='25'
network.@wireguard_MULLVAD[0].endpoint_port='51820'
network.@wireguard_MULLVAD[0].allowed_ips='0.0.0.0/0'
network.@wireguard_MULLVAD[0].endpoint_host='nl4-wireguard.mullvad.net'
network.@wireguard_MULLVAD[0].public_key='hnRyse6QxPPcZOoSwRsHUtK1W+APWXnIoaDTmH6JsHQ='
network.@wireguard_MULLVAD[0].description='nl4-wireguard.mullvad.net'
network.GUEST=interface
network.GUEST.type='bridge'
network.GUEST.proto='static'
network.GUEST.ipaddr='10.19.88.1'
network.GUEST.netmask='255.255.255.0'
network.GUEST.ifname='eth3'
uci show wireless
wireless.radio0=wifi-device
wireless.radio0.type='mac80211'
wireless.radio0.channel='36'
wireless.radio0.hwmode='11a'
wireless.radio0.path='pci0000:00/0000:00:10.0'
wireless.radio0.htmode='VHT80'
wireless.radio0.distance='50'
wireless.radio0.country='DE'
wireless.radio0.disabled='1'
wireless.radio1=wifi-device
wireless.radio1.type='mac80211'
wireless.radio1.channel='36'
wireless.radio1.hwmode='11a'
wireless.radio1.path='pci0000:00/0000:00:1f.0/0000:02:0d.0'
wireless.radio1.htmode='VHT80'
wireless.radio1.distance='50'
wireless.radio1.country='DE'
wireless.wifinet0=wifi-iface
wireless.wifinet0.network='GUEST'
wireless.wifinet0.wpa_disable_eapol_key_retries='1'
wireless.wifinet0.ssid='Guest'
wireless.wifinet0.device='radio1'
wireless.wifinet0.mode='ap'
wireless.wifinet0.ieee80211w='1'
wireless.wifinet0.key='***'
wireless.wifinet0.encryption='psk2'
wireless.wifinet1=wifi-iface
wireless.wifinet1.ssid='Secure'
wireless.wifinet1.encryption='psk2'
wireless.wifinet1.device='radio0'
wireless.wifinet1.mode='ap'
wireless.wifinet1.wpa_disable_eapol_key_retries='1'
wireless.wifinet1.key='***'
wireless.wifinet1.network='LAN'
wireless.wifinet1.disabled='1'
uci show firewall
firewall.@defaults[0]=defaults
firewall.@defaults[0].input='ACCEPT'
firewall.@defaults[0].output='ACCEPT'
firewall.@defaults[0].forward='REJECT'
firewall.@defaults[0].synflood_protect='1'
firewall.lan=zone
firewall.lan.name='lan'
firewall.lan.input='ACCEPT'
firewall.lan.output='ACCEPT'
firewall.lan.forward='ACCEPT'
firewall.lan.network='LAN'
firewall.guest=zone
firewall.guest.name='guest'
firewall.guest.network='GUEST'
firewall.guest.input='ACCEPT'
firewall.guest.output='ACCEPT'
firewall.guest.forward='ACCEPT'
firewall.wan=zone
firewall.wan.name='wan'
firewall.wan.input='REJECT'
firewall.wan.output='ACCEPT'
firewall.wan.forward='REJECT'
firewall.wan.network='wan wan6 WAN'
firewall.@rule[0]=rule
firewall.@rule[0].name='Allow-DHCP-Renew'
firewall.@rule[0].src='wan'
firewall.@rule[0].proto='udp'
firewall.@rule[0].dest_port='68'
firewall.@rule[0].target='ACCEPT'
firewall.@rule[0].family='ipv4'
firewall.@rule[1]=rule
firewall.@rule[1].name='Allow-Ping'
firewall.@rule[1].src='wan'
firewall.@rule[1].proto='icmp'
firewall.@rule[1].icmp_type='echo-request'
firewall.@rule[1].family='ipv4'
firewall.@rule[1].target='ACCEPT'
firewall.@rule[2]=rule
firewall.@rule[2].name='Allow-IGMP'
firewall.@rule[2].src='wan'
firewall.@rule[2].proto='igmp'
firewall.@rule[2].family='ipv4'
firewall.@rule[2].target='ACCEPT'
firewall.@rule[3]=rule
firewall.@rule[3].name='Allow-DHCPv6'
firewall.@rule[3].src='wan'
firewall.@rule[3].proto='udp'
firewall.@rule[3].src_ip='fc00::/6'
firewall.@rule[3].dest_ip='fc00::/6'
firewall.@rule[3].dest_port='546'
firewall.@rule[3].family='ipv6'
firewall.@rule[3].target='ACCEPT'
firewall.@rule[4]=rule
firewall.@rule[4].name='Allow-MLD'
firewall.@rule[4].src='wan'
firewall.@rule[4].proto='icmp'
firewall.@rule[4].src_ip='fe80::/10'
firewall.@rule[4].icmp_type='130/0' '131/0' '132/0' '143/0'
firewall.@rule[4].family='ipv6'
firewall.@rule[4].target='ACCEPT'
firewall.@rule[5]=rule
firewall.@rule[5].name='Allow-ICMPv6-Input'
firewall.@rule[5].src='wan'
firewall.@rule[5].proto='icmp'
firewall.@rule[5].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type' 'router-solicitation' 'neighbour-solicitation' 'router-advertisement' 'neighbour-advertisement'
firewall.@rule[5].limit='1000/sec'
firewall.@rule[5].family='ipv6'
firewall.@rule[5].target='ACCEPT'
firewall.@rule[6]=rule
firewall.@rule[6].name='Allow-ICMPv6-Forward'
firewall.@rule[6].src='wan'
firewall.@rule[6].dest='*'
firewall.@rule[6].proto='icmp'
firewall.@rule[6].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type'
firewall.@rule[6].limit='1000/sec'
firewall.@rule[6].family='ipv6'
firewall.@rule[6].target='ACCEPT'
firewall.@rule[7]=rule
firewall.@rule[7].name='Allow-IPSec-ESP'
firewall.@rule[7].src='wan'
firewall.@rule[7].dest='lan'
firewall.@rule[7].proto='esp'
firewall.@rule[7].target='ACCEPT'
firewall.@rule[8]=rule
firewall.@rule[8].name='Allow-ISAKMP'
firewall.@rule[8].src='wan'
firewall.@rule[8].dest='lan'
firewall.@rule[8].dest_port='500'
firewall.@rule[8].proto='udp'
firewall.@rule[8].target='ACCEPT'
firewall.@include[0]=include
firewall.@include[0].path='/etc/firewall.user'
firewall.@zone[3]=zone
firewall.@zone[3].network='MULLVAD'
firewall.@zone[3].name='WG_FW'
firewall.@zone[3].mtu_fix='1'
firewall.@zone[3].input='REJECT'
firewall.@zone[3].forward='REJECT'
firewall.@zone[3].masq='1'
firewall.@zone[3].output='ACCEPT'
firewall.@forwarding[0]=forwarding
firewall.@forwarding[0].dest='WG_FW'
firewall.@forwarding[0].src='lan'
firewall.guest_wan=forwarding
firewall.guest_wan.src='guest'
firewall.guest_wan.dest='wan'
firewall.guest_dns=rule
firewall.guest_dns.name='Allow-DNS-Guest'
firewall.guest_dns.src='guest'
firewall.guest_dns.dest_port='53'
firewall.guest_dns.proto='tcp udp'
firewall.guest_dns.target='ACCEPT'
uci show dhcp
dhcp.@dnsmasq[0]=dnsmasq
dhcp.@dnsmasq[0].domainneeded='1'
dhcp.@dnsmasq[0].localise_queries='1'
dhcp.@dnsmasq[0].rebind_protection='1'
dhcp.@dnsmasq[0].rebind_localhost='1'
dhcp.@dnsmasq[0].local='/lan/'
dhcp.@dnsmasq[0].domain='lan'
dhcp.@dnsmasq[0].expandhosts='1'
dhcp.@dnsmasq[0].authoritative='1'
dhcp.@dnsmasq[0].readethers='1'
dhcp.@dnsmasq[0].leasefile='/tmp/dhcp.leases'
dhcp.@dnsmasq[0].resolvfile='/tmp/resolv.conf.auto'
dhcp.@dnsmasq[0].localservice='1'
dhcp.@dnsmasq[0].logqueries='1'
dhcp.@dnsmasq[0].server='10.19.89.2'
dhcp.@dnsmasq[0].interface='br-LAN' 'br-guest'
dhcp.lan=dhcp
dhcp.lan.interface='lan'
dhcp.lan.start='100'
dhcp.lan.limit='150'
dhcp.lan.leasetime='12h'
dhcp.lan.dhcpv6='server'
dhcp.lan.ra='server'
dhcp.lan.ra_management='1'
dhcp.wan=dhcp
dhcp.wan.interface='wan'
dhcp.wan.ignore='1'
dhcp.odhcpd=odhcpd
dhcp.odhcpd.maindhcp='0'
dhcp.odhcpd.leasefile='/tmp/hosts/odhcpd'
dhcp.odhcpd.leasetrigger='/usr/sbin/odhcpd-update'
dhcp.odhcpd.loglevel='4'
dhcp.LAN=dhcp
dhcp.LAN.start='100'
dhcp.LAN.leasetime='12h'
dhcp.LAN.interface='LAN'
dhcp.LAN.limit='150'
dhcp.LAN.dhcp_option='6,10.19.89.2'
dhcp.@host[0]=host
dhcp.@host[0].mac='EA:25:6F:59:08:0F'
dhcp.@host[0].name='pihole'
dhcp.@host[0].dns='1'
dhcp.@host[0].ip='10.19.89.2'
dhcp.@host[1]=host
dhcp.@host[1].name='apu2'
dhcp.@host[1].dns='1'
dhcp.@host[1].ip='10.19.89.3'
dhcp.@host[1].mac='92:B9:59:7E:F3:97'
dhcp.LAN_PUBLIC=dhcp
dhcp.LAN_PUBLIC.start='100'
dhcp.LAN_PUBLIC.leasetime='12h'
dhcp.LAN_PUBLIC.limit='150'
dhcp.LAN_PUBLIC.interface='LAN_PUBLIC'
dhcp.LAN_PUBLIC.dhcp_option='6,10.19.90.3'
dhcp.guest=dhcp
dhcp.guest.interface='guest'
dhcp.guest.start='100'
dhcp.guest.limit='150'
dhcp.guest.leasetime='1h'
dhcp.guest.dhcp_option='6,1.1.1.1'

