I have one wireless lan mapping to the "Main" subnet 192.168.8.XXX and another Guest wifi with its own VLAN (192.168.9.XXX). AP Isolation is on as I don't want devices on the Guest wifi to see other devices unless explicitly permitted. In Luci, I went to Network -> Firewall and configured a rule to allow a specific device IP to see a server on the "Main" subnet i.e. ip 192.168.8.100.
I have played with selecting specific zones and then just general zones. Didn't work.
I'm really stuck here, does anyone have suggestions?
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):
Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall
frollic:
bus call system board
Thank you Frollic, here is the output.
{
"kernel": "5.4.281",
"hostname": "GL-BE14000",
"system": "ARMv8 Processor rev 0",
"model": "GL.iNet GL-BE14000",
"board_name": "glinet,gl-be14000",
"release": {
"distribution": "OpenWrt",
"version": "21.02-SNAPSHOT",
"revision": "",
"target": "mediatek/mt7988",
"description": "OpenWrt 21.02-SNAPSHOT "
}
}
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd59:e2ab:e9ad::/48'
config device
option name 'br-lan'
option type 'bridge'
option macaddr '-'
list ports 'eth1.1'
config device
option name 'eth1.1'
option macaddr '-'
option ifname 'eth1'
config device
option name 'lan5'
option macaddr '-''
config device
option name 'lan6'
option macaddr '9-'
config device
option name 'lan7'
option macaddr '-'
config device
option name 'lan8'
option macaddr '-'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.8.1'
option netmask '255.255.255.0'
option ip6assign '60'
option display_name 'main'
option isolate '0'
config device 'secondwan_dev'
option name 'eth1.2'
option macaddr '-'
option ifname 'eth1'
config interface 'secondwan'
option device 'eth1.2'
option proto 'dhcp'
option metric '15'
option ipv6 '0'
option force_link '0'
option classlessroute '0'
config interface 'secondwan6'
option proto 'dhcpv6'
option device '@secondwan'
option disabled '1'
config device
option name 'eth2'
option macaddr '-'
config interface 'wan'
option device 'eth2'
option proto 'dhcp'
option force_link '0'
option ipv6 '0'
option classlessroute '0'
option metric '10'
config interface 'wan6'
option proto 'dhcpv6'
option device '@wan'
option disabled '1'
config switch
option name 'switch0'
option reset '0'
option enable_vlan '1'
config switch_vlan 'vlan_lan'
option device 'switch0'
option vlan '1'
option ports '0 5t'
config switch_vlan 'vlan_secondwan'
option device 'switch0'
option vlan '2'
option ports '4 5t'
config interface 'guest'
option force_link '1'
option device 'br-guest'
option proto 'static'
option ipaddr '192.168.9.1'
option netmask '255.255.255.0'
option ip6assign '60'
option multicast_querier '1'
option igmp_snooping '0'
option display_name 'guest'
option vlan_id '9'
option isolate '1'
config device
option name 'br-guest'
option type 'bridge'
option bridge_empty '1'
config interface 'iot'
option force_link '1'
option device 'br-iot'
option proto 'static'
option ipaddr '192.168.10.1'
option netmask '255.255.255.0'
option ip6assign '60'
option multicast_querier '1'
option igmp_snooping '0'
option isolate '0'
option display_name 'iot'
option vlan_id '10'
option disabled '0'
config device
option name 'br-iot'
option type 'bridge'
option bridge_empty '1'
list ports 'eth1.10'
config rule 'policy_relay_lo_rt_lan'
option lookup '16800'
option in 'loopback'
option priority '1'
config interface 'tethering6'
option device '@tethering'
option proto 'dhcpv6'
option disabled '1'
config interface 'wwan6'
option device '@wwan'
option proto 'dhcpv6'
option disabled '1'
config interface 'wwan'
option proto 'dhcp'
option classlessroute '0'
option metric '20'
config interface 'modem_1_1_s1_6'
option proto 'dhcpv6'
option disabled '1'
