Guest network gets wrong ip addresses

Installing and Using OpenWrt Network and Wireless Configuration
1

Hi!
I recently set up a guest network but when I connect to the network I get the ip adress: 192.168.0.8. This is supposed to be 192.168.2.8. I see in the log

Fri Jul 30 00:39:35 2021 daemon.info dnsmasq-dhcp[4041]: DHCP, IP range 192.168.0.2 -- 192.168.0.9, lease time 6h
Fri Jul 30 00:39:35 2021 daemon.info dnsmasq-dhcp[4041]: DHCP, IP range 192.168.0.2 -- 192.168.0.251, lease time 1d

The one with the 6 hour lease is the guest one and is supposed to be 192.168.2.2-192.168.2.9.
Why could this be happening?
Here are some config files:
network:


config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0.1'
	option igmp_snooping '1'
	option ipv6 '0'

config device
	option name 'eth0.1'
	option macaddr '88:c3:97:84:4b:5b'
	option ipv6 '0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option netmask '255.255.255.0'
	option ipaddr '192.168.0.1'
	option delegate '0'

config interface 'wan'
	option device 'eth0.2'
	option proto 'static'
	option netmask '255.255.255.0'
	list dns '1.1.1.1'
	list dns '1.0.0.1'
	option delegate '0'
	option ipaddr '192.168.1.254'
	option gateway '192.168.1.1'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0t 2 3'
	option vid '1'
	option description 'LAN'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '0t 1'
	option vid '2'
	option description 'WAN'

config device
	option name 'wlan0'
	option ipv6 '0'

config device
	option name 'eth0'
	option ipv6 '0'

config device
	option name 'eth0.2'
	option type '8021q'
	option ifname 'eth0'
	option vid '2'
	option ipv6 '0'

config switch_vlan
	option device 'switch0'
	option vlan '3'
	option ports '0t 4'
	option vid '3'
	option description 'GUEST'

config interface 'guest'
	option proto 'static'
	option netmask '255.255.0.0'
	option delegate '0'
	option type 'bridge'
	option ipaddr '192.168.2.1'

config device
	option name 'eth0.3'
	option type '8021q'
	option ifname 'eth0'
	option vid '3'
	option ipv6 '0'

config device
	option name 'wlan1'
	option ipv6 '0'

config interface 'wg_lan'
	option proto 'wireguard'
	option private_key 
	option listen_port '51820'
	list addresses '100.0.0.1/24'
	option mtu '1420'

config wireguard_wg_lan
	option public_key 
	option preshared_key 
	option description
	list allowed_ips '100.0.0.2/32'
	option route_allowed_ips '1'
	option persistent_keepalive '25'

config wireguard_wg_lan
	option public_key 
	option preshared_key 
	option description '2_lan_Test'
	list allowed_ips '100.0.0.3/32'
	option route_allowed_ips '1'
	option persistent_keepalive '25'

dhcp:


config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option ednspacket_max '1232'
	option confdir '/tmp/dnsmasq.d'
	option localservice '1'

config dhcp 'lan'
	option interface 'lan'
	option dhcpv4 'server'
	option start '2'
	option limit '250'
	option leasetime '24h'
	option netmask '255.255.255.0'

config dhcp 'guest'
	option interface 'guest'
	option dhcpv4 'server'
	option start '2'
	option limit '8'
	option leasetime '6h'
	option force '1'
	option netmask '255.255.0.0'

firewall:


config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'
	option flow_offloading '1'

config zone 'lan'
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option family 'ipv4'
	option network 'lan wg_lan'
	list device 'ppp+'

config zone 'wan'
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	option family 'ipv4'
	list network 'wan'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option proto 'icmp'
	option family 'ipv4'
	option target 'ACCEPT'
	option name 'Allow-ICMP'
	option src '*'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Support-UDP-Traceroute'
	option src 'wan'
	option dest_port '33434:33689'
	option proto 'udp'
	option family 'ipv4'
	option target 'REJECT'
	option enabled '0'

config include
	option path '/etc/firewall.user'

config redirect 'adblock_lan53'
	option name 'Adblock DNS (lan, 53)'
	option src 'lan'
	option proto 'tcp udp'
	option src_dport '53'
	option dest_port '53'
	option target 'DNAT'

config redirect 'adblock_lan853'
	option name 'Adblock DNS (lan, 853)'
	option src 'lan'
	option proto 'tcp udp'
	option src_dport '853'
	option dest_port '853'
	option target 'DNAT'

config redirect 'adblock_lan5353'
	option name 'Adblock DNS (lan, 5353)'
	option src 'lan'
	option proto 'tcp udp'
	option src_dport '5353'
	option dest_port '5353'
	option target 'DNAT'

config zone
	option name 'guest'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option family 'ipv4'
	list network 'guest'

config forwarding
	option src 'guest'
	option dest 'wan'

config rule
	option family 'ipv4'
	option src 'guest'
	option dest_port '53'
	option target 'ACCEPT'
	option name 'Allow-DNS-Guest'

config rule
	option name 'Allow-DHCP-Guest'
	option family 'ipv4'
	list proto 'udp'
	option src 'guest'
	option target 'ACCEPT'
	option dest_port '67'

config rule 'wg'
	option name 'Allow-WireGuard-lan'
	option src 'wan'
	option dest_port '51820'
	option proto 'udp'
	option target 'ACCEPT'
	option family 'ipv4'

config include 'miniupnpd'
	option type 'script'
	option path '/usr/share/miniupnpd/firewall.include'
	option family 'any'
	option reload '1'

config rule 'pptp'
	option name 'Allow-PPTP'
	option src 'wan'
	option dest_port '1723'
	option proto 'tcp'
	option target 'ACCEPT'
1 Like
2 
uci set network.guest.netmask="255.255.255.0"
uci commit network
/etc/init.d/network restart
1 Like
3

Also remove the netmask from dhcp configuration. It will be autodetected.
uci delete dhcp.guest.netmask; uci commit dhcp; service dnsmasq restart
One more thing I have noticed, the 100.0.0.X addresses you are using for the wireguard are public and routable. Better switch them to 10.0.0.X

3 Likes
4

I have done that and now it works, but since I wanted the guest network to have a different netmask so that guests couldn't access my modem at 192.168.1.1 I switched the guest network to 10.0.0.1 and 255.255.0.0 and the VPN to 192.168.2.1/24, and now everything works well.
Thanks for the help!

1 Like
6

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.