grep -v -e ^# -e ^$ /etc/firewall.user;
empty
head -v -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*
==> /etc/resolv.conf <==
search lan
nameserver 127.0.0.1

==> /tmp/resolv.conf <==
search lan
nameserver 127.0.0.1

==> /tmp/resolv.conf.auto <==
# Interface WAN
nameserver 10.19.90.3
search fritz.box
head: /tmp/resolv.*/*: No such file or directory
ip address show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br-LAN state UP group default qlen 1000
    link/ether 3a:32:67:2c:4f:28 brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:0d:b9:4c:a3:44 brd ff:ff:ff:ff:ff:ff
    inet 10.19.90.21/24 brd 10.19.90.255 scope global eth1
       valid_lft forever preferred_lft forever
    inet6 fe80::20d:b9ff:fe4c:a344/64 scope link 
       valid_lft forever preferred_lft forever
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br-LAN state UP group default qlen 1000
    link/ether 00:0d:b9:4c:a3:45 brd ff:ff:ff:ff:ff:ff
5: eth3: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq master br-GUEST state DOWN group default qlen 1000
    link/ether 00:0d:b9:4c:a3:46 brd ff:ff:ff:ff:ff:ff
6: wlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 04:f0:21:85:42:3a brd ff:ff:ff:ff:ff:ff
8: br-GUEST: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 00:0d:b9:4c:a3:46 brd ff:ff:ff:ff:ff:ff
    inet 10.19.88.1/24 brd 10.19.88.255 scope global br-GUEST
       valid_lft forever preferred_lft forever
    inet6 fe80::20d:b9ff:fe4c:a346/64 scope link 
       valid_lft forever preferred_lft forever
9: br-LAN: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 3a:32:67:2c:4f:28 brd ff:ff:ff:ff:ff:ff
    inet 10.19.89.1/24 brd 10.19.89.255 scope global br-LAN
       valid_lft forever preferred_lft forever
    inet6 fe80::3832:67ff:fe2c:4f28/64 scope link 
       valid_lft forever preferred_lft forever
10: MULLVAD: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    link/none 
    inet X.X.X.X/32 brd 255.255.255.255 scope global MULLVAD
       valid_lft forever preferred_lft forever
11: wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-GUEST state UP group default qlen 1000
    link/ether 04:f0:21:88:40:33 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::6f0:21ff:fe88:4033/64 scope link 
       valid_lft forever preferred_lft forever
ip route show table all
default dev MULLVAD proto static scope link 
10.19.88.0/24 dev br-GUEST proto kernel scope link src 10.19.88.1 
10.19.89.0/24 dev br-LAN proto kernel scope link src 10.19.89.1 
10.19.90.0/24 dev eth1 proto kernel scope link src 10.19.90.21 
193.32.249.69 via 10.19.90.1 dev eth1 proto static 
broadcast 10.19.88.0 dev br-GUEST table local proto kernel scope link src 10.19.88.1 
local 10.19.88.1 dev br-GUEST table local proto kernel scope host src 10.19.88.1 
broadcast 10.19.88.255 dev br-GUEST table local proto kernel scope link src 10.19.88.1 
broadcast 10.19.89.0 dev br-LAN table local proto kernel scope link src 10.19.89.1 
local 10.19.89.1 dev br-LAN table local proto kernel scope host src 10.19.89.1 
broadcast 10.19.89.255 dev br-LAN table local proto kernel scope link src 10.19.89.1 
broadcast 10.19.90.0 dev eth1 table local proto kernel scope link src 10.19.90.21 
local 10.19.90.21 dev eth1 table local proto kernel scope host src 10.19.90.21 
broadcast 10.19.90.255 dev eth1 table local proto kernel scope link src 10.19.90.21 
local X.X.X.X dev MULLVAD table local proto kernel scope host src X.X.X.X 
broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1 
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 
unreachable fda8:2149:e3a8::/48 dev lo proto static metric 2147483647 error 4294967183 pref medium
fe80::/64 dev br-LAN proto kernel metric 256 pref medium
fe80::/64 dev eth1 proto kernel metric 256 pref medium
fe80::/64 dev wlan1 proto kernel metric 256 pref medium
fe80::/64 dev br-GUEST proto kernel metric 256 pref medium
local ::1 dev lo table local proto kernel metric 0 pref medium
anycast fe80:: dev br-LAN table local proto kernel metric 0 pref medium
anycast fe80:: dev eth1 table local proto kernel metric 0 pref medium
anycast fe80:: dev wlan1 table local proto kernel metric 0 pref medium
anycast fe80:: dev br-GUEST table local proto kernel metric 0 pref medium
local fe80::20d:b9ff:fe4c:a344 dev eth1 table local proto kernel metric 0 pref medium
local fe80::20d:b9ff:fe4c:a346 dev br-GUEST table local proto kernel metric 0 pref medium
local fe80::6f0:21ff:fe88:4033 dev wlan1 table local proto kernel metric 0 pref medium
local fe80::3832:67ff:fe2c:4f28 dev br-LAN table local proto kernel metric 0 pref medium
ff00::/8 dev br-LAN table local metric 256 pref medium
ff00::/8 dev eth1 table local metric 256 pref medium
ff00::/8 dev wlan1 table local metric 256 pref medium
ff00::/8 dev br-GUEST table local metric 256 pref medium
ff00::/8 dev MULLVAD table local metric 256 pref medium
ip rule show
0:      from all lookup local 
32766:  from all lookup main 
32767:  from all lookup default 
iptables-save
# Generated by iptables-save v1.8.3 on Tue Jan  5 14:00:17 2021
*nat
:PREROUTING ACCEPT [72:6901]
:INPUT ACCEPT [8:562]
:OUTPUT ACCEPT [4:292]
:POSTROUTING ACCEPT [4:256]
:postrouting_WG_FW_rule - [0:0]
:postrouting_guest_rule - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_WG_FW_rule - [0:0]
:prerouting_guest_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_WG_FW_postrouting - [0:0]
:zone_WG_FW_prerouting - [0:0]
:zone_guest_postrouting - [0:0]
:zone_guest_prerouting - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i br-LAN -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i br-GUEST -m comment --comment "!fw3" -j zone_guest_prerouting
-A PREROUTING -i eth1 -m comment --comment "!fw3" -j zone_wan_prerouting