option device '@modem_1_1_s1'
config interface 'modem_2_1_s1_6'
option proto 'dhcpv6'
option disabled '1'
option device '@modem_2_1_s1'
config interface 'modem_3_1_s1_6'
option proto 'dhcpv6'
option disabled '1'
option device '@modem_3_1_s1'
config interface 'modem_4_1_s1_6'
option proto 'dhcpv6'
option disabled '1'
option device '@modem_4_1_s1'
config device
option name 'br-vlan11'
option type 'bridge'
config interface 'vlan11'
option device 'br-vlan11'
option proto 'static'
option ipaddr '192.168.11.1'
option netmask '255.255.255.0'
option display_name 'V11'
option vlan_id '11'
config device
option name 'br-vlan12'
option type 'bridge'
list ports 'eth1.12'
config interface 'vlan12'
option device 'br-vlan12'
option proto 'static'
option ipaddr '192.168.12.1'
option netmask '255.255.255.0'
option display_name 'V12'
option vlan_id '12'
config device
option name 'br-vlan20'
option type 'bridge'
list ports 'lan8'
list ports 'lan7'
list ports 'lan6'
list ports 'lan5'
list ports 'eth1.20'
config interface 'vlan20'
option device 'br-vlan20'
option proto 'static'
option ipaddr '192.168.20.1'
option netmask '255.255.255.0'
option display_name 'V20'
option vlan_id '20'
option isolate '1'
config switch_vlan
option device 'switch0'
option vlan '20'
option ports '5t 3'
config device
option name 'eth1.20'
option ifname 'eth1'
config switch_vlan
option device 'switch0'
option vlan '10'
option ports '5t 2'
config device
option name 'eth1.10'
option ifname 'eth1'
config switch_vlan
option device 'switch0'
option vlan '12'
option ports '5t 1'
config device
option name 'eth1.12'
option ifname 'eth1'
config wifi-device 'MT7990_1_1'
option type 'mtkwifi'
option vendor 'mediatek'
option percentag_enable '1'
option txpower '100'
option acs_skiplist '12;13'
option acs_scan_dwell '200'
option acs_restore_dwell '150'
option acs_check_time '0'
option acs_ch_util_threshold '0'
option acs_data_rate_weight '1'
option acs_prio_weight '0'
option acs_tx_power_cons '0'
option acs_max_acs_times '0'
option acs_switch_ch_threshold '0'
option acs_sta_num_threshold '1'
option beacon_int '100'
option txpreamble '1'
option band '2g'
option ht_txstream '4'
option ht_rxstream '4'
option shortslot '1'
option ht_distkip '1'
option bgprotect '0'
option txburst '1'
option region '0'
option country 'US'
option e2p_accessmode '2'
option map_mode '0'
option dbdc_mode '0'
option etxbfencond '1'
option itxbfen '0'
option mutxrx_enable '0'
option bss_color '255'
option twt_support '3'
option dfs_enable '0'
option sr_mode '0'
option sre_enable '1'
option powerup_cckofdm '0:0:0:0:0:0:0'
option powerup_ht20 '0:0:0:0:0:0:0'
option powerup_ht40 '0:0:0:0:0:0:0'
option powerup_vht20 '0:0:0:0:0:0:0'
option powerup_vht40 '0:0:0:0:0:0:0'
option powerup_vht80 '0:0:0:0:0:0:0'
option powerup_vht160 '0:0:0:0:0:0:0'
option vow_airtime_fairness_en '1'
option ht_rdg '0'
option vow_bw_ctrl '0'
option vow_ex_en '1'
option htmode 'EHT40'
option pure_11b '0'
option doth '0'
option dfs_zero_wait '0'
option rd_region 'FCC'
option qos_enable '1'
option dfs_offchannel_cac '0'
option dfs_slave '0'
option cp_support '2'
option noscan '1'
option ht_coex '1'
option random_bssid '1'
option disabled '0'
option channel 'auto'
option macaddr '-'
option legacy_rates '0'
config wifi-iface 'ra0'
option device 'MT7990_1_1'
option network 'lan'
option mode 'ap'
option disabled '0'
option vifidx '1'
option hidden '0'
option wmm '1'
option dtim_period '1'
option rekey_interval '604800'
option rekey_meth 'DISABLE'
option ieee8021x '0'
option auth_server '0'
option auth_port '1812'
option ownip '192.168.1.1'
option idle_timeout '0'
option session_timeout '0'
option rsn_preauth '0'
option ieee80211w '1'
option pmf_sha256 '0'
option tx_rate '0'
option isolate '0'
option rts '2347'
option frag '2346'
