iOS (iPhone or iPad) not getting internet when connected to WiFi (openwrt vpn router) but android devices are fine

scotjam · April 21, 2023, 9:36pm

I installed openwrt 21.02.3 on my linksys wrt1900ac v2 so that I can connect to vpn WiFi (and switch back to my isp router WiFi whenever I want). Works well on my android devices.

Whenever apple users come to visit they can't connect with their apple devices (2 iPhones and an iPad). They can connect to the WiFi but it says there is no Internet on that connection. Spent over an hour on with apple tech support and didn't get a solution but we did establish that the apple devices can connect to the isp router without issue and have Internet.

The android devices can be switched to airplane mode then when you turn the WiFi only back on and then connect to the vpn WiFi (linksys) it has Internet access.

Switching off wireless security on the vpn router doesn't affect the situation for either the apple (no Internet) or the android devices (have Internet).

No doubt I've got some unusual setting on the openwrt settings that apple doesn't play nicely with.

Has anyone else bumped into this issue?

psherman · April 21, 2023, 9:47pm

let's see your config...

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

scotjam · April 22, 2023, 8:34am

Thanks psherman - my config (parts that I guess may be sensitive are xxx):


root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'xxxx:xxxx:xxxx::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.2.1'

config device
        option name 'wan'
        option macaddr 'xx:xx:xx:xx:xx:xx'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'
        option peerdns '0'
        list dns '103.86.96.100'
        list dns '103.86.99.100'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config interface 'tun0'
        option proto 'none'
        option device 'tun0'
        option auto '0'

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'soc/soc:pcie/pci0000:00/0000:00:01.0/0000:01:00.0'
        option band '5g'
        option cell_density '0'
        option htmode 'VHT40'
        option channel 'auto'
        option country 'NL'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option macaddr 'xx:xx:xx:xx:xx:xx'
        option ssid 'Linksysxxxxx'
        option key 'xxx'
        option encryption 'psk-mixed'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'soc/soc:pcie/pci0000:00/0000:00:02.0/0000:02:00.0'
        option channel '1'
        option band '2g'
        option htmode 'HT20'
        option country 'FR'
        option cell_density '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option macaddr 'xx:xx:xx:xx:xx:xx'
        option ssid 'Linksysxxxxxx'
        option key 'xxx'
        option encryption 'psk2'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option localservice '1'
        option ednspacket_max '1232'
        option port '1053'
        option noresolv '1'
        option nohosts '1'
        list server '8.8.8.8'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'
        list ra_flags 'none'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config host
        option name 'x'
        option dns '1'
        option mac 'xx:xx:xx:xx:xx:xx'
        option ip '192.168.2.207'

config host
        option name 'xx'
        option ip '192.168.2.214'
        option mac 'xx:xx:xx:xx:xx:xx'

config host
        option ip '192.168.2.208'
        option mac 'xx:xx:xx:x:xx:xx'
        option name 'xxx'
        option dns '1'

config host
        option name 'xxxx'
        option ip '192.168.2.228'
        option mac 'xx:xx:xx:xx:xx:xx'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'
        list network 'tun0'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Support-UDP-Traceroute'
        option src 'wan'
        option dest_port '33434:33689'
        option proto 'udp'
        option family 'ipv4'
        option target 'REJECT'
        option enabled 'false'

config include
        option path '/etc/firewall.user'

config zone
        option name 'vpnfirewall'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'surfsharktun'

config forwarding
        option src 'lan'
        option dest 'vpnfirewall'

root@OpenWrt:~#

scotjam · April 22, 2023, 11:50am

I found a workaround. I don't know what setting is wrong exactly but this gets it working.

On the iOS device, after connecting to the linksys wifi, I click on the wifi connection which brings up a list of network options. One of those is DNS which is automatic by default. If I click on that, change it to manual, and then enter google DNS (8.8.8.8) then the internet connection works on the iOS device.

This worked on all three iOS devices I have access to right now.

psherman · April 22, 2023, 3:36pm

This indicates that your DNS is probably not working as expected in your configuration.

So... looking at DNS specifically -- what are the DNS entries that you've defined in your wan interface? It appears that they're for NordVPN, is that correct? These shouldn't be in your wan, and that could be part of the issue. You should use either the ISP/DHCP advertised DNS, or a public one (like 8.8.8.8) on your wan. Using DNS that is related to the VPN on your wan interface could cause a chicken-or-egg situation.

These are also likely to cause DNS problems... is there a reason you have made these changes?

On a slightly different topic, you've got your VPN setup with your wan zone... it seems that you had previously configured it differently with the vpnfirewall zone which would give you the ability to have a kill-switch. When it is setup with the wan zone, a kill switch won't work. This isn't a problem, per-se, but the vpnfirewall zone doesn't do anything right now.

Also, on wireless, don't use psk-mixed unless you actually need to (i.e. legacy devices). You should probably change this to psk2 (unless you want to use newer WPA3; keep in mind that many devices don't work well when you use sae-mixed (WPA2/WPA3) mode, so you want to be either WPA2 or WPA3, not mixed)

scotjam:

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option macaddr 'xx:xx:xx:xx:xx:xx'
        option ssid 'Linksysxxxxx'
        option key 'xxx'
        option encryption 'psk-mixed'

scotjam · April 22, 2023, 5:31pm

thank you for this, my dnsmasq now reads:

config dnsmasq
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option localservice '1'
        option ednspacket_max '1232'
        option authoritative '1'

my wan interface is now:

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'
        option peerdns '0'
        list dns '8.8.8.8'

Apple devices working well now - thanks so much!

I suspect that the reason for most of these changed settings must have been either a previous vpn provider suggestion or an uneducated attempt to block dns leaks. I set up this router long ago originally.

I have just now followed this guide (only the first part - Web interface instructions) and it seems to be blocking dns leaks now:

I also noted your point about mixed mode and have set it to use just wpa2-psk on both SSIDs now.

Regarding the firewall vpn kill switch you mentioned, I have now followed (probably re-followed given that the zone was already set up) the instructions here:

WAN and VPN are both input=reject, output=accept, forward=reject, enable masquerading

One point I'm not clear on - what should the settings be for the LAN -> vpn row (in Luci this is)
currently I have input=accept, output=accept, forward=accept, disable masquerading. Is that correct or should it match the others?

Thanks again!!

psherman · April 22, 2023, 5:46pm

You’re really talking about the lan zone rules. And yes, this sounds correct.

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Thanks!

system · May 22, 2023, 1:49pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.