Hiden gateway two network

Installing and Using OpenWrt Network and Wireless Configuration
1

Hi OpenWRT community.

I am working with a Router with LEDE 17.04 and I'm defining this network:

OpenWRT

For the network on port ETH0 the segment 192.168.1.0/24 is defined and for the WLAN it is 192.168.2.0/24 and the gateways defined for each network correspond to 192.168.1.1 and 192.168.2.1.

any way to avoid being on the WLAN network to trace the gateway of the ETH0 segment. The main idea is that from any of the two interfaces the other interface cannot be traced.

I tried with adding rules in the firewall but nothing I get it to work.

configurations:

root@LEDE:/# cat /etc/config/network 

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdc9:aea8:111a::/48'

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	option ipaddr '192.168.2.1'
	option netmask '255.255.255.0'
	option ipv6	'0'

config interface 'wan'
	option ifname 'eth0'
	option proto 'static'
	option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
	optiion ipv6	'0'

#config interface 'wan6'
#	option ifname 'eth0'
#	option proto 'dhcpv6'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '1 2 3 4 0'

root@LEDE:/# cat /etc/config/firewall 
config defaults
	option syn_flood	1
	option input		ACCEPT
	option output		ACCEPT
	option forward		REJECT
# Uncomment this line to disable ipv6 rules
#	option disable_ipv6	1

config zone
	option name		lan
	list   network		'lan'
	option input		ACCEPT
	option output		ACCEPT
	option forward		REJECT

config zone
	option name		wan
	list   network		'wan'
#	list   network		'wan6'
	option input		REJECT
	option output		ACCEPT
	option forward		REJECT
	option masq		1
#	option masq_dest	'192.168.1.0/24'
	option mtu_fix		1

#config forwarding
#	option src		wan
#	option dest		lan

#config forwarding
#        option src              lan
#        option dest             wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
	option name		Allow-DHCP-Renew
	option src		wan
	option proto		udp
	option dest_port	68
	option target		ACCEPT
	option family		ipv4

# Allow IPv4 ping
config rule
	option name		Allow-Ping
	option src		wan
	option proto		icmp
	option icmp_type	echo-request
	option family		ipv4
	option target		ACCEPT

config rule
	option name		Allow-IGMP
	option src		wan
	option proto		igmp
	option family		ipv4
	option target		ACCEPT

# Allow DHCPv6 replies
# see https://dev.openwrt.org/ticket/10381
config rule
	option name		Allow-DHCPv6
	option src		wan
	option proto		udp
	option src_ip		fc00::/6
	option dest_ip		fc00::/6
	option dest_port	546
	option family		ipv6
	option target		ACCEPT

config rule
	option name		Allow-MLD
	option src		wan
	option proto		icmp
	option src_ip		fe80::/10
	list icmp_type		'130/0'
	list icmp_type		'131/0'
	list icmp_type		'132/0'
	list icmp_type		'143/0'
	option family		ipv6
	option target		ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
	option name		Allow-ICMPv6-Input
	option src		wan
	option proto	icmp
	list icmp_type		echo-request
	list icmp_type		echo-reply
	list icmp_type		destination-unreachable
	list icmp_type		packet-too-big
	list icmp_type		time-exceeded
	list icmp_type		bad-header
	list icmp_type		unknown-header-type
	list icmp_type		router-solicitation
	list icmp_type		neighbour-solicitation
	list icmp_type		router-advertisement
	list icmp_type		neighbour-advertisement
	option limit		1000/sec
	option family		ipv6
	option target		ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
	option name		Allow-ICMPv6-Forward
	option src		wan
	option dest		*
	option proto		icmp
	list icmp_type		echo-request
	list icmp_type		echo-reply
	list icmp_type		destination-unreachable
	list icmp_type		packet-too-big
	list icmp_type		time-exceeded
	list icmp_type		bad-header
	list icmp_type		unknown-header-type
	option limit		1000/sec
	option family		ipv6
	option target		ACCEPT

config rule
	option name		Allow-IPSec-ESP
	option src		wan
	option dest		lan
	option proto		esp
	option target		ACCEPT

config rule
	option name		Allow-ISAKMP
	option src		wan
	option dest		lan
	option dest_port	500
	option proto		udp
	option target		ACCEPT

config	rule
	option	target		'REJECT'
	option	src		'wan'
	option	family		'ipv4'
	option	proto		'tcp'
	option	src_ip		'192.168.1.0/24'
	option	dest_port	'22'
	option	name		'ACCEPT-SSH-INTERNAL-DEVICE'
	option	enabled		'1'

# include a file with users custom iptables rules
config include
	option path /etc/firewall.user


root@LEDE:/# cat /etc/config/dhcp 

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.auto'
	option localservice '1'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv6 'disable'
	option ra 'server'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'


config wifi-device 'radio0'
	option type 'mac80211'
	option channel 'auto'
	option hwmode '11a'
	option path 'platform/ar934x_wmac'
	option htmode 'HT20'
	option disabled '0'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option ssid 'LEDE'
	option encryption 'none'

Any ideas? Thanks

2

LEDE 17.01 is ancient and has been EOL and unsupported for many years now. It is not safe to run this on the internet anymore, and you should look to upgrade to a recent version of OpenWrt.

That said, if you're talking about a traceroute, the gateway at 192.168.1.1 is going to be in that trace since it is the upstream router. You would need to set that gateway to not respond to pings/traceroutes. On your LEDE box, you can block access to 192.168.1.0/24 with the firewall... that would prevent the 192.168.2.0/24 network from talking to the router or anything else on that network... but I think it will still show up in the trace unless you change the configuration of the 1.1 gateway.

1 Like
3

Thanks @psherman for your response. Yes it is a pending task that I have to upgrade the version of the OS but that would give us for another post.

As you say with the Firewall block any protocol between network segments but the gateways are visible between them.

What is the configuration change you mention at the end?

4

TBH, I'm not exactly sure what changes need to be made to the upstream firewall for traceroute (and your ability to do this would depend entirely on the upsream router's firmware/software), but you might read through this:

https://forum.mikrotik.com/viewtopic.php?t=8041

But at this point, it seems like it isn't really related to OpenWrt anymore if that upstream router isn't actually running OpenWrt.

1 Like