option apsd_capable '1'
option vht_bw_signal '0'
option vht_ldpc '1'
option vht_stbc '1'
option vht_sgi '1'
option ht_ldpc '1'
option ht_stbc '1'
option ht_protect '1'
option ht_gi '1'
option ht_opmode '0'
option ht_amsdu '1'
option ht_autoba '1'
option ht_badec '0'
option ht_bawinsize '1024'
option igmpsn_enable '0'
option mumimoul_enable '1'
option mumimodl_enable '1'
option muofdmaul_enable '1'
option muofdmadl_enable '1'
option pmk_cache_period '65530'
option wdsencryptype 'NONE'
option wdsphymode '0'
option access_policy '0'
option eml_mode 'emlsr'
option eml_trans_to '0'
option eml_omn_en '0'
option dscp_pri_map_enable '1'
option sta_keepalive '0'
option ieee80211r '0'
option tid_mapping '255'
option ht_mcs '33'
option amsdu_num '5'
option eht_ap_nsep_pri_access '1'
option eht_ap_txop_sharing '0'
option ieee80211k '1'
option eht_t2lmnegosupport '1'
option proxy_arp '0'
option ht_mpdu_density '4'
option ifname 'ra0'
option factory_macaddr '94:83:c4:eb:e1:c5'
option encryption 'psk2+ccmp'
option wds '1'
option random_bssid '1'
option bss_transition '1'
option init '1'
option ssid 'WIFI-2.4G'
option key '-'
option macaddr '-'
config wifi-device 'MT7990_1_2'
option type 'mtkwifi'
option vendor 'mediatek'
option percentag_enable '1'
option txpower '100'
option acs_skiplist '52;56;60;64;100;104;108;112;116;120;124;128;132;136;140;144;149;153;157;16
1;165'
option acs_scan_dwell '200'
option acs_restore_dwell '150'
option acs_check_time '0'
option acs_ch_util_threshold '0'
option acs_data_rate_weight '1'
option acs_prio_weight '0'
option acs_tx_power_cons '0'
option acs_max_acs_times '0'
option acs_switch_ch_threshold '0'
option acs_sta_num_threshold '1'
option beacon_int '100'
option txpreamble '1'
option band '5g'
option ht_txstream '4'
option ht_rxstream '4'
option shortslot '1'
option ht_distkip '1'
option bgprotect '0'
option txburst '1'
option country 'US'
option aregion '13'
option e2p_accessmode '2'
option map_mode '0'
option dbdc_mode '0'
option etxbfencond '1'
option itxbfen '0'
option mutxrx_enable '0'
option bss_color '255'
option twt_support '3'
option dfs_enable '1'
option sr_mode '0'
option sre_enable '1'
option powerup_cckofdm '0:0:0:0:0:0:0'
option powerup_ht20 '0:0:0:0:0:0:0'
option powerup_ht40 '0:0:0:0:0:0:0'
option powerup_vht20 '0:0:0:0:0:0:0'
option powerup_vht40 '0:0:0:0:0:0:0'
option powerup_vht80 '0:0:0:0:0:0:0'
option powerup_vht160 '0:0:0:0:0:0:0'
option vow_airtime_fairness_en '1'
option ht_rdg '0'
option vow_bw_ctrl '0'
option vow_ex_en '1'
option doth '1'
option dfs_zero_wait '1'
option dfs_dedicated_zero_wait '0'
option dfs_zero_wait_default '0'
option rd_region 'FCC'
option qos_enable '1'
option dfs_offchannel_cac '0'
option dfs_slave '0'
option cp_support '2'
option band4_dfs_enable '0'
option dfs_zero_wait_bandidx '1'
option random_bssid '1'
option disabled '0'
option channel 'auto'
option macaddr '-'
option htmode 'EHT160'
config wifi-iface 'rai0'
option device 'MT7990_1_2'
option network 'lan'
option mode 'ap'
option disabled '0'
option vifidx '1'
option hidden '0'
option wmm '1'
option dtim_period '1'
option encryption 'sae-mixed'
option rekey_interval '604800'
option rekey_meth 'DISABLE'
option ieee8021x '0'
option auth_server '0'
option auth_port '1812'
option ownip '192.168.1.1'
option idle_timeout '0'
option session_timeout '0'
option rsn_preauth '0'
option ieee80211w '1'
option pmf_sha256 '0'
option tx_rate '0'
option isolate '0'
option rts '2347'
option frag '2346'
option apsd_capable '1'
option vht_bw_signal '0'
option vht_ldpc '1'
option vht_stbc '1'
option vht_sgi '1'
option ht_ldpc '1'
option ht_stbc '1'
option ht_protect '1'
option ht_gi '1'
option ht_opmode '0'
option ht_amsdu '1'
option ht_autoba '1'
option ht_badec '0'
option ht_bawinsize '1024'
