I am not able to access internet

defect-slayer · November 20, 2022, 1:36pm

I have my setup like
ISP Router(192.168.29.1) <-> OpenWrt (192.168.1.1) <-> local devices(192.168.1.XX)

This was working for long but today all of sudden my local devices lost internet connectivity.
OpenWrt can access internet

root@OpenWrt:~# ping google.com
PING google.com (2404:6800:4002:806::200e): 56 data bytes
64 bytes from 2404:6800:4002:806::200e: seq=0 ttl=119 time=5.346 ms
64 bytes from 2404:6800:4002:806::200e: seq=1 ttl=119 time=5.285 ms
64 bytes from 2404:6800:4002:806::200e: seq=2 ttl=119 time=5.009 ms
^C
--- google.com ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 5.009/5.213/5.346 ms

but LAN devices cannot even reach to ISP router 192.168.29.1

Is it a case of some route missing?
Not a master of networking just basic user so pardon for any silly mistakes.
Let me know if any other info needed.

Wallbanger · November 20, 2022, 3:13pm

I'm wondering how your clients will reach anything in 192.168.29.0/24 from 192.168.1.0/24

psherman · November 20, 2022, 5:50pm

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

defect-slayer · November 20, 2022, 6:04pm

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option packet_steering '1'
        option ula_prefix 'fd7a:0ef0:eebd::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config device
        option name 'lan1'
        option macaddr '60:38:e0:32:e5:7c'

config device
        option name 'lan2'
        option macaddr '60:38:e0:32:e5:7c'

config device
        option name 'lan3'
        option macaddr '60:38:e0:32:e5:7c'

config device
        option name 'lan4'
        option macaddr '60:38:e0:32:e5:7c'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device
        option name 'wan'
        option macaddr '60:38:e0:32:e5:7c'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
        option band '2g'
        option htmode 'HT40'
        option channel 'auto'
        option cell_density '0'
        option disabled '1'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'OpenWrt2'
        option encryption 'sae'
        option key 'polo1$$p'
        option disabled '1'

config wifi-device 'radio1'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
        option band '5g'
        option cell_density '0'
        option country 'IN'
        option htmode 'VHT80'
        option channel '36'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'OpenWrt'
        option key 'polo1$$p'
        option encryption 'sae-mixed'

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config host
        option ip '192.168.1.217'
        option mac ''
        option name 'home-server.lan'
        option dns '1'

config domain
        option ip '192.168.1.217'
        option name 'pi-hole.lan'

config host
        option name 'desktop'
        option dns '1'
        option mac ''
        option ip '192.168.1.219'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option synflood_protect '1'
        option flow_offloading '1'
        option flow_offloading_hw '1'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config forwarding
        option src 'wan'
        option dest 'lan'

psherman · November 20, 2022, 6:11pm

Delete the following... it is an extraneous entry (you already have a wan zone defined, but this one doesn't have any networks assigned -- this may be causing an issue and it should be removed).

and this is backwards...

it should look like this

config forwarding
        option src 'lan'
        option dest 'wan'

fix those two things, restart your router and report back.

frollic · November 20, 2022, 8:34pm

Or just do a full reset.

defect-slayer · November 21, 2022, 2:58am

Thanks this worked.
I have a question that why it stopped working all of a sudden, when I have not touched the config for 2-3 months.
Just want to know so that I can prevent it in future.

psherman · November 21, 2022, 3:14am

I have no idea why it was working in the first place... if you're positive that you (and by extension nobody else) touched the configuration, I can't say why it suddenly stopped working... but it shouldn't have been working based on the config you shared. Really, the situation suggests that there was some modification of the firewall config that caused it to stop working, but I can't explain it beyond that.

Meanwhile, if your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.

system · December 1, 2022, 3:14am

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.