-A PREROUTING -i MULLVAD -m comment --comment "!fw3" -j zone_WG_FW_prerouting
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o br-LAN -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o br-GUEST -m comment --comment "!fw3" -j zone_guest_postrouting
-A POSTROUTING -o eth1 -m comment --comment "!fw3" -j zone_wan_postrouting
-A POSTROUTING -o MULLVAD -m comment --comment "!fw3" -j zone_WG_FW_postrouting
-A zone_WG_FW_postrouting -m comment --comment "!fw3: Custom WG_FW postrouting rule chain" -j postrouting_WG_FW_rule
-A zone_WG_FW_postrouting -m comment --comment "!fw3" -j MASQUERADE
-A zone_WG_FW_prerouting -m comment --comment "!fw3: Custom WG_FW prerouting rule chain" -j prerouting_WG_FW_rule
-A zone_guest_postrouting -m comment --comment "!fw3: Custom guest postrouting rule chain" -j postrouting_guest_rule
-A zone_guest_prerouting -m comment --comment "!fw3: Custom guest prerouting rule chain" -j prerouting_guest_rule
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
COMMIT
# Completed on Tue Jan  5 14:00:17 2021
# Generated by iptables-save v1.8.3 on Tue Jan  5 14:00:17 2021
*mangle
:PREROUTING ACCEPT [1548:364171]
:INPUT ACCEPT [939:172762]
:FORWARD ACCEPT [597:189081]
:OUTPUT ACCEPT [973:228001]
:POSTROUTING ACCEPT [1570:417082]
-A FORWARD -o MULLVAD -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone WG_FW MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i MULLVAD -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone WG_FW MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Tue Jan  5 14:00:17 2021
# Generated by iptables-save v1.8.3 on Tue Jan  5 14:00:17 2021
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:forwarding_WG_FW_rule - [0:0]
:forwarding_guest_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_WG_FW_rule - [0:0]
:input_guest_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_WG_FW_rule - [0:0]
:output_guest_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_WG_FW_dest_ACCEPT - [0:0]
:zone_WG_FW_dest_REJECT - [0:0]
:zone_WG_FW_forward - [0:0]
:zone_WG_FW_input - [0:0]
:zone_WG_FW_output - [0:0]
:zone_WG_FW_src_REJECT - [0:0]
:zone_guest_dest_ACCEPT - [0:0]
:zone_guest_forward - [0:0]
:zone_guest_input - [0:0]
:zone_guest_output - [0:0]
:zone_guest_src_ACCEPT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-LAN -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i br-GUEST -m comment --comment "!fw3" -j zone_guest_input
-A INPUT -i eth1 -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i MULLVAD -m comment --comment "!fw3" -j zone_WG_FW_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-LAN -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i br-GUEST -m comment --comment "!fw3" -j zone_guest_forward
-A FORWARD -i eth1 -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i MULLVAD -m comment --comment "!fw3" -j zone_WG_FW_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-LAN -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o br-GUEST -m comment --comment "!fw3" -j zone_guest_output
-A OUTPUT -o eth1 -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o MULLVAD -m comment --comment "!fw3" -j zone_WG_FW_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_WG_FW_dest_ACCEPT -o MULLVAD -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_WG_FW_dest_ACCEPT -o MULLVAD -m comment --comment "!fw3" -j ACCEPT
-A zone_WG_FW_dest_REJECT -o MULLVAD -m comment --comment "!fw3" -j reject
-A zone_WG_FW_forward -m comment --comment "!fw3: Custom WG_FW forwarding rule chain" -j forwarding_WG_FW_rule
-A zone_WG_FW_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_WG_FW_forward -m comment --comment "!fw3" -j zone_WG_FW_dest_REJECT
-A zone_WG_FW_input -m comment --comment "!fw3: Custom WG_FW input rule chain" -j input_WG_FW_rule
-A zone_WG_FW_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_WG_FW_input -m comment --comment "!fw3" -j zone_WG_FW_src_REJECT
-A zone_WG_FW_output -m comment --comment "!fw3: Custom WG_FW output rule chain" -j output_WG_FW_rule
-A zone_WG_FW_output -m comment --comment "!fw3" -j zone_WG_FW_dest_ACCEPT
-A zone_WG_FW_src_REJECT -i MULLVAD -m comment --comment "!fw3" -j reject
-A zone_guest_dest_ACCEPT -o br-GUEST -m comment --comment "!fw3" -j ACCEPT
-A zone_guest_forward -m comment --comment "!fw3: Custom guest forwarding rule chain" -j forwarding_guest_rule
-A zone_guest_forward -m comment --comment "!fw3: Zone guest to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_guest_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_guest_forward -m comment --comment "!fw3" -j zone_guest_dest_ACCEPT
-A zone_guest_input -m comment --comment "!fw3: Custom guest input rule chain" -j input_guest_rule
-A zone_guest_input -p tcp -m tcp --dport 53 -m comment --comment "!fw3: Allow-DNS-Guest" -j ACCEPT
-A zone_guest_input -p udp -m udp --dport 53 -m comment --comment "!fw3: Allow-DNS-Guest" -j ACCEPT
-A zone_guest_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_guest_input -m comment --comment "!fw3" -j zone_guest_src_ACCEPT
-A zone_guest_output -m comment --comment "!fw3: Custom guest output rule chain" -j output_guest_rule
-A zone_guest_output -m comment --comment "!fw3" -j zone_guest_dest_ACCEPT
-A zone_guest_src_ACCEPT -i br-GUEST -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_dest_ACCEPT -o br-LAN -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to WG_FW forwarding policy" -j zone_WG_FW_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-LAN -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth1 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o eth1 -m comment --comment "!fw3" -j reject
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i eth1 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Tue Jan  5 14:00:17 2021