option igmpsn_enable '0'
option mumimoul_enable '1'
option mumimodl_enable '1'
option muofdmaul_enable '1'
option muofdmadl_enable '1'
option pmk_cache_period '65530'
option wdsencryptype 'NONE'
option wdsphymode '0'
option access_policy '0'
option eml_mode 'emlsr'
option eml_trans_to '0'
option eml_omn_en '0'
option dscp_pri_map_enable '1'
option sta_keepalive '0'
option ieee80211r '0'
option tid_mapping '255'
option ht_mcs '33'
option amsdu_num '5'
option eht_ap_nsep_pri_access '1'
option eht_ap_txop_sharing '0'
option ieee80211k '1'
option eht_t2lmnegosupport '1'
option proxy_arp '0'
option ht_mpdu_density '3'
option ifname 'rai0'
option random_bssid '1'
option factory_macaddr '-'
option wds '1'
option bss_transition '1'
option init '1'
option ssid 'WIFI-5G'
option key '-'
option macaddr '-'
config wifi-device 'MT7990_1_3'
option type 'mtkwifi'
option vendor 'mediatek'
option percentag_enable '1'
option txpower '100'
option acs_skiplist '97;101;105;109;113;117;121;125;129;133;137;141;145;149;153;157;161;165;169
;173;177;181;185;189;193;197;201;205;209;213;217;221;225;229;233'
option acs_scan_dwell '200'
option acs_restore_dwell '150'
option acs_check_time '0'
option acs_ch_util_threshold '0'
option acs_data_rate_weight '1'
option acs_prio_weight '0'
option acs_tx_power_cons '0'
option acs_max_acs_times '0'
option acs_switch_ch_threshold '0'
option acs_sta_num_threshold '1'
option beacon_int '100'
option txpreamble '1'
option band '6g'
option ht_txstream '4'
option ht_rxstream '4'
option shortslot '1'
option ht_distkip '1'
option bgprotect '0'
option txburst '1'
option country 'US'
option aregion '0'
option e2p_accessmode '2'
option map_mode '0'
option dbdc_mode '0'
option etxbfencond '1'
option itxbfen '0'
option mutxrx_enable '0'
option bss_color '255'
option twt_support '3'
option dfs_enable '0'
option sr_mode '0'
option sre_enable '1'
option powerup_cckofdm '0:0:0:0:0:0:0'
option powerup_ht20 '0:0:0:0:0:0:0'
option powerup_ht40 '0:0:0:0:0:0:0'
option powerup_vht20 '0:0:0:0:0:0:0'
option powerup_vht40 '0:0:0:0:0:0:0'
option powerup_vht80 '0:0:0:0:0:0:0'
option powerup_vht160 '0:0:0:0:0:0:0'
option vow_airtime_fairness_en '1'
option ht_rdg '0'
option vow_bw_ctrl '0'
option vow_ex_en '1'
option htmode 'EHT320'
option doth '1'
option dfs_zero_wait '0'
option dfs_dedicated_zero_wait '0'
option dfs_zero_wait_default '0'
option rd_region 'FCC'
option psc_acs '1'
option qos_enable '1'
option dfs_offchannel_cac '0'
option dfs_slave '0'
option cp_support '2'
option dfs_zero_wait_bandidx '1'
option random_bssid '1'
option disabled '0'
option channel 'auto'
option macaddr '-'
option chan_6g_only_psc '1'
option require_mode 'ax'
config wifi-iface 'rax0'
option device 'MT7990_1_3'
option network 'lan'
option mode 'ap'
option disabled '0'
option vifidx '1'
option hidden '0'
option wmm '1'
option dtim_period '1'
option encryption 'sae'
option rekey_interval '604800'
option rekey_meth 'DISABLE'
option ieee8021x '0'
option auth_server '0'
option auth_port '1812'
option ownip '192.168.1.1'
option idle_timeout '0'
option session_timeout '0'
option rsn_preauth '0'
option ieee80211w '2'
option pmf_sha256 '0'
option tx_rate '0'
option isolate '0'
option rts '2347'
option frag '2346'
option apsd_capable '1'
option vht_bw_signal '0'
option vht_ldpc '1'
option vht_stbc '1'
option vht_sgi '1'
option ht_ldpc '1'
option ht_stbc '1'
option ht_protect '1'
option ht_gi '1'
option ht_opmode '0'
option ht_amsdu '1'
option ht_autoba '1'
option ht_badec '0'
option ht_bawinsize '1024'
option igmpsn_enable '0'
option mumimoul_enable '1'
option mumimodl_enable '1'
option muofdmaul_enable '1'
option muofdmadl_enable '1'
option pmk_cache_period '65530'
option wdsencryptype 'NONE'
option wdsphymode '0'
option access_policy '0'
