Intra/Internet problems

flyingpeter · April 20, 2019, 3:00am

Heys Guys!

I am facing a problem and i've almost dedicated my last 5 days at full time to search a solution for this problem... but i just can't. I've read a lot here in the forum, google... etc... almost giving up.

Here it goes:

I have my home lan. I have a good ISP Router that manages my Fiber connection. I have my own wifi and a guest one.

I want to extend this setting to another place next to my home. I passed a ethernet cable and i grab my old TPLINK MR3420V2 and flashed with Openwrt.

Here is the goal... I want it to access full lan with lan ports, i want to have a wifi for me, and again a guest wifi.

i followed this tutotial (one of them... that i've tried...): https://medium.com/openwrt-iot/openwrt-multiple-ssids-f43169945890

The guest wifi works like a charm. No intranet connections, internet works fine.

The problem is with my Intranet connections in lan connected devices and private wifi. I have internet... but no intranet connections. and a strange thing, i cant event ping 8.8.8.8 in network diagnosis, even that i have internet.

i have tried to connect the lan cable to wan (from router to tplink...) and i have the problem i showed you before. i also tried from on of the four lan ports... (but the results are even worse then then wan...)

i tryed to turn off firewall, played with dhcp (and when i turn it off... my tlpink doenst pass my router dhcp server assign the ips after the router...

i am stuck on this. there were moments i thought i had it work... but after a few seconds... it stops working...

Any help guys?

jeff · April 20, 2019, 3:22am

A quick sketch of your setup, along with /etc/config/network from both routers pasted in using the preformatted button </> will help a lot. You can remove passwords and the like.

Hegabo · April 20, 2019, 6:38am

With the default settings, connecting to the LAN port will "extend" your home LAN. New router will be working as a switch and AP. Devices connected to new router LAN or WiFi will be as if connected to main router LAN (except guest WiFi of course). You will need your LAN IP to be in the same subnet as your main router, probably best to set it to static IP outside main router DHCP pool. You will need to turn off DHCP on new router.

If you connect to WAN, new router on a separate subnet. You will need to have the WAN port as DHCP client (or static), have the LAN interface IP set to a different subnet. With the default settings, you will have internet access but will need to adjust firewall settings to allow "intranet" access.

flyingpeter · April 20, 2019, 11:32am

Thanks for your answers!

In fact it works if I connect to LAN ports... But I loose the "Guest WiFi" setup.

Here are my setup files:

------------ /etc/config/network ------------------

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdaa:5ae2:56fe::/48'

config interface 'lan'
        option type 'bridge'
        option ifname 'eth1'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option ifname 'eth0'
        option proto 'dhcp'

config interface 'wan6'
        option ifname 'eth0'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0 1 2 3 4'

config interface 'public'
        option proto 'static'
        option ipaddr '10.0.0.2'
        option netmask '255.255.255.0'

------------ /etc/config/wireless ------------------

config wifi-device 'radio0'
        option type 'mac80211'
        option channel '11'
        option hwmode '11g'
        option path 'platform/ar934x_wmac'
        option htmode 'HT20'
        option country 'US'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'Private Wifi'
        option encryption 'none'

config wifi-iface
        option device 'radio0'
        option mode 'ap'
        option encryption 'none'
        option ssid 'Public Wifi'
        option network 'public'
        option isolate '1'

------------ /etc/config/dhcp ------------------

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.auto'
        option localservice '1'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv6 'server'
        option ra 'server'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'

config dhcp 'public'
        option interface 'public'
        option start '3'
        option limit '50'
        option leasetime '1h'

------------ /etc/config/firewall ------------------

config defaults
        option syn_flood        1
        option input            ACCEPT
        option output           ACCEPT
        option forward          REJECT
# Uncomment this line to disable ipv6 rules
#       option disable_ipv6     1

config zone
        option name             lan
        list   network          'lan'
        option input            ACCEPT
        option output           ACCEPT
        option forward          ACCEPT

config zone
        option name             wan
        list   network          'wan'
        list   network          'wan6'
        option input            REJECT
        option output           ACCEPT
        option forward          REJECT
        option masq             1
        option mtu_fix          1

config forwarding
        option src              lan
        option dest             wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
        option name             Allow-DHCP-Renew
        option src              wan
        option proto            udp
        option dest_port        68
        option target           ACCEPT
        option family           ipv4