Because you have not permitted udp 67 for dhcp. INPUT and FORWARD can be drop/reject.
You are also mixing upper-lower case names, e.g in network you have GUEST, while in DHCP guest. Stick to lower case everywhere.

Finally you allow in firewall guest->wan forwarding only, however there is no default route in the routing table via the wan interface. You need to do Policy Based Routing and you have 3 options:

  1. mwan3 package
  2. pbr package
  3. a set of rules/routes for each internet connection.
2 Likes

Thank you for your reply.
I renamed all interfaces to lowercase and added:

firewall.@rule[9]=rule
firewall.@rule[9].dest_port='67-68'
firewall.@rule[9].src='guest'
firewall.@rule[9].name='Allow-Guest-DHCP'
firewall.@rule[9].target='ACCEPT'
firewall.@rule[9].proto='udp'
firewall.@rule[10]=rule
firewall.@rule[10].dest_port='53'
firewall.@rule[10].src='guest'
firewall.@rule[10].name='Allow-Guest-DNS'
firewall.@rule[10].target='ACCEPT'
firewall.@rule[10].proto='udp'

as well as:

vpn-policy-routing.@policy[0]=policy
vpn-policy-routing.@policy[0].interface='wan'
vpn-policy-routing.@policy[0].name='Guest'
vpn-policy-routing.@policy[0].src_addr='10.19.88.0/24'

But still DHCP in the guest network only works if Input, Output and Forward is set to 'ACCEPT' and I've no internet connection in the guest network.