option eml_mode 'emlsr'
option eml_trans_to '0'
option eml_omn_en '0'
option dscp_pri_map_enable '1'
option sta_keepalive '0'
option ieee80211r '0'
option tid_mapping '255'
option ht_mcs '33'
option amsdu_num '5'
option eht_ap_nsep_pri_access '1'
option eht_ap_txop_sharing '0'
option ieee80211k '1'
option eht_t2lmnegosupport '1'
option proxy_arp '0'
option ht_mpdu_density '5'
option ifname 'rax0'
option random_bssid '1'
option factory_macaddr '-'
option sae_pwe '1'
option wds '1'
option bss_transition '1'
option init '1'
option ssid 'WIFI-6G'
option key '-'
option macaddr '-'
config wifi-iface 'guest2g'
option device 'MT7990_1_1'
option network 'guest'
option mode 'ap'
option ifname 'ra1'
option encryption 'psk2+ccmp'
option factory_macaddr '-'
option guest '1'
option wds '1'
option hidden '0'
option random_bssid '1'
option vifidx '2'
option disabled '0'
option ssid 'GUEST'
option key '-'
option init '1'
option macaddr '-'
option isolate '1'
config wifi-iface 'wlanmld2g'
option device 'MT7990_1_1'
option network 'lan'
option mode 'ap'
option factory_macaddr '-'
option ssid 'GL-BE14000-1c1-MLO'
option encryption 'sae'
option key '-'
option wds '1'
option isolate '0'
option hidden '0'
option ifname 'ra2'
option ieee80211k '1'
option bss_transition '1'
option disabled '1'
option vifidx '3'
option mld 'mld0'
option macaddr '-'
config wifi-iface 'guest5g'
option device 'MT7990_1_2'
option network 'guest'
option mode 'ap'
option ifname 'rai1'
option encryption 'sae-mixed'
option factory_macaddr '-'
option guest '1'
option wds '1'
option hidden '0'
option random_bssid '1'
option vifidx '2'
option disabled '0'
option ssid 'IOT'
option init '1'
option key '-'
option macaddr '-'
option isolate '1'
config wifi-iface 'wlanmld5g'
option device 'MT7990_1_2'
option network 'lan'
option mode 'ap'
option factory_macaddr '94:83:c4:eb:e1:c9'
option ssid 'GL-BE14000-1c1-MLO'
option encryption 'sae'
option key '-'
option wds '1'
option isolate '0'
option hidden '0'
option ifname 'rai2'
option ieee80211k '1'
option bss_transition '1'
option disabled '1'
option vifidx '3'
option mld 'mld0'
option macaddr '-'
config wifi-iface 'guest6g'
option device 'MT7990_1_3'
option network 'guest'
option mode 'ap'
option ifname 'rax1'
option encryption 'sae'
option sae_pwe '1'
option key '-'
option ssid 'GL-BE14000-1c1-6G-Guest'
option factory_macaddr '-'
option guest '1'
option disabled '1'
option wds '1'
option hidden '0'
option init '0'
option random_bssid '1'
option vifidx '2'
option macaddr '-'
option isolate '1'
config wifi-iface 'wlanmld6g'
option device 'MT7990_1_3'
option network 'lan'
option mode 'ap'
option factory_macaddr '-'
option ssid 'GL-BE14000-1c1-MLO'
option encryption 'sae'
option key '-'
option wds '1'
option isolate '0'
option hidden '0'
option ifname 'rax2'
option ieee80211k '1'
option bss_transition '1'
option disabled '1'
option vifidx '3'
option mld 'mld0'
option macaddr '-'
config wifi-mld 'mld0'
option disabled '1'
option ssid 'GL-BE14000-1c1-MLO'
option eht_t2lmnegosupport '1'
option mode 'ap'
option encryption 'sae'
option key '-'
option iface 'ra2 rai2 rax2'
option hidden '0'
option mldgroup '1'
option mld_addr '-'
config wifi-iface 'iot2g'
option device 'MT7990_1_1'
option network 'iot'
option mode 'ap'
option ifname 'ra3'
option encryption 'psk2+ccmp'
option key '-'
option ssid 'GL-BE14000-1c1-IoT'
option factory_macaddr '-'
option iot '1'
option disabled '1'
option wds '1'
option isolate '1'
option hidden '0'
option init '0'
option random_bssid '1'
option vifidx '4'
option macaddr '-'
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option localservice '1'
option ednspacket_max '1232'
option confdir '/tmp/dnsmasq.d'
option rebind_protection '0'
option filter_aaaa '1'
option noresolv '1'