# Allow IPv4 ping
config rule
        option name             Allow-Ping
        option src              wan
        option proto            icmp
        option icmp_type        echo-request
        option family           ipv4
        option target           ACCEPT

config rule
        option name             Allow-IGMP
        option src              wan
        option proto            igmp
        option family           ipv4
        option target           ACCEPT

# Allow DHCPv6 replies
# see https://dev.openwrt.org/ticket/10381
config rule
        option name             Allow-DHCPv6
        option src              wan
        option proto            udp
        option src_ip           fc00::/6
        option dest_ip          fc00::/6
        option dest_port        546
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-MLD
        option src              wan
        option proto            icmp
        option src_ip           fe80::/10
        list icmp_type          '130/0'
        list icmp_type          '131/0'
        list icmp_type          '132/0'
        list icmp_type          '143/0'
        option family           ipv6
        option target           ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Input
        option src              wan
        option proto    icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        list icmp_type          router-solicitation
        list icmp_type          neighbour-solicitation
        list icmp_type          router-advertisement
        list icmp_type          neighbour-advertisement
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Forward
        option src              wan
        option dest             *
        option proto            icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-IPSec-ESP
        option src              wan
        option dest             lan
        option proto            esp
        option target           ACCEPT

config rule
        option name             Allow-ISAKMP
        option src              wan
        option dest             lan
        option dest_port        500
        option proto            udp
        option target           ACCEPT

# include a file with users custom iptables rules
config include
        option path /etc/firewall.user

config zone
       option name 'public'
       option network 'public'
       option forward 'REJECT'
       option output 'ACCEPT'
       option input 'REJECT'

config forwarding
       option src 'public'
       option dest 'wan'

config rule
       option src 'public'
       option src_port '67-68'
       option dest_port '67-68'
       option proto 'udp'
       option target 'ACCEPT'
       option name 'Allow DHCP request'

config rule
       option src 'public'
       option dest_port '53'
       option proto 'tcpudp'
       option target 'ACCEPT'
       option name 'Allow DNS Queries'

config rule
       option target 'ACCEPT'
       option src 'public'
       option dest 'wan'
       option name 'Allow Guest on WAN http'
       option proto 'tcp'
       option dest_port '80'

config rule
       option target 'ACCEPT'
       option src 'public'
       option dest 'wan'
       option name 'Allow Guest on WAN https'
       option proto 'tcp'
       option dest_port '443'

config rule
       option src 'public'
       option dest 'wan'
       option name 'Deny Guest on WAN'
       option proto 'all'
       option target 'DROP'

Is that what you asked for Jeff?

Thanks again!

Hegabo · April 20, 2019, 9:20pm

That fact that it works doesn't necessarily mean it's how it should be setup. Do you have DCHP enables on the LAN interface? Did you disable DHCP on your main router? Also I see you have LAN IP of 192.168.1.1; can you confirm that your main router's LAN-side IP is different?

What do you mean by lose GuestWiFi setup? It disappears? Or you can't connect ot it? Or you can connect ot it but you can't access other PC? Or you can't access internet form it?

If the later, can you ping an external IP (e.g. 8.8.8.8 or 1.1.1.1) form a device connected to it?

P.S. I see you have only 1 VLAN (LAN), nothing for WAN, I imagine that why WAN doesn't work.

Could you include your code in Pre-formatted text </> (6th button form left , or Ctrl + Shift + C)

mk24 · April 20, 2019, 10:03pm

Basically you should get rid of wan and have only two networks in the router, lan and public. The trusted users will be on lan and bridge over directly and have full access to LAN resources. The public users will have their own IP range and DHCP server but be forwarded from public to lan for their internet access.

You will need to add firewall rules so the public users are blocked out of devices on the LAN, this means blocking public from the LAN IP block of private IPs but allow them to reach public IPs on the Internet.

flyingpeter · April 21, 2019, 12:01am

Sorry about my code wasn't idented. I did it in a hurry in my smartphone... and i'm not very used to the forum (yet).

