Is my router dead?

bluspider · February 18, 2020, 4:02pm

I have been using OpenWrt since Dec 2019. Seem to have no major issues so far.

Last night my wife switched off the power button on the router and switched it back this morning.

Now I am not getting internet on both wireless and even wired from the router (Netgear Nighthawk X4 R7500). Internet is available only when connected directly from the modem to my laptop (via RJ45).

I tried the following but none seems to have resolved the issue.

Restored from a recent archive
Performed reset from LUCI
Performed a hardware reset and tried with minimum configuration

Anything else I can try?

Appreciate all the help from this community.

trendy · February 18, 2020, 4:21pm

Connect the router back on the modem. Restore the last working backup you have.
Please post here the output of the following command, copy and paste the whole block:

uci show network;uci show wireless; \
uci show firewall; uci show dhcp; \
iptables-save; ip6tables-save; \
ip -4 addr ; ip -4 ro ; ip -4 ru; \
ip -6 addr ; ip -6 ro ; ip -6 ru; \
head -n -0 /etc/firewall.user; \
ls -l  /etc/resolv.* /tmp/resolv.*; head -n -0 /etc/resolv.* /tmp/resolv.*

Please use "Preformatted text </>" for logs, scripts, configs and general console output.

Remove any sensitive data from the output, like passwords, wifi keys, etc

slh · February 18, 2020, 4:34pm

If you can still access OpenWrt (via ssh or webinterface) on your device, it's not dead - that doesn't preclude further hardware problems (e.g. a blown out WAN port, broken NAND sectors, broken WLAN cards, etc.), but at least it's not dead and allows further debugging.

As a first debugging step, I'd re-flash the current OpenWrt version without keeping settings and starting with a fresh minimal configuration[0]. If that doesn't help, you'd need to check the system logs for details.

--
[0] if you have another working router, even if it's older or too slow for your network connection, another easy test would be to put your suspected broken router behind that one - to check the easiest network connection (ethernet + dhcp, yes double-NAT, but that's not an issue for quick functionality tests).

dlakelan · February 18, 2020, 4:49pm

Before doing anything.... do "the dance" sometimes modems lock out all but one MAC address... the first one they hear... And when you start up a router sometimes its switch chip will be in a forwarding mode where everything is forwarded to everywhere... so the first MAC your modem might have heard was say your laptop... This would explain all the symptoms...

So, here's the dance:

Turn off modem, and router
Turn router on, wait 1 minute to be sure it's fully initialized and online properly
Turn on modem, the first MAC it hears will be the router... and all should be good

If this still doesn't work... then try other things.

bluspider · February 18, 2020, 5:59pm

dlakelan, I tried steps 1,2,3 above a few times but did not resolve the issue. But you are right, I noticed this mac address locking in the past.

bluspider · February 18, 2020, 6:01pm

I am still able to ssh into the router and also access through web interface. Will try flashing the latest and see if that works.

mk24 · February 18, 2020, 6:06pm

Do the Ethernet link lights (if equipped) on the router WAN port and the modem come on? Does the main status page show an uplink connection?

bluspider · February 18, 2020, 6:31pm

@slh, will I be able to install from web UI. I downloaded the upgrade file from this page

https://openwrt.org/toh/views/toh_fwdownload?dataflt[0]=supported+current+rel_%3D19.07.1&dataflt[Brand*~]=netgear for R7000 but I am getting below error when tried to upload.

The backup archive does not appear to be a valid gzip file.

The file I downloaded is
openwrt-19.07.1-bcm53xx-netgear-r7000-squashfs.chk

My router model is R7500 but I don't see that on above list. So I downloaded R7000. Am doing something stupid?

bluspider · February 18, 2020, 6:33pm

Yes I am seeing the WAN led on the modem and the router. Not sure what you mean by "uplink connection". Where can I see this?

mk24 · February 18, 2020, 6:36pm

Go to the main status web page (the first page that appears after you log in to LuCI), scroll down to "Network" and look for "IPv4 Upstream" and/or "IPv6 Upstream".

dlakelan · February 18, 2020, 6:48pm

Your device is described here: https://openwrt.org/toh/netgear/netgear_r7500

which shows download links for upgrades for v1 and v2:

http://downloads.openwrt.org/releases/19.07.1/targets/ipq806x/generic/openwrt-19.07.1-ipq806x-generic-netgear_r7500-squashfs-sysupgrade.bin

http://downloads.openwrt.org/releases/19.07.1/targets/ipq806x/generic/openwrt-19.07.1-ipq806x-generic-netgear_r7500v2-squashfs-sysupgrade.bin

choose the appropriate one based on your version, and use that for the upgrade.

