I'm new to OpenWRT.
I've switched my WLAN to OpenWRT (5 Sophos AP55C). There are 3 WLANs (VLAN 1 = LAN bridged, VLAN 10 = guests, VLAN 20 = IoT). In the IoT WLAN there are devices that I can reach from the LAN via ping and I can't reach other devices.
The settings in the router seem to be correct, otherwise ping would probably NOT work.
What could be the problem?
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall
ubus call system board
{
"kernel": "5.10.176",
"hostname": "OpenWrt",
"system": "Qualcomm Atheros QCA9558 ver 1 rev 0",
"model": "Sophos AP55",
"board_name": "sophos,ap55",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "22.03.5",
"revision": "r20134-5f15225c1e",
"target": "ath79/generic",
"description": "OpenWrt 22.03.5 r20134-5f15225c1e"
}
}
root@OpenWrt:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd05:d7e6:cf5a::/48'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'
option ipv6 '0'
config interface 'lan'
option device 'switch.1'
option proto 'dhcp'
config device
option type 'bridge'
option name 'switch'
list ports 'eth0'
option ipv6 '0'
option mtu '1500'
option macaddr '00:1A:8C:E1:E2:F2'
config bridge-vlan
option device 'switch'
option vlan '1'
list ports 'eth0'
config bridge-vlan
option device 'switch'
option vlan '20'
list ports 'eth0:t'
config bridge-vlan
option device 'switch'
option vlan '10'
list ports 'eth0:t'
config interface 'VLAN10_Gast'
option proto 'static'
option device 'switch.10'
option netmask '255.255.255.0'
option ipaddr '10.1.0.192'
config interface 'VLAN20_IoT'
option proto 'static'
option device 'switch.20'
option netmask '255.255.255.0'
option ipaddr '10.1.2.192'
root@OpenWrt:~# cat /etc/config/wireless
config wifi-device 'radio0'
option type 'mac80211'
option path 'pci0000:00/0000:00:00.0'
option channel 'auto'
option band '5g'
option htmode 'VHT40'
option cell_density '0'
option country 'DE'
config wifi-device 'radio1'
option type 'mac80211'
option path 'platform/ahb/18100000.wmac'
option channel 'auto'
option band '2g'
option htmode 'HT20'
option country 'DE'
option cell_density '0'
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'VLAN10_Gast'
option mode 'ap'
option ssid 'MR-Gast'
option encryption 'psk-mixed'
option dtim_period '3'
option ieee80211r '1'
option mobility_domain '123F'
option ft_over_ds '0'
option ft_psk_generate_local '1'
option nasid '0192'
config wifi-iface 'wifinet2'
option device 'radio0'
option mode 'ap'
option ssid 'MR-Gast'
option encryption 'psk-mixed'
option wpa_disable_eapol_key_retries '1'
option network 'VLAN10_Gast'
option ieee80211r '1'
option mobility_domain '123F'
option ft_over_ds '0'
option ft_psk_generate_local '1'
option dtim_period '3'
option nasid '0192'
config wifi-iface 'wifinet3'
option device 'radio0'
option mode 'ap'
option ssid 'WLAN-MR-LAN'
option encryption 'psk-mixed'
option wpa_disable_eapol_key_retries '1'
option network 'lan'
option dtim_period '3'
option ieee80211r '1'
option mobility_domain '123F'
option ft_over_ds '0'
option ft_psk_generate_local '1'
option nasid '0192'
config wifi-iface 'wifinet4'
option device 'radio1'
option mode 'ap'
option ssid 'WLAN-MR-LAN'
option encryption 'psk-mixed'
option dtim_period '3'
option ieee80211r '1'
option mobility_domain '123F'
option ft_over_ds '0'
option ft_psk_generate_local '1'
option wpa_disable_eapol_key_retries '1'
option nasid '0192'
option network 'lan'
config wifi-iface 'wifinet5'
option device 'radio0'
option mode 'ap'
option ssid 'MR-Alexa'
option encryption 'psk-mixed'
option dtim_period '3'
option ieee80211r '1'
option mobility_domain '123F'
option ft_over_ds '0'
option ft_psk_generate_local '1'
option wpa_disable_eapol_key_retries '1'
option network 'VLAN20_IoT'
option nasid '0192'
config wifi-iface 'wifinet6'
option device 'radio1'
option mode 'ap'
option ssid 'MR-Alexa'
option encryption 'psk-mixed'
option dtim_period '3'
option ieee80211r '1'
option mobility_domain '123F'
option ft_over_ds '0'
option ft_psk_generate_local '1'
option wpa_disable_eapol_key_retries '1'
option network 'VLAN20_IoT'
option nasid '0192'
root@OpenWrt:~# cat /etc/config/dhcp
config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
option filter_aaaa '0'
option filter_a '0'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'hybrid'
option ra 'hybrid'
list ra_flags 'managed-config'
list ra_flags 'other-config'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
root@OpenWrt:~# cat /etc/config/firewall
config defaults
option syn_flood '1'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
There are a lot of issues here — too many to resolve as is. The best action is to reset to defaults and start over.
I would start by upgrading to 23.05.
Then add one network by creating a bridge device with dotted notation on the Ethernet port (this device doesn’t appear to have a switch).
from the config, it seems that this is an ap only, not operating as router. Therefore, only the management network should have an address, the rest should be unmanaged.
And then in your wireless config, you should be using either wpa2 or wpa3. Do not use mixed mode as it tends to cause problems with some client devices. Also 802.11r is best disabled for the same reason, and it is only relevant if you have multiple APs, anyway.
Correct. This is the data of ONE of the 5 APs.
Ok. I still recommend disabling 802.11r and all the other things I said above.
I try it... many thanks
I have question marks about some devices. Where does the AP get the information from? Can I maintain it?
nowhere, that's why it shows a ?.
/etc/ethers or read Show hostname in Associated stations
That didn't make any difference. - The problems probably have other causes. The restructuring of the network was quite extensive. A few things still need to be corrected.