list server '192.168.8.183#53'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option ra_slaac '1'
option force '1'
option dhcpv6 'disabled'
option ra 'disabled'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config dhcp 'guest'
option interface 'guest'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv6 'disabled'
option ra 'disabled'
option force '1'
config dhcp 'iot'
option interface 'iot'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv6 'disabled'
option ra 'disabled'
option force '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
config domain
option name 'console.gl-inet.com'
option ip '192.168.8.1'
config domain
option name 'console.gl-inet.com' TV to Plexy
option ip '::ffff:192.168.8.1'
config dhcp 'secondwan'
option interface 'secondwan'
option ignore '1' TV to Plexy
config dhcp 'vlan11'
option interface 'vlan11'
option start '100'
option limit '150'
option leasetime '12h'
config dhcp 'vlan12'
option interface 'vlan12'
option start '100'
option limit '150'
option leasetime '12h'
config dhcp 'vlan20'
option interface 'vlan20'
option start '100'
option limit '150'
option leasetime '12h'
config host
option mac '-'
option ip '192.168.8.249'
option network 'lan'
option tag 'REDACTED'
config host
option mac '-'
option ip '192.168.8.243'
option network 'lan'
option tag 'REDACTED'
config host
option mac '-'
option ip '192.168.8.183'
option network 'lan'
option tag 'REDACTED'
config host
option mac '-'
option ip '192.168.8.165'
option network 'lan'
option tag 'REDACTED'
config host
option mac '-'
option ip '192.168.8.117'
option network 'lan'
option tag 'REDACTED'
config host
option mac '-'
option ip '192.168.8.104'
option network 'lan'
option tag 'REDACTED'
config host
option name 'GUESTDEVICE'
option dns '1'
option mac '-'
option ip '192.168.9.222'
config domain
option name 'REDACTED'
option ip '192.168.8.165'
config wifi-iface 'iot5g'
option device 'MT7990_1_2'
option network 'iot'
option mode 'ap'
option ifname 'rai3'
option encryption 'psk2+ccmp'
option key '-'
option ssid 'GL-BE14000-1c1-5G-IoT'
option factory_macaddr '-'
option iot '1'
option disabled '1'
option wds '1'
option isolate '1'
option hidden '0'
option init '0'
option random_bssid '1'
option vifidx '4'
option macaddr '-'
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option localservice '1'
option ednspacket_max '1232'
option confdir '/tmp/dnsmasq.d'
option rebind_protection '0'
option filter_aaaa '1'
option noresolv '1'
list server '192.168.8.183#53'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option ra_slaac '1'
option force '1'
option dhcpv6 'disabled'
option ra 'disabled'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config dhcp 'guest'
option interface 'guest'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv6 'disabled'
option ra 'disabled'
option force '1'
config dhcp 'iot'
option interface 'iot'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv6 'disabled'
option ra 'disabled'
option force '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
config domain
option name 'console.gl-inet.com'
option ip '192.168.8.1'
config domain
option name 'console.gl-inet.com'
option ip '::ffff:192.168.8.1'
config dhcp 'secondwan'
option interface 'secondwan'
option ignore '1'
config dhcp 'vlan11'
option interface 'vlan11'
option start '100'
option limit '150'
option leasetime '12h'
config dhcp 'vlan12'
option interface 'vlan12'
option start '100'
option limit '150'
option leasetime '12h'
config dhcp 'vlan20'
option interface 'vlan20'
option start '100'
option limit '150'
option leasetime '12h'
config host
option mac '-'
option ip '192.168.8.249'
option network 'lan'
option tag 'REDACTED'
config host
option mac '-'
option ip '192.168.8.243'
option network 'lan'
option tag 'REDACTED'
config host