uci show network
network.loopback=interface
network.loopback.ifname='lo'
network.loopback.proto='static'
network.loopback.ipaddr='127.0.0.1'
network.loopback.netmask='255.0.0.0'
network.globals=globals
network.globals.ula_prefix='fda8:2149:e3a8::/48'
network.wan=interface
network.wan.proto='dhcp'
network.wan.macaddr='00:0D:B9:4C:A3:44'
network.wan.ifname='eth1'
network.lan=interface
network.lan.proto='static'
network.lan.type='bridge'
network.lan.netmask='255.255.255.0'
network.lan.ipaddr='10.19.89.1'
network.lan.ifname='eth0 eth2'
network.mullvad=interface
network.mullvad.proto='wireguard'
network.mullvad.addresses='X.X.X.X'
network.mullvad.private_key='***'
network.mullvad.force_link='1'
network.@wireguard_mullvad[0]=wireguard_mullvad
network.@wireguard_mullvad[0].persistent_keepalive='25'
network.@wireguard_mullvad[0].endpoint_port='51820'
network.@wireguard_mullvad[0].allowed_ips='0.0.0.0/0'
network.@wireguard_mullvad[0].endpoint_host='nl4-wireguard.mullvad.net'
network.@wireguard_mullvad[0].public_key='hnRyse6QxPPcZOoSwRsHUtK1W+APWXnIoaDTmH6JsHQ='
network.@wireguard_mullvad[0].description='nl4-wireguard.mullvad.net'
network.guest=interface
network.guest.type='bridge'
network.guest.proto='static'
network.guest.ipaddr='10.19.88.1'
network.guest.netmask='255.255.255.0'
network.guest.ifname='eth3'
uci show firewall
firewall.@defaults[0]=defaults
firewall.@defaults[0].input='ACCEPT'
firewall.@defaults[0].output='ACCEPT'
firewall.@defaults[0].forward='REJECT'
firewall.@defaults[0].synflood_protect='1'
firewall.@zone[0]=zone
firewall.@zone[0].name='lan'
firewall.@zone[0].input='ACCEPT'
firewall.@zone[0].forward='ACCEPT'
firewall.@zone[0].network='lan'
firewall.@zone[0].output='ACCEPT'
firewall.@zone[1]=zone
firewall.@zone[1].name='guest'
firewall.@zone[1].input='ACCEPT'
firewall.@zone[1].network='guest'
firewall.@zone[1].forward='ACCEPT'
firewall.@zone[1].output='ACCEPT'
firewall.wan=zone
firewall.wan.name='wan'
firewall.wan.input='REJECT'
firewall.wan.output='ACCEPT'
firewall.wan.forward='REJECT'
firewall.wan.network='wan'
firewall.@rule[0]=rule
firewall.@rule[0].name='Allow-DHCP-Renew'
firewall.@rule[0].src='wan'
firewall.@rule[0].proto='udp'
firewall.@rule[0].dest_port='68'
firewall.@rule[0].target='ACCEPT'
firewall.@rule[0].family='ipv4'
firewall.@rule[1]=rule
firewall.@rule[1].name='Allow-Ping'
firewall.@rule[1].src='wan'
firewall.@rule[1].proto='icmp'
firewall.@rule[1].icmp_type='echo-request'
firewall.@rule[1].family='ipv4'
firewall.@rule[1].target='ACCEPT'
firewall.@rule[2]=rule
firewall.@rule[2].name='Allow-IGMP'
firewall.@rule[2].src='wan'
firewall.@rule[2].proto='igmp'
firewall.@rule[2].family='ipv4'
firewall.@rule[2].target='ACCEPT'
firewall.@rule[3]=rule
firewall.@rule[3].name='Allow-DHCPv6'
firewall.@rule[3].src='wan'
firewall.@rule[3].proto='udp'
firewall.@rule[3].src_ip='fc00::/6'
firewall.@rule[3].dest_ip='fc00::/6'
firewall.@rule[3].dest_port='546'
firewall.@rule[3].family='ipv6'
firewall.@rule[3].target='ACCEPT'
firewall.@rule[4]=rule
firewall.@rule[4].name='Allow-MLD'
firewall.@rule[4].src='wan'
firewall.@rule[4].proto='icmp'
firewall.@rule[4].src_ip='fe80::/10'
firewall.@rule[4].icmp_type='130/0' '131/0' '132/0' '143/0'
firewall.@rule[4].family='ipv6'
firewall.@rule[4].target='ACCEPT'
firewall.@rule[5]=rule
firewall.@rule[5].name='Allow-ICMPv6-Input'
firewall.@rule[5].src='wan'
firewall.@rule[5].proto='icmp'
firewall.@rule[5].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type' 'router-solicitation' 'neighbour-solicitation' 'router-advertisement' 'neighbour-advertisement'
firewall.@rule[5].limit='1000/sec'
firewall.@rule[5].family='ipv6'
firewall.@rule[5].target='ACCEPT'
firewall.@rule[6]=rule
firewall.@rule[6].name='Allow-ICMPv6-Forward'
firewall.@rule[6].src='wan'
firewall.@rule[6].dest='*'
firewall.@rule[6].proto='icmp'
firewall.@rule[6].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type'
firewall.@rule[6].limit='1000/sec'
firewall.@rule[6].family='ipv6'
firewall.@rule[6].target='ACCEPT'
firewall.@rule[7]=rule
firewall.@rule[7].name='Allow-IPSec-ESP'
firewall.@rule[7].src='wan'