Well answering to yout questions:

My router is 192.168.1.254, not the same as the Openwrt router.
The DHCP is on in both devices, but not in the same range... one gives from 1 to 100, the other from 101 to 254. (I tried also with the DHCP disabled on my Openwrt... but then i had to force a static IP in my computer connected to Openwrt device because the router wasn't relaying the DHCP from the main router.

-When i mean guestwifi setup... the gest wifi stop working because all setup was made for wan connection... so, no internet... no intranet... at all.

-No ping from devices connected to the router.

Thanks for your time!!!

flyingpeter · April 21, 2019, 12:05am

I sounds nice.

I will try do do it... i need two vlans, one of them, "firewalled". right?

searching...

mk24 · April 21, 2019, 12:09am

First get your basic "dumb AP" working, then add the guest network.

When you set your LAN to a static IP in 192.168.1.0/24, the main router's DHCP will set your PC also in this range, so you don't need a DHCP server in the AP. Everything is one network. If you did leave the DHCP server on, it might serve other PCs in the network and tell them that it is the gateway to the Internet, which is not right and it will break your network.

flyingpeter · April 21, 2019, 12:20am

Well... that part was easy.

Reset to my Openwrt
DHCP disabled.
Static IP information saved on lan interface (gateway, dns)
Wireless enabled with encryption

Everything working. Connection with lan devices and Internet in both cabled and wifi!

Peace of cake!

P.S:

Backup file downloaded (ahah)

flyingpeter · April 21, 2019, 1:16am

Hey Guys,

I am building my private lan under lan port instead of my wan port as @mk24 suggested.

When i was building over my wan... i used this tutorial:

and:
https://openwrt.org/docs/guide-user/network/wifi/guestwifi/guest-wlan-webinterface

Now i am doing it over my lan port with the help of this one:

its quite similiar... i am stuck in the last step.
Create a static route. This guy says to create a static route... this needs to be created in my router... or in my Openwrt? Any help?

jeff · April 21, 2019, 1:26am

I think you may be off on a road to a place you don't need to go

If your end goal is:

Two locations
LAN clients and "private" wireless clients can
- Talk to each other
- Reach the Internet
"Guest" wireless clients can
- Reach the Internet
Guest wireless clients can not reach LAN or private wireless clients

then there is no special routing or static routes required, just a couple of VLANs and tags on the switch ports that you use for the cable between them.

flyingpeter · April 21, 2019, 1:30am

Thats exatly what i need @jeff. Do you think via vlan should be a better way? but in that case how do i say to a vlan that should only acess internet and not lan? (sorry my basuc questions... networks are a headache to me!)

jeff · April 21, 2019, 1:55am

The way I think of VLANs is often as a cable within a cable. In the case here, it is a way that you can run two, separate packet streams over one Ethernet cable. I'll let one of the folks more familiar with LuCI configuration help you through it, but basically what you'll end up doing is:

Assigning your LAN bridge to eth0.10 (to pick a number)
Assigning your guest bridge to eth0.11
Configuring your switch so it understands they exist and sending them to the CPU tagged
Sending them out (and receiving them) as tagged on a selected port of your switch

In essence, you're going to use the same wire for both, but tell the senders and listeners on each end that "VLAN 10 means LAN" and "VLAN 11 means guest" and "don't mix them up!"

There's also a couple firewall rules you'll need to make sure that your routers don't route packets from LAN to guest or back, or accept packets from guest to the routers that they shouldn't, but that is pretty straightforward too.

mpa · April 21, 2019, 10:28am

Does the ISP router support 802.1Q VLAN tagging on its LAN ports at all?
Would it be OK if the guests behind one router cannot reach the guests behind the other, while all of them still can connect to the internet?

flyingpeter · April 21, 2019, 11:10am

@jeff I understand your point of view. But I need to setup firewall rules to apply to that vlan... (And the problem o think it will be the same...)

I follow some tutorials but the result is: "no internet" in my guest wifi devices.

Later I will post my setup!

