Guest WiFi Has No Internet Connection

Installing and Using OpenWrt Network and Wireless Configuration
1

i am trying to set up a guest WiFi network on the 192.168.8.1 range.
i can connect to the guest WiFi network but it has no connection to the internet. i followed this video to set it up,

i think i have everything correct but i still have no internet access. im pulling my hair out trying to get this to work.
i think Ive copied my settings correctly below.
can anyone help please?

root@OpenWrt:~# cat /etc/config/network
ireless
cat /etc/config/dhcp
cat /etc/config/firewall
config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option 

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        list ports 'lan5'

config device
        option name 'lan1'
        option

config device
        option name 'lan2'
        option 

config device
        option name 'lan3'
        option 

config device
        option name 'lan4'
        option 

config device
        option name 'lan5'
        option 

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device
        option name 'eth1'
        option 

config interface 'wan'
        option device 'eth1'
        option proto 'pppoe'
        option username 
        option password
        option ipv6 'auto'

config interface 'wan6'
        option device 'eth1'
        option proto 'dhcpv6'

config interface 'IoT'
        option proto 'static'
        option device 'IoT'
        option ipaddr '172.16.17.18'
        option netmask '255.255.255.0'


config interface 'GuestWiFi'
        option proto 'static'
        option ipaddr '192.168.8.1'
        option netmask '255.255.255.0'
        option device 'br-guestwifi'
        list dns '1.1.1.1'
        list dns '8.8.8.8'

config device
        option type 'bridge'
        option name 'br-guestwifi'
        option bridge_empty '1'

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option channel '1'
        option band '2g'
        option htmode 'HE20'
        option cell_density '0'
        option country

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'Farfield WiFi 2'
        option encryption 'psk2'
        option key

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi+1'
        option channel '36'
        option band '5g'
        option htmode 'HE80'
        option cell_density '0'
        option country 

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'Farfield Wifi 5'
        option encryption 'psk2'
        option key

config wifi-iface 'wifinet2'
        option device 'radio0'
        option mode 'ap'
        option ssid 'IoT'
        option encryption 'none'
        option network 'IoT'

config wifi-iface 'wifinet4'
        option device 'radio0'
        option mode 'ap'
        option ssid 'Guest WiFi'
        option encryption 'none'
        option key 
        option isolate '1'
        option network 'GuestWiFi'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'
        option port '5353'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '48h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'




config dhcp 'GuestWiFi'
        option interface 'GuestWiFi'
        option start '100'
        option limit '150'
        option leasetime '12h'




root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'
        option port '5353'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '48h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'



config dhcp 'GuestWiFi'
        option interface 'GuestWiFi'
        option start '100'
        option limit '150'
        option leasetime '12h'



config host
        option name 'C520WS'
        option ip '
        option mac

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option 

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        list ports 'lan5'

config device
        option name 'lan1'
        option 

config device
        option name 'lan2'
        option 

config device
        option name 'lan3'
        option 

config device
        option name 'lan4'
        option 

config device
        option name 'lan5'
        option 

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device
        option name 'eth1'
root@OpenWrt:~# ubus call system board
at /etc/config/w{
        "kernel": "5.15.167",
        "hostname": "OpenWrt",
        "system": "ARMv8 Processor rev 4",
        "model": "GL.iNet GL-MT6000",
        "board_name": "glinet,gl-mt6000",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.5",
                "revision": "r24106-10cc5fcd00",
                "target": "mediatek/filogic",
                "description": "OpenWrt 23.05.5 r24106-10cc5fcd00"
        }
}
root@OpenWrt:~# cat /etc/config/network
ireless
cat /etc/config/dhcp
cat /etc/config/firewall
config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option 

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        list ports 'lan5'

config device
        option name 'lan1'
        option 

config device
        option name 'lan2'
        option 

config device
        option name 'lan3'
        option 

config device
        option name 'lan4'
        option 

config device
        option name 'lan5'
        option 

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device
        option name 'eth1'
        option mac

config interface 'wan'
        option device 'eth1'
        option proto 'pppoe'
        option username 
        option password 
        option ipv6 'auto'

config interface 'wan6'
        option device 'eth1'
        option proto 'dhcpv6'

config device
        option type 'bridge'
        option name 'IoT'
        list ports 'eth0'

config interface 'GuestWiFi'
        option proto 'static'
        option ipaddr '192.168.8.1'
        option netmask '255.255.255.0'
        option device 'br-guestwifi'
        list dns '1.1.1.1'
        list dns '8.8.8.8'

config device
        option type 'bridge'
        option name 'br-guestwifi'
        option bridge_empty '1'

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option channel '1'
        option band '2g'
        option htmode 'HE20'
        option cell_density '0'
        option country 

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'Farfield WiFi 2'
        option encryption 'psk2'
        option key 

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi+1'
        option channel '36'
        option band '5g'
        option htmode 'HE80'
        option cell_density '0'
        option country 'IE'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'Farfield Wifi 5'
        option encryption 'psk2'
        option key

config wifi-iface 'wifinet2'
        option device 'radio0'
        option mode 'ap'
        option ssid 'IoT'
        option encryption 'none'

config wifi-iface 'wifinet4'
        option device 'radio0'
        option mode 'ap'
        option ssid 'Guest WiFi'
        option encryption 'none'
        option key        option isolate '1'
        option network 'GuestWiFi'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'
        option port '5353'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '48h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'


       

config dhcp 'GuestWiFi'
        option interface 'GuestWiFi'
        option start '100'
        option limit '150'
        option leasetime '12h'


        


       

root@OpenWrt:~# cat /etc/config/firewall
2

No encryption, but a key config?

