Guest network clients do not get IP address from DHCP

When I try to connect a client to my guest network it stays at "Optaining IP address..." indefinitely. First I thought my DHCP server was not running but it works just fine on my other interfaces. Then I remembered changing some rules in my firewall to support network wide ad blocking via a forced DNS server but I only have rudimentary knowledge about this so I think I am missing something.

Note: "alfred" is my IOT network

/etc/config/dhcpcd

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option expandhosts '1'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.auto'
	option localservice '1'
	option domain 'olymp'
	option local '/olymp/'
	option confdir '/tmp/dnsmasq.d'
	option noresolv '1'
	option port '53'
	list server '127.0.0.1#1053'
	list server '::1#1053'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '1'
	list dns 'fd20:cf90:8d13::1'
	list domain 'olymp'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'guest'
	option start '100'
	option limit '150'
	option interface 'guest'
	option force '1'
	option leasetime '30m'

config dhcp 'alfred'
	option start '100'
	option leasetime '12h'
	option limit '150'
	option interface 'alfred'

/etc/config/network

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix '…'

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ipaddr '10.100.0.1'

config device 'lan_eth0_1_dev'
	option name 'eth0.1'
	option macaddr '…'

config interface 'wan'
	option ifname 'eth0.2'
	option proto 'dhcp'

config device 'wan_eth0_2_dev'
	option name 'eth0.2'
	option macaddr '…'

config interface 'wan6'
	option ifname 'eth0.2'
	option proto 'dhcpv6'
	option reqaddress 'try'
	option reqprefix 'auto'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'
	option ar8xxx_mib_type '0'
	option ar8xxx_mib_poll_interval '500'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '1 2 3 4 0t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '5 0t'

config interface 'alfred'
	option proto 'static'
	option netmask '255.255.255.0'
	option ipaddr '10.200.0.1'

config interface 'vpn'
	option proto 'wireguard'
	option private_key '…'
	option listen_port '80'
	list addresses '1234:5678::1/64'

config wireguard_vpn
	option route_allowed_ips '1'
	option public_key '…'
	option description '…'
	list allowed_ips '1234:5678::3/128'

config wireguard_vpn
	option route_allowed_ips '1'
	option public_key '…'
	option description '…'
	list allowed_ips '1234:5678::2/64'

config interface 'guest'
	option proto 'static'
	option ipaddr '192.168.0.1'
	option netmask '255.255.255.0'

/etc/config/firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone 'lan'
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'
	list network 'vpn'

config zone 'wan'
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'
	option enabled '0'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'
	option enabled '0'

config include
	option path '/etc/firewall.user'

config zone 'guestzone'
	option forward 'REJECT'
	option name 'guestzone'
	option output 'ACCEPT'
	list network 'guest'
	option input 'REJECT'

config zone 'alfredzone'
	option input 'ACCEPT'
	option forward 'REJECT'
	option name 'alfredzone'
	option output 'ACCEPT'
	list network 'alfred'

config forwarding
	option dest 'alfredzone'
	option src 'lan'

config forwarding
	option dest 'wan'
	option src 'guestzone'

config rule
	option src 'guestzone'
	option name 'Guest DHCP'
	option target 'ACCEPT'
	list proto 'tcp'
	list proto 'udp'
	option dest_port '67 68'

config rule
	option src 'guestzone'
	option name 'Guest DNS'
	option proto 'tcp udp'
	option target 'ACCEPT'
	option dest_port '53 853 5353'

config redirect 'adblock_dns_53'
	option name 'Adblock DNS, port 53'
	option src 'lan'
	option proto 'tcp udp'
	option src_dport '53'
	option dest_port '53'
	option target 'DNAT'

config redirect 'adblock_dns_853'
	option name 'Adblock DNS, port 853'
	option src 'lan'
	option proto 'tcp udp'
	option src_dport '853'
	option dest_port '853'
	option target 'DNAT'

config redirect 'adblock_dns_5353'
	option name 'Adblock DNS, port 5353'
	option src 'lan'
	option proto 'tcp udp'
	option src_dport '5353'
	option dest_port '5353'
	option target 'DNAT'

config rule
	option dest 'wan'
	option proto 'tcp udp'
	option dest_port '53 853 5353'
	option target 'REJECT'
	option src '*'
	option name 'Block public DNS'

config rule 'wg'
	option name 'Allow WireGuard'
	option src 'wan'
	option dest_port '80'
	option target 'ACCEPT'
	list proto 'udp'

config zone 'lonely'
	option name 'zerotier'
	option input 'ACCEPT'
	option forward 'REJECT'
	option output 'ACCEPT'
	option device 'zt+'
	option masq '1'
	option mtu_fix '1'

config forwording
	option dest 'zerotier'
	option src 'lan'

config forwarding
	option dest 'lan'
	option src 'zerotier'
1 Like

If you reject input from guest network in the firewall (which is a good idea btw), you need to add new rules to allow dns and dhcp:

Maybe this is useful (its my setup guide for doing guestnet on multiple access points).

2 Likes

I do have these two rules setup already ("Guest DHCP" and "Guest DNS") but I think I made a mistake somewhere. Setting a static IP in my client does establish a connection but I am still without access to the internet.

get putty or some other telnet capable application, and try to connect to the port(s) of the the host(s) running DNS and DHCP, while connected to the guest network.

If there's a reply, the firewall rule works.

I get "No route to host" when using Termux on my Android device (I do not have any other Wifi capable device, all desktops are wired) and running telnet 192.168.0.1 67. But I might misunderstand what you meant by your tip.

Not familiar with termux, but it looks correct to me.