firewall.@rule[7].dest='lan'
firewall.@rule[7].proto='esp'
firewall.@rule[7].target='ACCEPT'
firewall.@rule[8]=rule
firewall.@rule[8].name='Allow-ISAKMP'
firewall.@rule[8].src='wan'
firewall.@rule[8].dest='lan'
firewall.@rule[8].dest_port='500'
firewall.@rule[8].proto='udp'
firewall.@rule[8].target='ACCEPT'
firewall.@include[0]=include
firewall.@include[0].path='/etc/firewall.user'
firewall.@zone[3]=zone
firewall.@zone[3].network='mullvad'
firewall.@zone[3].mtu_fix='1'
firewall.@zone[3].input='REJECT'
firewall.@zone[3].forward='REJECT'
firewall.@zone[3].masq='1'
firewall.@zone[3].output='ACCEPT'
firewall.@zone[3].name='mullvad'
firewall.@forwarding[0]=forwarding
firewall.@forwarding[0].src='lan'
firewall.@forwarding[0].dest='mullvad'
firewall.@forwarding[1]=forwarding
firewall.@forwarding[1].dest='wan'
firewall.@forwarding[1].src='guest'
firewall.@rule[9]=rule
firewall.@rule[9].dest_port='67-68'
firewall.@rule[9].src='guest'
firewall.@rule[9].name='Allow-Guest-DHCP'
firewall.@rule[9].target='ACCEPT'
firewall.@rule[9].proto='udp'
firewall.@rule[10]=rule
firewall.@rule[10].dest_port='53'
firewall.@rule[10].src='guest'
firewall.@rule[10].name='Allow-Guest-DNS'
firewall.@rule[10].target='ACCEPT'
firewall.@rule[10].proto='udp'
uci show dhcp
dhcp.@dnsmasq[0]=dnsmasq
dhcp.@dnsmasq[0].domainneeded='1'
dhcp.@dnsmasq[0].localise_queries='1'
dhcp.@dnsmasq[0].rebind_protection='1'
dhcp.@dnsmasq[0].rebind_localhost='1'
dhcp.@dnsmasq[0].local='/lan/'
dhcp.@dnsmasq[0].domain='lan'
dhcp.@dnsmasq[0].expandhosts='1'
dhcp.@dnsmasq[0].authoritative='1'
dhcp.@dnsmasq[0].readethers='1'
dhcp.@dnsmasq[0].leasefile='/tmp/dhcp.leases'
dhcp.@dnsmasq[0].resolvfile='/tmp/resolv.conf.auto'
dhcp.@dnsmasq[0].localservice='1'
dhcp.@dnsmasq[0].logqueries='1'
dhcp.@dnsmasq[0].server='10.19.89.2'
dhcp.@dnsmasq[0].interface='br-lan' 'br-guest'
dhcp.wan=dhcp
dhcp.wan.interface='wan'
dhcp.wan.ignore='1'
dhcp.odhcpd=odhcpd
dhcp.odhcpd.maindhcp='0'
dhcp.odhcpd.leasefile='/tmp/hosts/odhcpd'
dhcp.odhcpd.leasetrigger='/usr/sbin/odhcpd-update'
dhcp.odhcpd.loglevel='4'
dhcp.lan=dhcp
dhcp.lan.start='100'
dhcp.lan.leasetime='12h'
dhcp.lan.interface='lan'
dhcp.lan.limit='150'
dhcp.lan.dhcp_option='6,10.19.89.2'
dhcp.@host[0]=host
dhcp.@host[0].mac='EA:25:6F:59:08:0F'
dhcp.@host[0].name='pihole'
dhcp.@host[0].dns='1'
dhcp.@host[0].ip='10.19.89.2'
dhcp.@host[1]=host
dhcp.@host[1].name='apu2'
dhcp.@host[1].dns='1'
dhcp.@host[1].ip='10.19.89.3'
dhcp.@host[1].mac='92:B9:59:7E:F3:97'
dhcp.guest=dhcp
dhcp.guest.interface='guest'
dhcp.guest.start='100'
dhcp.guest.limit='150'
dhcp.guest.leasetime='1h'
dhcp.guest.dhcp_option='6,10.19.88.1'
uci show vpn-policy-routing
vpn-policy-routing.config=vpn-policy-routing
vpn-policy-routing.config.verbosity='2'
vpn-policy-routing.config.strict_enforcement='1'
vpn-policy-routing.config.src_ipset='0'
vpn-policy-routing.config.dest_ipset='dnsmasq.ipset'
vpn-policy-routing.config.ipv6_enabled='0'
vpn-policy-routing.config.supported_interface=''
vpn-policy-routing.config.ignored_interface='vpnserver wgserver'
vpn-policy-routing.config.boot_timeout='30'
vpn-policy-routing.config.iptables_rule_option='append'
vpn-policy-routing.config.iprule_enabled='0'
vpn-policy-routing.config.webui_enable_column='0'
vpn-policy-routing.config.webui_protocol_column='0'
vpn-policy-routing.config.webui_chain_column='0'
vpn-policy-routing.config.webui_sorting='1'
vpn-policy-routing.config.webui_supported_protocol='tcp' 'udp' 'tcp udp' 'icmp' 'all'
vpn-policy-routing.config.enabled='1'
vpn-policy-routing.@include[0]=include
vpn-policy-routing.@include[0].path='/etc/vpn-policy-routing.netflix.user'
vpn-policy-routing.@include[0].enabled='0'
vpn-policy-routing.@include[1]=include
vpn-policy-routing.@include[1].path='/etc/vpn-policy-routing.aws.user'
vpn-policy-routing.@include[1].enabled='0'
vpn-policy-routing.@policy[0]=policy
vpn-policy-routing.@policy[0].interface='wan'
vpn-policy-routing.@policy[0].name='Guest'
vpn-policy-routing.@policy[0].src_addr='10.19.88.0/24'

iptables-save -c | grep Allow; service firewall restart; iptables-save -c | grep Allow

