I found the solution. Let openwrt default dhcp configuration, then configure Firewall Traffic Rules to block/reject udp ports 67/68 from WAN to LAN.
To configure OpenWrt as your local DHCP server and block your upstream (WAN) DHCP server from communicating with your local network, you can set up a custom Traffic Rule to drop UDP port 67 and 68 traffic. [1]
To be very clear, this is not the correct solution. What it indicates is that something is/was seriously wrong with your firewall configuration. And whatever constitutes that root-cause was not visible in the configs you posted.
wan > lan forwarding is not allowed at all in the standard/default configuration. This rule is entirely unnecessary under normal circumstances.
It is also worth noting that the link you just provided is for TurrisOS. That is obviously a fork of OpenWrt, but it is massively modified relative to the official OpenWrt firmware and therefore is not a proper reference point.
I will express this again because I think it is important:
--> Something is very wrong with your current configuration. Whatever is causing this could also represent serious issues with respect to security and general network operation. Please reset your router and you will see that the default configuration will work as expected.
Complementary solution.
When using mwan configurations, the rules have to be duplicated for each WAN that faces a dhcp server
I hope you saw my recent reply... your "solution" should be entirely unnecessary and indicates that you have a serious underlying issue that would be solved by simply resetting the device to defaults.
I already told that from the start on default configuration the devices on the Lan side gets ip's from the isp network (10.35.126.x/24) as if the openwrt dhcp is working as a relay.
By blocking the dhcp transactions from the isp, the openwrt takes over and the Lan side gets ip's from local network (192.168.1.x/24)
The point I was making is that this behavior is not normal for openwrt and is clearly the result of a serious misconfiguration.
