Help with firewall rules to allow traffic between two VLANs

Installing and Using OpenWrt Network and Wireless Configuration
1

I'm trying to have a network with the following configs for my VLANs:

VLAN10 - Able to access devices only in VLAN10. Gets internet from WAN
VLAN20 - Able to access devices only in VLAN20. Gets internet from OpenVPN
VLAN30 - Able to access devices in VLAN10 and VLAN20. Gets internet from WAN

My current configuration is as follows:

cat /etc/config/firewall 

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'vlan10'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'vlan10'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'

config forwarding
        option src 'vlan10'
        option dest 'wan'

config forwarding
        option src 'vlan30'
        option dest 'vlan10'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'vlan10'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'vlan10'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'VLAN10_Local_Access'
        option src 'vlan10'
        option dest 'vlan20'
        option target 'REJECT'

config rule
        option name 'Block_VLAN10_to_VLAN30'
        option src 'vlan10'
        option dest 'vlan30'
        option target 'REJECT'

config rule
        option name 'Block_VLAN_10_to_CG-NAT'
        option src 'vlan10'
        option dest 'wan'
        option dest_ip '192.168.12.0/24'
        option target 'REJECT'

config zone
        option name 'vlan20'
        option input 'ACCEPT'
        option output 'ACCEPT'
        list network 'vlan20'
        option forward 'REJECT'

config forwarding
        option src 'vlan20'
        option dest 'vpnfirewall'

config rule
        option name 'Block-192.168.20.15'
        option src 'vlan20'
        option src_ip '192.168.20.15'
        option target 'REJECT'

config forwarding
        option src 'vlan30'
        option dest 'vlan20'

config zone
        option name 'vlan30'
        option input 'ACCEPT'
        option output 'ACCEPT'
        list network 'vlan30'
        option forward 'ACCEPT'

config forwarding
        option src 'vlan30'
        option dest 'wan'

config forwarding
        option src 'vlan30'
        option dest 'vlan10'

config forwarding
        option src 'vlan30'
        option dest 'vlan20'

config zone
        option name 'vpnfirewall'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'openvpn'

config forwarding
        option src 'vlan20'
        option dest 'vpnfirewall'

root@OpenWrt:~# cat /etc/config/network 

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd54:d324:dfaa::/48'

config interface 'vlan10'
        option proto 'static'
        option ipaddr '192.168.10.1'
        option netmask '255.255.255.0'
        option device 'eth0.10'

config interface 'wan'
        option proto 'dhcp'
        option device 'eth1'

config interface 'vlan20'
        option proto 'static'
        option ipaddr '192.168.20.1'
        option netmask '255.255.255.0'
        option device 'eth0.20'

config interface 'vlan30'
        option proto 'static'
        option ipaddr '192.168.30.1'
        option netmask '255.255.255.0'
        option device 'eth0.30'

config device
        option name 'br-lan'
        option type 'bridge'

config interface 'openvpn'
        option proto 'none'
        option device 'tun0'

config rule                   
        option in 'vlan10'                        
        option lookup '100'     
                                
config rule                     
        option in 'vlan30'         
        option lookup '100'     
                                
config route                    
        option interface 'wan'  
        option target '0.0.0.0'
        option netmask '0.0.0.0'
        option metric '200'  
        option table '100'
        option gateway '192.168.12.1'
root@OpenWrt:~# cat /etc/config/dhcp 

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '2'
        option limit '50'
        option leasetime '48h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'
        option force '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'vlan20'
        option interface 'vlan20'
        option start '100'
        option limit '50'
        option leasetime '72h'
        option force '1'

config dhcp 'vlan30'
        option interface 'vlan30'
        option start '100'
        option limit '50'
        option leasetime '72h'
        option force '1'

config dhcp 'vlan10'
        option interface 'vlan10'
        option start '100'
        option limit '50'
        option leasetime '72h'
        option force '1'

VLAN10 and VLAN20 work and they are both able to only access devices in each other's network but when I'm connected to VLAN30 I am only able to access VLAN30 devices instead of devices on all 3 VLANs

Would someone be able to point me in the right direction to where my firewall rules are wrong?

Thank you!

2

These are unnecessary. Remove them.

You have this rule listed twice. Remove one of them.

Same with this. Remove one.

Your route tables may be at issue here, too. But try the above first.

Also, what are the source and target devices? Are any of them windows? If so, you need to adjust the windows firewall to allow access from other subnets.