Hey, this morning even the LAN connection didn't work so I did a factory reset and start all over again. After installing / configuring vpn-policy-routing and adding the DHCP and DNS rules for the Guest network everything works! And reconfiguring took only 10 minutes :+1:

Their must have been old messed up configs from the trail and error phase :wink:

I added the working configs:

uci show network
network.loopback=interface
network.loopback.ifname='lo'
network.loopback.proto='static'
network.loopback.ipaddr='127.0.0.1'
network.loopback.netmask='255.0.0.0'
network.globals=globals
network.globals.ula_prefix='fd30:f1aa:41e2::/48'
network.lan=interface
network.lan.type='bridge'
network.lan.ifname='eth0 eth2'
network.lan.proto='static'
network.lan.ipaddr='10.19.89.1'
network.lan.netmask='255.255.255.0'
network.lan.ip6assign='60'
network.wan=interface
network.wan.ifname='eth1'
network.wan.proto='dhcp'
network.mullvad=interface
network.mullvad.proto='wireguard'
network.mullvad.addresses='X.X.X.X/32'
network.mullvad.private_key='***'
network.mullvad.force_link='1'
network.@wireguard_mullvad[0]=wireguard_mullvad
network.@wireguard_mullvad[0].persistent_keepalive='25'
network.@wireguard_mullvad[0].endpoint_port='51820'
network.@wireguard_mullvad[0].allowed_ips='0.0.0.0/0'
network.@wireguard_mullvad[0].endpoint_host='nl4-wireguard.mullvad.net'
network.@wireguard_mullvad[0].public_key='hnRyse6QxPPcZOoSwRsHUtK1W+APWXnIoaDTmH6JsHQ='
network.@wireguard_mullvad[0].description='nl4-wireguard.mullvad.net'
network.@wireguard_mullvad[0].route_allowed_ips='1'
network.guest=interface
network.guest.proto='static'
network.guest.ifname='eth3'
network.guest.type='bridge'
network.guest.netmask='255.255.255.0'
network.guest.ipaddr='10.19.88.1'
network.guest.dns='10.19.89.2'```
uci show firewall
firewall.@defaults[0]=defaults
firewall.@defaults[0].input='ACCEPT'
firewall.@defaults[0].output='ACCEPT'
firewall.@defaults[0].forward='REJECT'
firewall.@defaults[0].synflood_protect='1'
firewall.@zone[0]=zone
firewall.@zone[0].name='lan'
firewall.@zone[0].input='ACCEPT'
firewall.@zone[0].output='ACCEPT'
firewall.@zone[0].forward='ACCEPT'
firewall.@zone[0].network='lan'
firewall.@zone[1]=zone
firewall.@zone[1].network='guest'
firewall.@zone[1].output='ACCEPT'
firewall.@zone[1].name='guest'
firewall.@zone[1].input='REJECT'
firewall.@zone[1].forward='REJECT'
firewall.@zone[2]=zone
firewall.@zone[2].name='wan'
firewall.@zone[2].input='REJECT'
firewall.@zone[2].output='ACCEPT'
firewall.@zone[2].forward='REJECT'
firewall.@zone[2].masq='1'
firewall.@zone[2].mtu_fix='1'
firewall.@zone[2].network='wan'
firewall.@rule[0]=rule
firewall.@rule[0].name='Allow-DHCP-Renew'
firewall.@rule[0].src='wan'
firewall.@rule[0].proto='udp'
firewall.@rule[0].dest_port='68'
firewall.@rule[0].target='ACCEPT'
firewall.@rule[0].family='ipv4'
firewall.@rule[1]=rule
firewall.@rule[1].name='Allow-Ping'
firewall.@rule[1].src='wan'
firewall.@rule[1].proto='icmp'
firewall.@rule[1].icmp_type='echo-request'
firewall.@rule[1].family='ipv4'
firewall.@rule[1].target='ACCEPT'
firewall.@rule[2]=rule
firewall.@rule[2].name='Allow-IGMP'
firewall.@rule[2].src='wan'
firewall.@rule[2].proto='igmp'
firewall.@rule[2].family='ipv4'
firewall.@rule[2].target='ACCEPT'
firewall.@rule[3]=rule
firewall.@rule[3].name='Allow-DHCPv6'
firewall.@rule[3].src='wan'
firewall.@rule[3].proto='udp'
firewall.@rule[3].src_ip='fc00::/6'
firewall.@rule[3].dest_ip='fc00::/6'
firewall.@rule[3].dest_port='546'
firewall.@rule[3].family='ipv6'
firewall.@rule[3].target='ACCEPT'
firewall.@rule[4]=rule
firewall.@rule[4].name='Allow-MLD'
firewall.@rule[4].src='wan'
firewall.@rule[4].proto='icmp'
firewall.@rule[4].src_ip='fe80::/10'
firewall.@rule[4].icmp_type='130/0' '131/0' '132/0' '143/0'
firewall.@rule[4].family='ipv6'
firewall.@rule[4].target='ACCEPT'
firewall.@rule[5]=rule
firewall.@rule[5].name='Allow-ICMPv6-Input'
firewall.@rule[5].src='wan'
firewall.@rule[5].proto='icmp'
firewall.@rule[5].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type' 'router-solicitation' 'neighbour-solicitation' 'router-advertisement' 'neighbour-advertisement'
firewall.@rule[5].limit='1000/sec'
firewall.@rule[5].family='ipv6'
firewall.@rule[5].target='ACCEPT'
firewall.@rule[6]=rule
firewall.@rule[6].name='Allow-ICMPv6-Forward'
