Guest Wi-Fi on a dumb wireless AP using LuCI: DHCP does not work

ravie08 · October 21, 2024, 8:54am

Hello forum,

I am quite new to OpenWrt and tried to follow Guest Wi-Fi on a dumb wireless AP using LuCI as described. Unfortunately I currently cannot connect to it from client devices. OpenWrt version is 23.05.5 + luCI.

This seems to be caused by a DHCP issue: One device is stuck at "Obtaining IP address...", another one gets 169.254.x.x assigned.

Rough network diagram

Config files

/etc/config/dhcp

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'hybrid'
        option ra 'hybrid'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'
        option ignore '1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'guest'
        option interface 'guest'
        option start '100'
        option limit '150'
        option leasetime '12h'

Note: Main router acts as DHCP server, hence lan is DHCP client, with DHCP server disabled via option ignore '1'. IP address, gateway, and DNS are properly retrieved from main router.

/etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip '...'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'guest'

config forwarding
        option src 'guest'
        option dest 'lan'

config rule
        option name 'Guest_DHCP'
        list proto 'udp'
        option src 'guest'
        option dest_port '67-68'
        option target 'ACCEPT'

config rule
        option name 'Guest_DNS'
        option src 'guest'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'Guest_block_from_LAN'
        list proto 'all'
        option src 'guest'
        option dest 'lan'
        list dest_ip '192.168.1.0/24'
        option target 'REJECT'

Note: Most interesting rules are probably at the bottom. Rest is from default configuration, wan interface is yet to be removed.

/etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix '...'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        list ports 'lan5'
        option ipv6 '0'

config device
        option name 'lan1'
        option macaddr '...'

config device
        option name 'lan2'
        option macaddr '...'

config device
        option name 'lan3'
        option macaddr '...'

config device
        option name 'lan4'
        option macaddr '...'

config device
        option name 'lan5'
        option macaddr '...'

config interface 'lan'
        option device 'br-lan'
        option proto 'dhcp'

config device
        option name 'eth1'
        option macaddr '...'

config interface 'wan'
        option device 'eth1'
        option proto 'dhcp'

config interface 'wan6'
        option device 'eth1'
        option proto 'dhcpv6'

config device
        option type 'bridge'
        option name 'br-guest'
        option bridge_empty '1'

config interface 'guest'
        option proto 'static'
        option device 'br-guest'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'

/etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path '...'
        option channel '1'
        option band '2g'
        option htmode 'HE20'
        option cell_density '0'
        option country '...'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'ssid1'
        option encryption 'sae-mixed'
        option key 'ssid1-pw'

config wifi-device 'radio1'
        option type 'mac80211'
        option path '...'
        option channel 'auto'
        option band '5g'
        option htmode 'HE80'
        option cell_density '0'
        option country '...'

config wifi-iface 'wifinet1'
        option device 'radio1'
        option mode 'ap'
        option ssid 'ssid1'
        option encryption 'sae-mixed'
        option key 'ssid1-pw'
        option network 'lan'

config wifi-iface 'wifinet2'
        option device 'radio0'
        option mode 'ap'
        option ssid 'ssid2'
        option encryption 'sae-mixed'
        option key 'ssid2-pw'
        option network 'guest'

Note: for ssid1 (main WiFi) I currently have 2.4 (radio0) and 5 ghz (radio1) enabled, ssid2 (guest WiFi) for ease of use just has radio0. Channels are the same, just SSID + password differ. ssid1 works.

So why I am not able to connect to guest WiFi?
Any feedback is greatly appreciated!

brada4 · October 21, 2024, 9:20am

Guest is missing:

Clear evidence of llm mangling:

Please compare original to posted and restore relevant parts like country code, device paths and add output of
ubus call system board

ravie08 · October 21, 2024, 1:18pm

Thanks @brada4 , I will update configuration later on when having access to the device.