3

Updated firewall:

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'vlan10'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'vlan10'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'

config forwarding
        option src 'vlan10'
        option dest 'wan'

config forwarding
        option src 'vlan30'
        option dest 'vlan10'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'vlan10'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'vlan10'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Block_VLAN_10_to_CG-NAT'
        option src 'vlan10'
        option dest 'wan'
        option dest_ip '192.168.12.0/24'
        option target 'REJECT'

config zone
        option name 'vlan20'
        option input 'ACCEPT'
        option output 'ACCEPT'
        list network 'vlan20'
        option forward 'REJECT'

config forwarding
        option src 'vlan20'
        option dest 'vpnfirewall'

config rule
        option name 'Block-192.168.20.15'
        option src 'vlan20'
        option src_ip '192.168.20.15'
        option target 'REJECT'

config forwarding
        option src 'vlan30'
        option dest 'vlan20'

config zone
        option name 'vlan30'
        option input 'ACCEPT'
        option output 'ACCEPT'
        list network 'vlan30'
        option forward 'ACCEPT'

config forwarding
        option src 'vlan30'
        option dest 'wan'

config zone
        option name 'vpnfirewall'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'openvpn'

config forwarding
        option src 'vlan20'
        option dest 'vpnfirewall'

Where would I go to provide my current route tables, if needed? I haven't touched those yet.

For testing here is what I have:
VLAN10 -> Unraid server eth0 port
VLAN20 -> Plex docker container to port forward from server eth1 port
VLAN30 -> Management console from server

I am using a Windows PC to check my connection from VLAN30 if I can access the management console, Plex, and unraid management. Do I need to change anything in the firewall settings here? Or is that only if I were trying to access a Windows machine from a different subnet?

4

Add these two routes.

config route                    
        option interface 'vlan10' 
        option target '192.168.10.0'
        option netmask '255.255.255.0'
        option table '100'

config route                    
        option interface 'vlan30' 
        option target '192.168.30.0'
        option netmask '255.255.255.0'
        option table '100'
5

Added and see no change, still unable to access VLAN10 or 20 from 30

6

Did you restart network?
I had a typo in the target of vlan10 with a trailing dot, I hope you saw that.

7

Yes router was restarted after changing firewall settings and yes I saw the typo, my current firewall config is:

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'vlan10'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'vlan10'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'

config forwarding
        option src 'vlan10'
        option dest 'wan'

config forwarding
        option src 'vlan30'
        option dest 'vlan10'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'vlan10'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'vlan10'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Block_VLAN_10_to_CG-NAT'
        option src 'vlan10'
        option dest 'wan'
        option dest_ip '192.168.12.0/24'
        option target 'REJECT'

config zone
        option name 'vlan20'
        option input 'ACCEPT'
        option output 'ACCEPT'
        list network 'vlan20'
        option forward 'REJECT'

config forwarding
        option src 'vlan20'
        option dest 'vpnfirewall'

config rule
        option name 'Block-192.168.20.15'
        option src 'vlan20'
        option src_ip '192.168.20.15'
        option target 'REJECT'

config forwarding
        option src 'vlan30'
        option dest 'vlan20'

config zone
        option name 'vlan30'
        option input 'ACCEPT'
        option output 'ACCEPT'
        list network 'vlan30'
        option forward 'ACCEPT'

config forwarding
        option src 'vlan30'
        option dest 'wan'

config zone
        option name 'vpnfirewall'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'openvpn'

config forwarding
        option src 'vlan20'
        option dest 'vpnfirewall'

config route                    
        option interface 'vlan10' 
        option target '192.168.10.0'
        option netmask '255.255.255.0'
        option table '100'

config route                    
        option interface 'vlan30' 
        option target '192.168.30.0'
        option netmask '255.255.255.0'
        option table '100'
8

The configuration snippet was meant for network, not firewall. More to that, you'll need to add also for vlan20 as I noticed you need that forwarding too.

config route                    
        option interface 'vlan20' 
        option target '192.168.20.0'
        option netmask '255.255.255.0'
        option table '100'
9

That seems to have worked, thank you! If you don't mind, woukd you be able to explain why that worked? I'm still new to all these rules and want to make sure I understand what's going on.

Thank you!

1 Like
10

Because you added a new routing table which only had one entry; to route everything out of the default gateway/router. There were no directly connected networks, hence they needed to be added.

1 Like
11

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.