Guest Wifi ping issue/firewall

fosix · August 12, 2024, 12:30am

I've implemented guest wifi on my AP as of https://openwrt.org/docs/guide-user/network/wifi/guestwifi/guestwifi_dumbap

Here are the results:

Can ping from guest to lan (I guess this is expected as in the documentation there wasn't any icmp block from guest to lan)
Ping from lan to guest is not working (don't know if this should be expected or not)
At the moment my fw looks like this:

Capture980×192 11.5 KB

I had to change the forwarding to reject because after the last step aka deleting the wan interfaces etc as described in the documentation mine was on accept, but because in the documentation was on reject I changed it so it would reflect the firewall settings exactly as described in the documentation.
Can anyone please explain why this needs to be set to reject?

Also in the documentation they used the destination address 192.168.1.0/24 altho they specified LAN as destination.
Why specifying the subnet was necesarry if the destination zone is LAN, seems unneccesarry or is it?

guestwifi-dumbap-23.05_config_06_fw_block-all934×583 37.1 KB

psherman · August 12, 2024, 12:37am

This should not be possible; no special rule to block pings is required.

Per the guide, this should not be possible, so this is working as intended.

This should not be necessary and should have no effect if you've configured things properly.

It doesn't. Probably just an artifact of an unrelated thing that the person taking the screnshots must have been doing.

It is necessary to ensure that only the upstream lan network is blocked from the guest network. If the network (address/subnet) wasn't specified, the rule would stop all traffic from the guest network to the internet.

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

fosix · August 12, 2024, 12:51am

"kernel": "5.15.162",
        "hostname": "AP",
        "system": "MediaTek MT7621 ver:1 eco:3",
        "model": "ASUS RT-AX53U",
        "board_name": "asus,rt-ax53u",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.4",
                "revision": "r24012-d8dd03c46f",
                "target": "ramips/mt7621",
                "description": "OpenWrt 23.05.4 r24012-d8dd03c46f"

cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd56:5c5f:6562::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        option ipv6 '0'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.2'
        option netmask '255.255.255.0'
        option delegate '0'
        option gateway '192.168.1.1'
        list dns '192.168.1.1'

config device
        option type 'bridge'
        option name 'br-guest'
        option bridge_empty '1'
        option ipv6 '0'

config interface 'guest'
        option proto 'static'
        option device 'br-guest'
        option ipaddr '192.168.10.1'
        option netmask '255.255.255.0'
        option delegate '0'

 cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
        option channel '11'
        option band '2g'
        option htmode 'HT40'
        option cell_density '0'
        option country 'PA'
        option txpower '20'
        option noscan '1'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'redacted'
        option encryption 'psk2+ccmp'
        option key 'redacted'

config wifi-device 'radio1'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0+1'
        option channel 'auto'
        option band '5g'
        option htmode 'VHT80'
        option cell_density '0'
        option txpower '23'
        option country 'PA'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'guest'
        option mode 'ap'
        option ssid 'redcated'
        option encryption 'psk2+ccmp'
        option key 'redacted'
        option isolate '1'

config wifi-iface 'wifinet3'
        option device 'radio0'
        option mode 'ap'
        option ssid 'redcated'
        option encryption 'psk2'
        option key 'redacted'
        option network 'guest'
        option disabled '1'

cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'guest'
        option interface 'guest'
        option start '100'
        option limit '150'
        option leasetime '12h'

cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'
        option flow_offloading '1'
        option flow_offloading_hw '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        list network 'lan'

config zone
        option name 'guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'guest'

config forwarding
        option src 'guest'
        option dest 'lan'

config rule
        option name 'Guest_DHCP'
        list proto 'udp'
        option src 'guest'
        option dest_port '67-68'
        option target 'ACCEPT'

config rule
        option name 'Guest_DNS'
        option src 'guest'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'Block_Guest_from_Lan'
        option src 'guest'
        option dest 'lan'
        list dest_ip '192.168.1.0/24'
        option target 'REJECT'

config rule
        option name 'Ping'
        list proto 'icmp'
        option src 'guest'
        option dest 'lan'
        option target 'REJECT'

psherman · August 12, 2024, 12:57am

Everything looks generally fine.

This should not be required, though.

Can you give specific examples of the tests you were running and the results you saw?

fosix · August 12, 2024, 1:04am

I just connected some devices to guest, lan wifi and performed some pings to see if everything is ok. Could ping devices in the LAN area from guest client for example my main router but could not connect to it which is expected.
Regarding that Ping rule if I remove it somehow guests can ping lan zone devices.

Also, should I change reject here to accept?

psherman · August 12, 2024, 1:06am

This won't matter. I would typically leave it on ACCEPT but it only applies to intra-zone forwarding when you have 2 or more networks in the same zone (you don't have this configuration).

What are the source and destination devices + addresses that you're testing?

fosix · August 12, 2024, 1:14am

Basically when I connect a device to the guest wifi (I also check the ip on the device itself an also on the AP) I can for example ping anything connected on my lan subnet, my main router included, but not my AP (192.168.1.2)

psherman · August 12, 2024, 1:16am

What are the specific IP addresses you are pinging from and to?

fosix · August 12, 2024, 1:18am

Phone gets 192.168.10.144 and can ping 192.168.1.1 (main router) and other lan devices, but cannot ping 192.168.1.2 (AP)

psherman · August 12, 2024, 1:24am

That shouldn't be the case. What other lan devices can it reach (IP addresses)?

Have you restarted the OpenWrt router?

fosix · August 12, 2024, 1:34am

What would you suggest I try?

psherman · August 12, 2024, 1:38am

Can you show me the results of pings from your phone to other devices in the lan?

I'd suggest that you restart your router and then test to see if the problem still manifests.

fosix · August 12, 2024, 1:58am

Can ping from 192.168.10.144 to 192.168.1.220 (both phones)
Restarted router and also AP.

psherman · August 12, 2024, 2:04am

Are there any other APs in your network?

fosix · August 12, 2024, 2:07am

No, on the AP one of the lan ports is connected to my pc, that's it.

psherman · August 12, 2024, 2:14am

Can you try changing the name here - remove all the underscores and then reboot.

option name 'BlockGuestFromLan'

fosix · August 12, 2024, 2:23am

No luck, I also removed for DNS & DHCP.
Btw what should block ping from guest to lan if no icmp is defined in the firewall?
With reject from guest to lan 192.168.1.0/24 on tcp/udp you would expect all other traffic to pass from guest to lan 0.0.0.0/0 (besides 192.168.1.0/24 offcourse) and also icmp.

psherman · August 12, 2024, 2:35am

What about a shorter name for the rule? Maybe just blocklan

fosix · August 12, 2024, 2:44am

Still the same

psherman · August 12, 2024, 2:57am

Thanks for asking that... it made me re-evaluate the rule:

This is missing one critical line.

        list proto 'all'

Without it, only TCP + UDP is blocked. Therefore, the rule should be this:

config rule
        option name 'Block_Guest_from_Lan'
        list proto 'all'
        option src 'guest'
        option dest 'lan'
        list dest_ip '192.168.1.0/24'
        option target 'REJECT'