option mac '-'
option ip '192.168.8.183'
option network 'lan'
option tag 'REDACTED'
config host
option mac '-'
option ip '192.168.8.165'
option network 'lan'
option tag 'REDACTED'
config host
option mac '-'
option ip '192.168.8.117'
option network 'lan'
option tag 'REDACTED'
config host
option mac '-'
option ip '192.168.8.104'
option network 'lan'
option tag 'REDACTED'
config host
option name 'GUESTDEVICE'
option dns '1'
option mac '-'
option ip '192.168.9.222'
config domain
option name 'SERVER'
option ip '192.168.8.165'
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option synflood_protect '1'
option forward 'REJECT'
config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
list network 'wwan'
list network 'secondwan'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option input 'DROP'
config forwarding
option src 'lan'
option dest 'wan'
option enabled '1'
Part II
config rule
option name 'GUESTDEVICE TO SERVER'
option target 'ACCEPT'
list src_ip '192.168.9.222'
list dest_ip '192.168.8.165'
list proto 'tcp'
option src 'guest'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '\*'
option proto 'icmp'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config rule
option name 'Support-UDP-Traceroute'
option src 'wan'
option dest_port '33434:33689'
option proto 'udp'
option family 'ipv4'
option target 'REJECT'
option enabled '0'
config include
option path '/etc/firewall.user'
config zone
option name 'guest'
option network 'guest'
option output 'ACCEPT'
option input 'REJECT'
option forward 'REJECT'
config forwarding
option src 'guest'
option dest 'wan'
option enabled '1'
config rule
option name 'Allow-DHCP'
option src 'guest'
option target 'ACCEPT'
option proto 'udp'
option dest_port '67-68'
config rule
option name 'Allow-DNS'
option src 'guest'
option target 'ACCEPT'
option proto 'tcp udp'
option dest_port '53'
config zone
option name 'iot'
option network 'iot'
option forward 'REJECT'
option output 'ACCEPT'
option input 'REJECT'
config forwarding
option src 'iot'
option dest 'wan'
option enabled '1'
config rule
option name 'Allow-DHCP'
option src 'iot'
option target 'ACCEPT'
option proto 'udp'
option dest_port '67-68'
config rule
option name 'Allow-DNS'
option src 'iot'
option target 'ACCEPT'
option proto 'tcp udp'
option dest_port '53'
config rule
option name 'Block-LAN-mgmt-guest'
option src 'lan'
option dest_ip '192.168.9.1'
option proto 'tcp udp'
option dest_port '80 443 8080 8443'
option target 'REJECT'
config rule
option name 'Block-LAN-mgmt-iot'
option src 'lan'
option dest_ip '192.168.10.1'
option proto 'tcp udp'
option dest_port '80 443 8080 8443'
option target 'REJECT'
config include 'nat6'
option path '/etc/firewall.nat6'
option reload '1'
config include 'dns_order'
option type 'script'
option path '/etc/firewall.dns_order'
option reload '1'
option enabled '1'
config include
option enabled '1'
option type 'script'
option path '/etc/netifyd/iptables-init.sh'
option reload '1'
option fw4_compatible '1'
config include 'vpnclient'
option type 'script'
option path '/usr/bin/rtp2.sh'
option reload '0'
config include 'glblock'
option type 'script'
option path '/usr/bin/gl_block.sh'
option reload '1'
config include 'security'
option type 'script'
option path '/etc/firewall.security'
option reload '1'
config include
option type 'script'
option path '/etc/firewall.pf'
option reload '0'
config zone
option name 'vlan11'
list network 'vlan11'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
config forwarding
option src 'vlan11'
option dest 'wan'
config rule
option name 'Allow-DHCP-vlan11'
option src 'vlan11'
option target 'ACCEPT'
option proto 'udp'
option dest_port '67-68'
config rule
option name 'Allow-DNS-vlan11'
option src 'vlan11'
option target 'ACCEPT'
option proto 'tcp udp'