So I understand, the guest network runs at 192.168.0, does the rest of the network run on 10.100.0.?

Yes, my "private" LAN is on 10.100.0.1/24, my IOT wifi network is on 10.200.0.1/24 and guest network should be on 192.168.0.1/24.

have you verified the DNS and DHCP actually listens to the 192.168.0 subnet ?

try doing a telnet 192.168.0.1 (if that's the routers' IP on that net) on the DNS or DHCP port(s) on the router.

Do you happen to know what package in OpenWrt 19.07 does include a telnet client? I only found perl and ruby clients both which I do not know how to use.

seems they removed it, but nc would work too

package name is ncat

Thanks that seems to work. Now I get a "Connection refused" on port 67 and an indefinite wait on port 53.

so they don't appear to be listening to the subnet, which would explain why it doesn't work for you.

you have three options.

  • create route from the 192.168.0 subnet to the 10.x00 subnet for DNS and DHCP
  • make them listen
  • create additional DNS and DHCP for the 192.168.0 subnet

Try to connect a guest client, then check the firewall counters:

iptables-save -c | grep -i -e guest
1 Like
:postrouting_guestzone_rule - [0:0]
:prerouting_guestzone_rule - [0:0]
:zone_guestzone_postrouting - [0:0]
:zone_guestzone_prerouting - [0:0]
[0:0] -A PREROUTING -i wlan1-1 -m comment --comment "!fw3" -j zone_guestzone_prerouting
[1550:86832] -A POSTROUTING -o wlan1-1 -m comment --comment "!fw3" -j zone_guestzone_postrouting
[1550:86832] -A zone_guestzone_postrouting -m comment --comment "!fw3: Custom guestzone postrouting rule chain" -j postrouting_guestzone_rule
[0:0] -A zone_guestzone_prerouting -m comment --comment "!fw3: Custom guestzone prerouting rule chain" -j prerouting_guestzone_rule
:forwarding_guestzone_rule - [0:0]
:input_guestzone_rule - [0:0]
:output_guestzone_rule - [0:0]
:zone_guestzone_dest_ACCEPT - [0:0]
:zone_guestzone_dest_REJECT - [0:0]
:zone_guestzone_forward - [0:0]
:zone_guestzone_input - [0:0]
:zone_guestzone_output - [0:0]
:zone_guestzone_src_REJECT - [0:0]
[0:0] -A INPUT -i wlan1-1 -m comment --comment "!fw3" -j zone_guestzone_input
[0:0] -A FORWARD -i wlan1-1 -m comment --comment "!fw3" -j zone_guestzone_forward
[208823:31650304] -A OUTPUT -o wlan1-1 -m comment --comment "!fw3" -j zone_guestzone_output
[208823:31650304] -A zone_guestzone_dest_ACCEPT -o wlan1-1 -m comment --comment "!fw3" -j ACCEPT
[0:0] -A zone_guestzone_dest_REJECT -o wlan1-1 -m comment --comment "!fw3" -j reject
[0:0] -A zone_guestzone_forward -m comment --comment "!fw3: Custom guestzone forwarding rule chain" -j forwarding_guestzone_rule
[0:0] -A zone_guestzone_forward -m comment --comment "!fw3: Zone guestzone to wan forwarding policy" -j zone_wan_dest_ACCEPT
[0:0] -A zone_guestzone_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
[0:0] -A zone_guestzone_forward -m comment --comment "!fw3" -j zone_guestzone_dest_REJECT
[0:0] -A zone_guestzone_input -m comment --comment "!fw3: Custom guestzone input rule chain" -j input_guestzone_rule
[0:0] -A zone_guestzone_input -p tcp -m tcp --dport 67:68 -m comment --comment "!fw3: Guest DHCP" -j ACCEPT
[0:0] -A zone_guestzone_input -p udp -m udp --dport 67:68 -m comment --comment "!fw3: Guest DHCP" -j ACCEPT
[0:0] -A zone_guestzone_input -p tcp -m tcp --dport 53 -m comment --comment "!fw3: Guest DNS" -j ACCEPT
[0:0] -A zone_guestzone_input -p tcp -m tcp --dport 853 -m comment --comment "!fw3: Guest DNS" -j ACCEPT
[0:0] -A zone_guestzone_input -p tcp -m tcp --dport 5353 -m comment --comment "!fw3: Guest DNS" -j ACCEPT
[0:0] -A zone_guestzone_input -p udp -m udp --dport 53 -m comment --comment "!fw3: Guest DNS" -j ACCEPT
[0:0] -A zone_guestzone_input -p udp -m udp --dport 853 -m comment --comment "!fw3: Guest DNS" -j ACCEPT
[0:0] -A zone_guestzone_input -p udp -m udp --dport 5353 -m comment --comment "!fw3: Guest DNS" -j ACCEPT
[0:0] -A zone_guestzone_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
[0:0] -A zone_guestzone_input -m comment --comment "!fw3" -j zone_guestzone_src_REJECT
[208823:31650304] -A zone_guestzone_output -m comment --comment "!fw3: Custom guestzone output rule chain" -j output_guestzone_rule
[208823:31650304] -A zone_guestzone_output -m comment --comment "!fw3" -j zone_guestzone_dest_ACCEPT
[0:0] -A zone_guestzone_src_REJECT -i wlan1-1 -m comment --comment "!fw3" -j reject
1 Like

How would I do that? I can not find any setting in Luci that suggests that it is not listening. The DHCP setting for my guest network does not disable DHCP for this interface.

uci set network.guest.type="bridge"
uci commit network
/etc/init.d/network restart
1 Like

Of course it had to be something stupid :man_facepalming:

Thanks a lot, seems to work now!

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.