firewall.@rule[6].src='wan'
firewall.@rule[6].dest='*'
firewall.@rule[6].proto='icmp'
firewall.@rule[6].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type'
firewall.@rule[6].limit='1000/sec'
firewall.@rule[6].family='ipv6'
firewall.@rule[6].target='ACCEPT'
firewall.@rule[7]=rule
firewall.@rule[7].name='Allow-IPSec-ESP'
firewall.@rule[7].src='wan'
firewall.@rule[7].dest='lan'
firewall.@rule[7].proto='esp'
firewall.@rule[7].target='ACCEPT'
firewall.@rule[8]=rule
firewall.@rule[8].name='Allow-ISAKMP'
firewall.@rule[8].src='wan'
firewall.@rule[8].dest='lan'
firewall.@rule[8].dest_port='500'
firewall.@rule[8].proto='udp'
firewall.@rule[8].target='ACCEPT'
firewall.@include[0]=include
firewall.@include[0].path='/etc/firewall.user'
firewall.@zone[3]=zone
firewall.@zone[3].network='mullvad'
firewall.@zone[3].name='mullvad'
firewall.@zone[3].mtu_fix='1'
firewall.@zone[3].input='REJECT'
firewall.@zone[3].forward='REJECT'
firewall.@zone[3].masq='1'
firewall.@zone[3].output='ACCEPT'
firewall.@forwarding[0]=forwarding
firewall.@forwarding[0].dest='mullvad'
firewall.@forwarding[0].src='lan'
firewall.@forwarding[1]=forwarding
firewall.@forwarding[1].dest='wan'
firewall.@forwarding[1].src='guest'
firewall.@rule[9]=rule
firewall.@rule[9].dest_port='67-68'
firewall.@rule[9].src='guest'
firewall.@rule[9].name='Allow-Guest-DHCP'
firewall.@rule[9].target='ACCEPT'
firewall.@rule[9].proto='udp'
firewall.@rule[10]=rule
firewall.@rule[10].dest_port='53'
firewall.@rule[10].src='guest'
firewall.@rule[10].name='Allow-Guest-DNS'
firewall.@rule[10].target='ACCEPT'
firewall.@rule[10].proto='udp'
uci show dhcp
dhcp.@dnsmasq[0]=dnsmasq
dhcp.@dnsmasq[0].domainneeded='1'
dhcp.@dnsmasq[0].boguspriv='1'
dhcp.@dnsmasq[0].filterwin2k='0'
dhcp.@dnsmasq[0].localise_queries='1'
dhcp.@dnsmasq[0].rebind_protection='1'
dhcp.@dnsmasq[0].rebind_localhost='1'
dhcp.@dnsmasq[0].local='/lan/'
dhcp.@dnsmasq[0].domain='lan'
dhcp.@dnsmasq[0].expandhosts='1'
dhcp.@dnsmasq[0].nonegcache='0'
dhcp.@dnsmasq[0].authoritative='1'
dhcp.@dnsmasq[0].readethers='1'
dhcp.@dnsmasq[0].leasefile='/tmp/dhcp.leases'
dhcp.@dnsmasq[0].resolvfile='/tmp/resolv.conf.auto'
dhcp.@dnsmasq[0].nonwildcard='1'
dhcp.@dnsmasq[0].localservice='1'
dhcp.lan=dhcp
dhcp.lan.interface='lan'
dhcp.lan.start='100'
dhcp.lan.limit='150'
dhcp.lan.leasetime='12h'
dhcp.lan.dhcpv6='server'
dhcp.lan.ra='server'
dhcp.lan.dhcp_option='6,10.19.89.2'
dhcp.lan.ra_management='1'
dhcp.wan=dhcp
dhcp.wan.interface='wan'
dhcp.wan.ignore='1'
dhcp.odhcpd=odhcpd
dhcp.odhcpd.maindhcp='0'
dhcp.odhcpd.leasefile='/tmp/hosts/odhcpd'
dhcp.odhcpd.leasetrigger='/usr/sbin/odhcpd-update'
dhcp.odhcpd.loglevel='4'
dhcp.guest=dhcp
dhcp.guest.start='100'
dhcp.guest.leasetime='12h'
dhcp.guest.limit='150'
dhcp.guest.interface='guest'
uci show vpn-policy-routing
vpn-policy-routing.config=vpn-policy-routing
vpn-policy-routing.config.verbosity='2'
vpn-policy-routing.config.strict_enforcement='1'
vpn-policy-routing.config.src_ipset='0'
vpn-policy-routing.config.dest_ipset='dnsmasq.ipset'
vpn-policy-routing.config.ipv6_enabled='0'
vpn-policy-routing.config.supported_interface=''
vpn-policy-routing.config.ignored_interface='vpnserver wgserver'
vpn-policy-routing.config.boot_timeout='30'
vpn-policy-routing.config.iptables_rule_option='append'
vpn-policy-routing.config.iprule_enabled='0'
vpn-policy-routing.config.webui_enable_column='0'
vpn-policy-routing.config.webui_protocol_column='0'
vpn-policy-routing.config.webui_chain_column='0'
vpn-policy-routing.config.webui_sorting='1'
vpn-policy-routing.config.webui_supported_protocol='tcp' 'udp' 'tcp udp' 'icmp' 'all'
vpn-policy-routing.config.enabled='1'
vpn-policy-routing.@include[0]=include
vpn-policy-routing.@include[0].path='/etc/vpn-policy-routing.netflix.user'
vpn-policy-routing.@include[0].enabled='0'
vpn-policy-routing.@include[1]=include
vpn-policy-routing.@include[1].path='/etc/vpn-policy-routing.aws.user'
vpn-policy-routing.@include[1].enabled='0'
vpn-policy-routing.@policy[0]=policy
vpn-policy-routing.@policy[0].interface='wan'
vpn-policy-routing.@policy[0].name='Guest'
vpn-policy-routing.@policy[0].src_addr='10.19.88.2/24'
vpn-policy-routing.@policy[1]=policy
vpn-policy-routing.@policy[1].interface='wan'
1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.