I have an apple airport time capsule / extreme as my primary router.
Regards.
trendy
February 26, 2021, 10:05am
2
Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:
ubus call system board; \
uci export network; uci export wireless; \
uci export dhcp; uci export firewall; \
head -n -0 /etc/firewall.user; \
ip -4 addr ; ip -4 ro li tab all ; ip -4 ru; \
ls -l /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*
1 Like
Thanks here is the output , (Edited as had the network disabled)
root@OpenWrt:~# ubus call system board; \
> uci export network; uci export wireless; \
> uci export dhcp; uci export firewall; \
> head -n -0 /etc/firewall.user; \
> ip -4 addr ; ip -4 ro li tab all ; ip -4 ru; \
> ls -l /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*
{
"kernel": "4.14.221",
"hostname": "OpenWrt",
"system": "Qualcomm Atheros QCA9558 ver 1 rev 0",
"model": "Meraki MR18",
"board_name": "mr18",
"release": {
"distribution": "OpenWrt",
"version": "19.07.7",
"revision": "r11306-c4a6851c72",
"target": "ar71xx/nand",
"description": "OpenWrt 19.07.7 r11306-c4a6851c72"
}
}
package network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd3a:428b:da17::/48'
config interface 'lan'
option type 'bridge'
option ifname 'eth0'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option gateway '192.168.0.1'
option ipaddr '192.168.0.2'
option delegate '0'
option force_link '0'
list dns '192.168.0.3'
list dns '192.168.0.20'
config interface 'Guest'
option type 'bridge'
option ifname 'eth0.1003'
option proto 'static'
option gateway '172.16.42.1'
option ipaddr '172.16.42.2'
list dns '172.16.52.1'
package wireless
config wifi-device 'radio0'
option type 'mac80211'
option hwmode '11g'
option path 'platform/qca955x_wmac'
option htmode 'HT20'
option channel '6'
option country 'GB'
option legacy_rates '0'
option txpower '14'
config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option key 'REMOVED'
option ssid 'Mark'\''s Wi-Fi Network'
option encryption 'psk2+ccmp'
config wifi-device 'radio1'
option type 'mac80211'
option hwmode '11a'
option path 'pci0000:00/0000:00:00.0'
option country 'GB'
option htmode 'HT40'
option legacy_rates '0'
option channel '116'
option txpower '18'
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option key 'REMOVED'
option ssid 'Mark'\''s Wi-Fi Network'
option encryption 'psk2+ccmp'
config wifi-device 'radio2'
option type 'mac80211'
option hwmode '11a'
option path 'pci0000:01/0000:01:00.0'
option htmode 'HT20'
option country 'GB'
option channel 'auto'
config wifi-iface 'default_radio2'
option device 'radio2'
option mode 'ap'
option ssid 'OpenWrt'
option encryption 'none'
option hidden '1'
config wifi-iface 'wifinet3'
option ssid 'Mark’s Guest Network'
option device 'radio0'
option mode 'ap'
option network 'Guest'
option key 'REMOVED'
option encryption 'psk2+ccmp'
package dhcp
config dnsmasq
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.auto'
option localservice '1'
list rebind_domain 'free.aero2.net.pl'
config dhcp 'lan'
option interface 'lan'
option ignore '1'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
config dhcp 'Guest'
option interface 'Guest'
option ignore '1'
package firewall
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config zone
option network 'Guest'
option forward 'REJECT'
option name 'Guest'
option output 'ACCEPT'
option input 'REJECT'
config forwarding
option dest 'lan'
option src 'Guest'
config rule
option dest_port '67-68'
option src 'Guest'
option name 'Guest dhcp'
option dest 'lan'
option target 'ACCEPT'
list proto 'udp'
config rule
option dest_port '53'
option src 'Guest'
option name 'Guest dns'
option dest 'lan'
option target 'ACCEPT'
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.
# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
8: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
inet 192.168.0.2/24 brd 192.168.0.255 scope global br-lan
valid_lft forever preferred_lft forever
16: br-Guest: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
inet 172.16.42.2/32 brd 255.255.255.255 scope global br-Guest
valid_lft forever preferred_lft forever
192.168.0.0/24 dev br-lan scope link src 192.168.0.2
broadcast 127.0.0.0 dev lo table local scope link src 127.0.0.1
local 127.0.0.0/8 dev lo table local scope host src 127.0.0.1
local 127.0.0.1 dev lo table local scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local scope link src 127.0.0.1
local 172.16.42.2 dev br-Guest table local scope host src 172.16.42.2
broadcast 192.168.0.0 dev br-lan table local scope link src 192.168.0.2
local 192.168.0.2 dev br-lan table local scope host src 192.168.0.2
broadcast 192.168.0.255 dev br-lan table local scope link src 192.168.0.2
0: from all lookup local
32766: from all lookup main
32767: from all lookup default
ls: /tmp/resolv.*/*: No such file or directory
lrwxrwxrwx 1 root root 16 Feb 15 15:22 /etc/resolv.conf -> /tmp/resolv.conf
lrwxrwxrwx 1 root root 21 Feb 26 07:37 /tmp/resolv.conf -> /tmp/resolv.conf.auto
-rw-r--r-- 1 root root 104 Feb 26 11:02 /tmp/resolv.conf.auto
==> /etc/resolv.conf <==
# Interface Guest
nameserver 172.16.52.1
# Interface lan
nameserver 192.168.0.3
nameserver 192.168.0.20
==> /tmp/resolv.conf <==
# Interface Guest
nameserver 172.16.52.1
# Interface lan
nameserver 192.168.0.3
nameserver 192.168.0.20
==> /tmp/resolv.conf.auto <==
# Interface Guest
nameserver 172.16.52.1
# Interface lan
nameserver 192.168.0.3
nameserver 192.168.0.20
head: /tmp/resolv.*/*: No such file or directory
trendy
February 26, 2021, 11:28am
4
Guest interface doesn't have subnet mask. But you don't need to have IP there, you can switch it to unmanaged.
2 Likes
Thank you Trendy , let me change that .
I did have firewall previously disabled completely , I enabled it and added those rules based on the Guest Wifi Dumb AP wiki, but now understand it is not applicable to this application .
Ok I have tried changing this to unmanaged .
I still don't have internet connectivity , I believe this may be a DNS issue, as if I manually change the DNS on the device (e.g. 8.8.8.8) I then can browse the internet.
My DNS is a local pihole in my 192.168.0.x range . I can see how the guest network may not allow access to that device.
Not sure there is a way to overcome this.
Edit , is there a way for the Openwrt to give clients an alternative upstream DNS server , even if it isn't the pihole ?
frollic
February 26, 2021, 1:30pm
7
not unless there's a DHCP running on it, or a redirect is made
1 Like
trendy
February 26, 2021, 1:46pm
8
The settings that the guest host acquires from the Airport dhcp server look correct.
1 Like