Is the IPv4 DHCP server only enabled, when setting option dhcpv4 'server' for guest interface under /etc/config/dhcp? I am asking, because all steps were done exactly as described in the docs:

Press “Add new interface”
...
Now Select “DHCP Server” Tab
Enable DHCP Server for GUEST Network by pressing the Button “Set Up DHCP Server”

, which seemed enough to enable DHCP server via LuCI. But as you see, it did not create option dhcpv4 'server' in the config file.

So I'll try to add this setting directly via CLI, if I understood you correctly:

config dhcp 'guest'
        option interface 'guest'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'

llm = Link layer management? Not sure, what you mean here.

option src_ip (under wan) shouldn't be relevant, as this is a "dumb" access point. I probably should delete everything related to wan for a leaner config.

brada4 · October 21, 2024, 1:43pm

If all config files were AI filtered there is no point fixing them. WAN or firewall have no impact on bridge to wifi forwarding.

ravie08 · October 21, 2024, 3:54pm

They weren't. Honestly this allegation is a bit unpolite.

Is this an answer to my previous question? Then I did not understand it.

mk24 · October 21, 2024, 4:06pm

Legacy syntax did not include option dhcpv4. For compatibility, if start and limit are specified and ignore is not, a DHCPv4 server will be set up.

You could temporarily move the guest network to the lan firewall zone to make sure the firewall is not blocking anything. This is only for testing of course as it has no protection against malicious guests.

ravie08 · October 21, 2024, 7:05pm

This is helpful, appreciated @mk24 ! I verified by adding dhcpv4 manually with uci, with no effect as expected.

Tried this, and also temporarily disabled the rule "Guest_block_from_LAN", which had no success either. So issue seems not caused by firewall settings.

Setting Guest Wi-Fi actually is a bit more involved, than I thought. I am gonna repeat the whole guide starting with setting up wireless access point.

mk24 · October 21, 2024, 7:52pm

Step 3: Disable dnsmasq

Do not actually do this step, it will prevent any DHCP from working. Instead you should shut down DHCP on the lan interface only by changing its configuration to be only option ignore 1.

ravie08 · October 21, 2024, 8:11pm

Yeah, dnsmasq still runs on my router:

root@ap:/# service dnsmasq status
active with no instances

Actually I did all the configuration via LuCI and just stuck to linked documentation as starting point. option ignore 1 is set for lan DHCP, not for guest, as seen in OP under /etc/config/dhcp.

Edit: Oh, I actually had deleted the default entry under Network -> DHCP and DNS , before I decided to switch from dumb access point to an additional guest WiFi. I guess this configuration is needed to fill in the role for Network -> Interfaces -> guest -> Edit -> DHCP Server? There is some more documentation to read then.

psherman · October 21, 2024, 8:26pm

Is the firewall active? It must be, or the device will not be able to route with masquerading against the lan/upstream.

ravie08 · October 21, 2024, 8:31pm

Yes, firewall under LuCI shows me configured zones etc. And from CLI:

root@ap:/# /etc/init.d/firewall status
active with no instances

This is a quite vanilla OpenWrt setup as access point, with some drafting for Guest WiFi.

Edit: System -> Startup shows firewall as "Enabled", too.

mk24 · October 21, 2024, 8:37pm

This is a problem. The result should be "running." dnsmasq is a daemon which should continue to run in memory. No instances suggests there is a null configuration or a crash due to improper configuration.

On the other hand the firewall "service" only populates the kernel netfilter tables then exits. So "no instances" is the expected result.

ravie08 · October 21, 2024, 8:39pm

Ah thanks, this might be an indication of missing configuration under Network -> DHCP and DNS, right? I'll try to re-create the default configuration from LuCI.

Update: Yes, it works! I just add an entry under Network -> DHCP and DNS, leaving all default values and kept "Authorative" disabled.

Now CLI output is:

root@ap:/# service dnsmasq status
running

And I can finally connect to guest with the appropriate IP range from DHCP server. I will test out hardening and fine tuning tomorrow.

Thanks very much for now .