Thanks again!

flyingpeter · April 21, 2019, 11:17am

@mpa I don't know. The router is a good quality router.... A bit limited by the operator. (Altice labs fiber gateway)

I have a guest wifi in it... And I tried to intercept the vlan of that guest wifi zone...

But... There are hundreds os possibilities and I couldn't get it.

I will run a script this afternoon to change my vlan associated with a wifi AP... From 1 to 4096.

After that I will have another script... in another machine with a static address (in the guest wifi range) just to ping and log the result.

If the router has more vlans... Instead of vlan 1 only... I will have a result. (I hope...)

jeff · April 21, 2019, 11:19pm

I'm not sure what this is trying to accomplish. The VLANs need to be set up by creating the sub-interfaces and/by adding them to the bridge and in the switch. 802.11 doesn't have the concept of a VLAN at all.

You can determine the VLANs available in your switch, as well as the number of table entries it permits using swconfig for most devices.

For example, from an Archer C7v2 running a recent master build on the ath79 platform, the two important lines for what you're doing are:

switch0: mdio-bus.0(Atheros AR8327), ports: 7 (cpu @ 0), vlans: 128
Attribute 1 (int): vid (VLAN ID (0-4094))

This tells me that I can use up to 128 different VLANs at once, 1-4094 are available as valid VLAN tags (0 and 4095 are reserved), and that if I want to use a tag above 128, then I'll need to specify the vid and pvid explicitly in my config. (Your switch may be notably different than this one!)

# swconfig list
Found: switch0 - mdio-bus.0

# swconfig dev switch0 help
switch0: mdio-bus.0(Atheros AR8327), ports: 7 (cpu @ 0), vlans: 128
     --switch
	Attribute 1 (int): enable_vlan (Enable VLAN mode)
	Attribute 2 (none): reset_mibs (Reset all MIB counters)
	Attribute 3 (int): enable_mirror_rx (Enable mirroring of RX packets)
	Attribute 4 (int): enable_mirror_tx (Enable mirroring of TX packets)
	Attribute 5 (int): mirror_monitor_port (Mirror monitor port)
	Attribute 6 (int): mirror_source_port (Mirror source port)
	Attribute 7 (int): arl_age_time (ARL age time (secs))
	Attribute 8 (string): arl_table (Get ARL table)
	Attribute 9 (none): flush_arl_table (Flush ARL table)
	Attribute 10 (int): igmp_snooping (Enable IGMP Snooping)
	Attribute 11 (int): igmp_v3 (Enable IGMPv3 support)
	Attribute 12 (none): apply (Activate changes in the hardware)
	Attribute 13 (none): reset (Reset the switch)
     --vlan
	Attribute 1 (int): vid (VLAN ID (0-4094))
	Attribute 2 (ports): ports (VLAN port mapping)
     --port
	Attribute 1 (none): reset_mib (Reset single port MIB counters)
	Attribute 2 (string): mib (Get port's MIB counters)
	Attribute 3 (int): enable_eee (Enable EEE PHY sleep mode)
	Attribute 4 (none): flush_arl_table (Flush port's ARL table entries)
	Attribute 5 (int): igmp_snooping (Enable port's IGMP Snooping)
	Attribute 6 (int): vlan_prio (Port VLAN default priority (VLAN PCP) (0-7))
	Attribute 7 (int): pvid (Primary VLAN ID)
	Attribute 8 (unknown): link (Get port link information)

flyingpeter · April 22, 2019, 12:58am

I understand what you mean. I have an extra tplink AP that in wifi setup i can join an VLAN with it. If my ISP Router creates a VLAN with the Guest Wifi, i just would need to intercept it and use it with no extra setup. BUT... i don't know if it really creates a VLAN... and even it creates a VLAN... i would need to know its number (maybe one of the 4096 possibilities).

I found a solution this afternoon... The solution is a bit silly... but it's working:

DUMB_AP configuration in my Openwrt solves the problem of my inter and intranet for wifi and ethernet.
One of the Lan ports of my Openwrt device connected to the WAN port (same device) and a guest wifi setup...

I am sure i could do it all by software... but i couldn't manage how to do it... so for now... it's working...

system · May 2, 2019, 12:59am

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.