It's missing, so we can't determine what zone you assigned the Guest WiFi to.

3 
ubus call system board
cat /etc/config/network
cat /etc/config/firewall
cat /etc/config/dhcp

You have to show country code, some countries forbid or diminish Channel 36 (but good job having it set at all)

1 Like
4

Very sorry i didnt relise it was missing. i think i have the rest of the command outputs listed below. let me know if its missing anything

root@OpenWrt:~# cat /etc/config/firewall
dhcp
config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'
        option flow_offloading '1'
        option flow_offloading_hw '1'

config zone 'lan'
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone 'wan'
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'IoT'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config forwarding
        option src 'lan'
        option dest 'IoT'

config zone
        option name 'GuestWiFi'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list device 'br-guestwifi'
        option family 'ipv4'
        list network 'GuestWiFi'

config forwarding
        option src 'GuestWiFi'
        option dest 'wan'

config rule
        option name 'Guest DHCP'
        option src 'GuestWiFi'
        option dest_port '67-68'
        option target 'ACCEPT'
        list proto 'tcp'
        list proto 'udp'
        option family 'ipv4'

config rule
        option name 'Guest DNS'
        option src 'GuestWiFi'
        option dest_port '5353'
        option target 'ACCEPT'
        option family 'ipv4'
5

You need guest DNS on port 53, and probably icmp ping.

6

i have set up ad guard home as per this video from Marc,

so my DNS has moved to port 5353
which is set in the firewall rules for the guest network. i don't have icmp ping set for the guest network though?

7

But clients use 53/udp for DNS, not 5353. You still need a DNS server (or redirect) at 53/udp.for client usage.

8

i added a rule to the firewall to allow DNS on port 53 to the guest network but i still have no internet access on the guest WiFi?
Pic of the firewall rules for the guest network attached.

dns rules
dns rules1026×226 24.3 KB

9

DNS uses TCP too, dhcp does not, it is kind of widespread knowledge, check wikipedia.

10

okay Ive updated the DNS settings but still have no internet connection on the Guest WiFi

11 
config zone
        option name 'GuestWiFi'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
-        list device 'br-guestwifi'
        option family 'ipv4'
        list network 'GuestWiFi'
1 Like
12

But you said your server is running at 5353?

Did you set it back to 53?

13

no i made firewall rules for both ports, 53 and 5353 on the guest network

14

what does this mean? the part highlighted in red?

15

You need to have DNS service running on port 53, dnsmasq being default
Check netstat -lnup to see if it is true.

1 Like
16

okay here is what i get back for that command,

root@OpenWrt:~# netstat -lnup
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
udp        0      0 0.0.0.0:67              0.0.0.0:*                           15200/dnsmasq
udp        0      0 127.0.0.1:5353          0.0.0.0:*                           15200/dnsmasq
udp        0      0 192.168.1.1:5353        0.0.0.0:*                           15200/dnsmasq
udp        0      0 :5353      0.0.0.0:*                           15200/dnsmasq
udp        0      0 192.168.8.1:5353        0.0.0.0:*                           15200/dnsmasq
udp        0      0 :::546                  :::*                                9011/odhcp6c
udp        0      0 :::546                  :::*                                8934/odhcp6c
udp        0      0 :::547                  :::*                                1746/odhcpd
udp        0      0 :::53                   :::*                                3409/AdGuardHome
udp        0      0 ::1:5353                :::*                                15200/dnsmasq
udp        0      0 fd51:4990:7314::1:5353  :::*                                15200/dnsmasq
udp        0      0 fe80::9683:c4ff:fea4:25d0:5353 :::*                                15200/dnsmasq
udp        0      0 fe80::9683:c4ff:fea4:25d2:5353 :::*                                15200/dnsmasq
udp        0      0 fe80::9683:c4ff:fea4:25d1:5353 :::*                                15200/dnsmasq
udp        0      0 fe80::9083:c4ff:fea4:25d1:5353 :::*                                15200/dnsmasq
udp        0      0:5353 :::*                                15200/dnsmasq
udp        0      0 fe80::9083:c4ff:fea4:25d1:5353 :::*                                15200/dnsmasq
root@OpenWrt:~#
17

Check adguard logs for requests coming in from guest network. If adguard does everything you do not need dnsmasq open from network.

1 Like
18

yes it looks like ad guard is severing the guest network, 192.168.8.1
ad guard ip lists

if that is the case, how do i close dnsmasq from the network?

19

Problem is your adguard not serving guest subnet.

1 Like
20

I got it to work!
I added a custom DNS address (1.1.1.1) for the guest WiFi under
Interfaces - GuestWifi - Advanced Settings - Use Custom DNS Servers

Screenshot_20241209_193608_Firefox
Screenshot_20241209_193608_Firefox1025×1424 114 KB

I then advertised that new custom DNS server to the GuestWifi under,
Interfaces - GuestWifi - DHCP Server - Advanced Settings - DHCP-Options
And added the DNS Server like this,
6,1.1.1.1

Screenshot_20241209_193628_Firefox
Screenshot_20241209_193628_Firefox1080×1836 172 KB

Save then Save&Apply and restarted the interface.
The guest WiFi now works (although without any ad blocking)
Thanks very much for all the prompt and helpful replies. It's really appreciated :+1:t2: