[HELP] Wifi not working and devices gone!

Installing and Using OpenWrt
1

Good morning everyone.

I am writing this because I need help from you owrt experts (I started using the system a few months ago and I am really a novice).

Yesterday, during the installation of the new fiber, I changed the settings of my Flint2 router, deleting the old WAN of the previous ISP and configuring the new one with the correct parameters. I also deactivated the SQM that I was using on the 30/3 connection and activated the hardware flow for the new 2.5/1Gbps connection.

Following these changes, it appears that:

  1. all wifi connectivity has suddenly disappeared, you can no longer access any wifi network in any way, even if they are visible from the various devices
  2. all devices connected to the router (and to the cascade switch) are unreachable (MAIN network), even if they are on the same network as my PC. Even the devices mapped with a fixed IP address do not work.
  3. The only connection that still works is that of my PC.

I attach the configuration printout, hoping you can enlighten me on what could have happened. It had already happened to me in the past, but I took advantage of the situation to install everything from scratch given the release of RC2 with the updated kernel for my device and until yesterday everything worked fine.

P.S.: I don't know how significant it could be, but I set DoH and Recursive DNS to 1.1.1.2 and 9.9.9.9

Thanks to anyone who can help me.

login as: root
root@172.18.3.254's password:


BusyBox v1.36.1 (2024-12-17 21:00:37 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 24.10.0-rc2, r28161-ea17e958b9
 -----------------------------------------------------
root@GLiNet-GL-MT6000:~#
root@GLiNet-GL-MT6000:~#
root@GLiNet-GL-MT6000:~# ubus call system board
{
        "kernel": "6.6.63",
        "hostname": "GLiNet-GL-MT6000",
        "system": "ARMv8 Processor rev 4",
        "model": "GL.iNet GL-MT6000",
        "board_name": "glinet,gl-mt6000",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "24.10.0-rc2",
                "revision": "r28161-ea17e958b9",
                "target": "mediatek/filogic",
                "description": "OpenWrt 24.10.0-rc2 r28161-ea17e958b9",
                "builddate": "1733226068"
        }
}
root@GLiNet-GL-MT6000:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 
        option packet_steering '2'
        option steering_flows '128'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        option stp '1'
        option igmp_snooping '1'
        option ipv6 '0'

config interface 'MGMT'
        option proto 'static'
        option device 'lan5'
        option ipaddr '172.18.3.254'
        option netmask '255.255.255.248'

config bridge-vlan
        option device 'br-lan'
        option vlan '199'
        list ports 'lan1:u*'
        list ports 'lan2:u*'
        list ports 'lan3:u*'
        list ports 'lan4:u*'

config bridge-vlan
        option device 'br-lan'
        option vlan '29'
        list ports 'lan1:t'
        list ports 'lan2:t'
        list ports 'lan3:t'
        list ports 'lan4:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '47'
        list ports 'lan1:t'
        list ports 'lan2:t'
        list ports 'lan3:t'
        list ports 'lan4:t'

config interface 'MAIN'
        option proto 'static'
        option device 'br-lan.199'
        list ipaddr '172.29.199.254/24'

config device
        option name 'lan5'
        option ipv6 '0'

config interface 'Guest'
        option proto 'static'
        option device 'br-lan.29'
        option ipaddr '172.29.29.254'
        option netmask '255.255.255.224'

config interface 'IoT'
        option proto 'static'
        option device 'br-lan.47'
        option ipaddr '172.29.47.254'
        option netmask '255.255.255.224'

config device
        option name 'br-lan.29'
        option type '8021q'
        option ifname 'br-lan'
        option vid '29'
        option ipv6 '0'

config device
        option name 'br-lan.47'
        option type '8021q'
        option ifname 'br-lan'
        option vid '47'
        option ipv6 '0'

config device
        option name 'br-lan.199'
        option type '8021q'
        option ifname 'br-lan'
        option vid '199'
        option ipv6 '0'

config device
        option type '8021q'
        option ifname 'eth1'
        option vid '835'
        option name 'eth1.835'

config interface 'TIM_WAN'
        option proto 'pppoe'
        option device 'eth1.835'
        option username 
        option password 
        option ipv6 '0'
        option keepalive '0 1'
        option peerdns '0'
        list dns '1.1.1.2'
        list dns '9.9.9.9'
        option force_link '1'

root@GLiNet-GL-MT6000:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option band '2g'
        option channel 'auto'
        option htmode 'HE40'
        option country 'IT'
        option cell_density '0'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi+1'
        option band '5g'
        option channel 'auto'
        option htmode 'HE160'
        option country 'IT'
        option cell_density '0'

config wifi-iface 'wifinet2'
        option device 'radio0'
        option mode 'ap'
        option ssid 'BCC-Guest'
        option encryption 'psk2'
        option isolate '1'
        option macaddr 'random'
        option key 
        option wnm_sleep_mode_no_keys '1'
        option bss_transition '1'
        option network 'Guest'

config wifi-iface 'wifinet3'
        option device 'radio0'
        option mode 'ap'
        option ssid 'BCC-IoT'
        option encryption 'sae-mixed'
        option macaddr 'random'
        option key 
        option wnm_sleep_mode_no_keys '1'
        option bss_transition '1'
        option ocv '0'
        option wpa_disable_eapol_key_retries '1'
        option network 'IoT'

config wifi-iface 'wifinet4'
        option device 'radio1'
        option mode 'ap'
        option ssid 'BCC-IoT'
        option encryption 'sae-mixed'
        option macaddr 'random'
        option key 
        option wnm_sleep_mode_no_keys '1'
        option bss_transition '1'
        option ocv '0'
        option wpa_disable_eapol_key_retries '1'
        option network 'IoT'

config wifi-iface 'wifinet5'
        option device 'radio0'
        option mode 'ap'
        option ssid 'BCC-Main'
        option encryption 'psk2'
        option macaddr 'random'
        option key 
        option wnm_sleep_mode_no_keys '1'
        option bss_transition '1'
        option wpa_disable_eapol_key_retries '1'
        option network 'MAIN'

config wifi-iface 'wifinet6'
        option device 'radio1'
        option mode 'ap'
        option ssid 'BCC-Main'
        option encryption 'psk2'
        option key 
        option wnm_sleep_mode_no_keys '1'
        option bss_transition '1'
        option wpa_disable_eapol_key_retries '1'
        option network 'MAIN'

root@GLiNet-GL-MT6000:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option localservice '1'
        option ednspacket_max '1232'
        list server '/mask.icloud.com/'
        list server '/mask-h2.icloud.com/'
        list server '/use-application-dns.net/'
        list server '127.0.0.1#5053'
        list server '127.0.0.1#5054'
        option doh_backup_noresolv '-1'
        option noresolv '1'
        list doh_backup_server '/mask.icloud.com/'
        list doh_backup_server '/mask-h2.icloud.com/'
        list doh_backup_server '/use-application-dns.net/'
        list doh_backup_server '127.0.0.1#5053'
        list doh_backup_server '127.0.0.1#5054'
        list doh_server '127.0.0.1#5053'
        list doh_server '127.0.0.1#5054'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'MGMT'
        option interface 'MGMT'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option ignore '1'
        option dynamicdhcp '0'

config dhcp 'MAIN'
        option interface 'MAIN'
        option start '1'
        option limit '199'
        option leasetime '12h'
        option force '1'

config dhcp 'Guest'
        option interface 'Guest'
        option start '100'
        option limit '150'
        option leasetime '12h'

config dhcp 'IoT'
        option interface 'IoT'
        option start '100'
        option limit '150'
        option leasetime '12h'

config host
        option name 'Marco-PC01-2.5Gbps'
        list mac 
        option ip '172.29.199.2'

config host
        option name 'Brother-MFC-L3770CDW'
        list mac 
        option ip '172.29.199.230'

config dhcp 'TIM_WAN'
        option interface 'TIM_WAN'
        option ignore '1'

config host
        option name 'QNAP-TS253D-01-Eth01.lan'
        list mac 
        option ip '172.29.199.210'

config host
        option name 'QNAP-TS253D-01-Eth02.lan'
        list mac 
        option ip '172.29.199.211'

root@GLiNet-GL-MT6000:~# cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'
        option flow_offloading '1'
        option flow_offloading_hw '1'

config zone
        option name 'MGMT'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'MGMT'

config zone
        option name 'lan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'MAIN'

config zone
        option name 'IoT'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'IoT'

config zone
        option name 'Guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'Guest'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config forwarding
        option src 'MGMT'
        option dest 'wan'

config rule
        option name 'MAIN LAN DHCP and DNS'
        option src 'lan'
        option dest_port '53 67 68'
        option target 'ACCEPT'

config rule
        option name 'IoT LAN DHCP and DNS'
        option src 'IoT'
        option dest_port '53 67 68'
        option target 'ACCEPT'

config rule
        option name 'Guest LAN DHCP and DNS'
        option src 'Guest'
        option dest_port '53 67 68'
        option target 'ACCEPT'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'TIM_WAN'

config forwarding
        option src 'Guest'
        option dest 'wan'

config forwarding
        option src 'IoT'
        option dest 'wan'

config forwarding
        option src 'lan'
        option dest 'IoT'

config forwarding
        option src 'MGMT'
        option dest 'Guest'

config forwarding
        option src 'MGMT'
        option dest 'IoT'

config forwarding
        option src 'MGMT'
        option dest 'lan'

config include 'pbr'
        option fw4_compatible '1'
        option type 'script'
        option path '/usr/share/pbr/firewall.include'

config rule
        option name 'PC Marco To Router'
        option src 'lan'
        list src_ip '172.29.199.2'
        option target 'ACCEPT'
        option family 'ipv4'
        list proto 'all'
2

are you hidding the keys/wifi passwords or is it the config?
psk2 encryption needs a valid key/password more than or equal to 8 characters long

config zone
        option name 'lan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'MAIN'

replace the 'REJECT' with 'ACCEPT'
save and restart

3

First of all, ty for your answer.

  1. Of course I deleted the passwords as well as the mac addresses before sending the request
  2. But by doing this, wouldn't I enable access to the router to the entire "LAN zone (MAIN)"? I would like access to the router's input to be limited to the "MGMT zone" and only to the "172.29.199.2 address of the MAIN"
4

for this the rule for MGMT zone is ok. but to be able to communicate between the devices in same lan (MAIN) change the REJECT of forward to ACCEPT.
this should look like this

config zone
        option name 'lan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'MAIN'
5

No. The forward zone rule affects intra-zone routing allowances. Specifically, if there are two or more networks in a single zone, the forward rule will determine the default behavior with respect to routing between those two (or more) networks.

To be clear, the forward rule does not affect traffic flowing on a single L2 network. This, in fact, never reaches the firewall because it is switched, not routed. The firewall only comes into the equation when the traffic is routed between two or more L3 interfaces.

In the OP's situation, there will be no difference between forward being set to ACCEPT vs REJECT (or DROP) because there is only a single network in that zone.

1 Like