option dest_port '53'
config rule
option name 'Block-LAN-mgmt-vlan11'
option src 'lan'
option dest_ip '192.168.11.1'
option proto 'tcp udp'
option dest_port '80 443 8080 8443'
option target 'REJECT'
config zone
option name 'vlan12'
list network 'vlan12'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
config forwarding
option src 'vlan12'
option dest 'wan'
config rule
option name 'Allow-DHCP-vlan12'
option src 'vlan12'
option target 'ACCEPT'
option proto 'udp'
option dest_port '67-68'
config rule
option name 'Allow-DNS-vlan12'
option src 'vlan12'
option target 'ACCEPT'
option proto 'tcp udp'
option dest_port '53'
config rule
option name 'Block-LAN-mgmt-vlan12'
option src 'lan'
option dest_ip '192.168.12.1'
option proto 'tcp udp'
option dest_port '80 443 8080 8443'
option target 'REJECT'
config zone
option name 'vlan20'
list network 'vlan20'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
config rule
option name 'Allow-DHCP-vlan20'
option src 'vlan20'
option target 'ACCEPT'
option proto 'udp'
option dest_port '67-68'
config rule
option name 'Allow-DNS-vlan20'
option src 'vlan20'
option target 'ACCEPT'
option proto 'tcp udp'
option dest_port '53'
config rule
option name 'Block-LAN-mgmt-vlan20'
option src 'lan'
option dest_ip '192.168.20.1'
option proto 'tcp udp'
option dest_port '80 443 8080 8443'
option target 'REJECT'
config rule 'sambasharewan'
option src 'wan'
option dest_port '137 138 139 445'
option dest_proto 'tcpudp'
option target 'DROP'
config rule 'sambasharelan'
option src 'lan'
option dest_port '137 138 139 445'
option dest_proto 'tcpudp'
option target 'ACCEPT'
config rule 'glnas_ser'
option src 'wan'
option dest_port '6000-6002'
option dest_proto 'tcp'
option target 'DROP'
config rule 'webdav_wan'
option src 'wan'
option dest_port '6008'
option dest_proto 'tcp'
option target 'DROP'
config rule
option name 'Allow-DHCP-guest'
option src 'guest'
option target 'ACCEPT'
option proto 'udp'
option dest_port '67-68'
config rule
option name 'Allow-DNS-guest'
option src 'guest'
option target 'ACCEPT'
option proto 'tcp udp'
option dest_port '53'
It appears you are using firmware that is not from the official OpenWrt project.
When using forks/offshoots/vendor-specific builds that are "based on OpenWrt", there may be many differences compared to the official versions (hosted by OpenWrt.org ). Some of these customizations may fundamentally change the way that OpenWrt works. You might need help from people with specific/specialized knowledge about the firmware you are using, so it is possible that advice you get here may not be useful.
You may find that the best options are:
Install an official version of OpenWrt, if your device is supported (see https://firmware-selector.openwrt.org ).
Ask for help from the maintainer(s) or user community of the specific firmware that you are using.
Provide the source code for the firmware so that users on this forum can understand how your firmware works (OpenWrt forum users are volunteers, so somebody might look at the code if they have time and are interested in your issue).
If you believe that this specific issue is common to generic/official OpenWrt and/or the maintainers of your build have indicated as such, please feel free to clarify.
Thanks psherman, it's a GL.iNet Flint 4 router, that's probably running a modified OpenWRT. That's about the extent of my knowledge!
Yes, the gl-inet vendor firmware is indeed a heavily modified version of OpenWrt and it is not supported on these forums. You need to ask GL-Inet for help with their firmware.
Thanks psherman. I may end up just flashing the latest OpenWRT if I can muster up the courage!
That device is not yet supported by the official OpenWrt, but yeah, I would suggest using official OpenWrt when it is available.