bluspider · February 18, 2020, 6:49pm

 -----------------------------------------------------
 OpenWrt 18.06.5, r7897-9d401013fc
 -----------------------------------------------------
root@PARIS:~# clear
root@PARIS:~# uci show network;uci show wireless; \
> uci show firewall; uci show dhcp; \
> iptables-save; ip6tables-save; \
> ip -4 addr ; ip -4 ro ; ip -4 ru; \
> ip -6 addr ; ip -6 ro ; ip -6 ru; \
> head -n -0 /etc/firewall.user; \
> ls -l  /etc/resolv.* /tmp/resolv.*; head -n -0 /etc/resolv.* /tmp/resolv.*
network.loopback=interface
network.loopback.ifname='lo'
network.loopback.proto='static'
network.loopback.ipaddr='127.0.0.1'
network.loopback.netmask='255.0.0.0'
network.globals=globals
network.globals.ula_prefix='fd60:eb19:f655::/48'
network.lan=interface
network.lan.type='bridge'
network.lan.ifname='eth1.1'
network.lan.proto='static'
network.lan.ipaddr='192.168.1.1'
network.lan.netmask='255.255.255.0'
network.lan.ip6assign='60'
network.lan.dns='208.67.220.220 208.67.222.222'
network.wan=interface
network.wan.ifname='eth0.2'
network.wan.proto='dhcp'
network.wan6=interface
network.wan6.ifname='eth0.2'
network.wan6.proto='dhcpv6'
network.@switch[0]=switch
network.@switch[0].name='switch0'
network.@switch[0].reset='1'
network.@switch[0].enable_vlan='1'
network.@switch_vlan[0]=switch_vlan
network.@switch_vlan[0].device='switch0'
network.@switch_vlan[0].vlan='1'
network.@switch_vlan[0].ports='1 2 3 4 6t'
network.@switch_vlan[1]=switch_vlan
network.@switch_vlan[1].device='switch0'
network.@switch_vlan[1].vlan='2'
network.@switch_vlan[1].ports='5 0t'
wireless.radio0=wifi-device
wireless.radio0.type='mac80211'
wireless.radio0.hwmode='11g'
wireless.radio0.path='soc/1b700000.pci/pci0001:00/0001:00:00.0/0001:01:00.0'
wireless.radio0.country='US'
wireless.radio0.legacy_rates='1'
wireless.radio0.channel='auto'
wireless.radio0.htmode='HT40'
wireless.default_radio0=wifi-iface
wireless.default_radio0.device='radio0'
wireless.default_radio0.network='lan'
wireless.default_radio0.mode='ap'
wireless.default_radio0.ssid='GANYMEDE'
wireless.default_radio0.encryption='psk'
wireless.default_radio0.key='**my_wireless_pwd**'
firewall.@defaults[0]=defaults
firewall.@defaults[0].syn_flood='1'
firewall.@defaults[0].input='ACCEPT'
firewall.@defaults[0].output='ACCEPT'
firewall.@defaults[0].forward='REJECT'
firewall.@zone[0]=zone
firewall.@zone[0].name='lan'
firewall.@zone[0].network='lan'
firewall.@zone[0].input='ACCEPT'
firewall.@zone[0].output='ACCEPT'
firewall.@zone[0].forward='ACCEPT'
firewall.@zone[1]=zone
firewall.@zone[1].name='wan'
firewall.@zone[1].network='wan' 'wan6'
firewall.@zone[1].input='REJECT'
firewall.@zone[1].output='ACCEPT'
firewall.@zone[1].forward='REJECT'
firewall.@zone[1].masq='1'
firewall.@zone[1].mtu_fix='1'
firewall.@forwarding[0]=forwarding
firewall.@forwarding[0].src='lan'
firewall.@forwarding[0].dest='wan'
firewall.@rule[0]=rule
firewall.@rule[0].name='Allow-DHCP-Renew'
firewall.@rule[0].src='wan'
firewall.@rule[0].proto='udp'
firewall.@rule[0].dest_port='68'
firewall.@rule[0].target='ACCEPT'
firewall.@rule[0].family='ipv4'
firewall.@rule[1]=rule
firewall.@rule[1].name='Allow-Ping'
firewall.@rule[1].src='wan'
firewall.@rule[1].proto='icmp'
firewall.@rule[1].icmp_type='echo-request'
firewall.@rule[1].family='ipv4'
firewall.@rule[1].target='ACCEPT'
firewall.@rule[2]=rule
firewall.@rule[2].name='Allow-IGMP'
firewall.@rule[2].src='wan'
firewall.@rule[2].proto='igmp'
firewall.@rule[2].family='ipv4'
firewall.@rule[2].target='ACCEPT'
firewall.@rule[3]=rule
firewall.@rule[3].name='Allow-DHCPv6'
firewall.@rule[3].src='wan'
firewall.@rule[3].proto='udp'
firewall.@rule[3].src_ip='fc00::/6'
firewall.@rule[3].dest_ip='fc00::/6'
firewall.@rule[3].dest_port='546'
firewall.@rule[3].family='ipv6'
firewall.@rule[3].target='ACCEPT'
firewall.@rule[4]=rule
firewall.@rule[4].name='Allow-MLD'
firewall.@rule[4].src='wan'
firewall.@rule[4].proto='icmp'
firewall.@rule[4].src_ip='fe80::/10'
firewall.@rule[4].icmp_type='130/0' '131/0' '132/0' '143/0'
firewall.@rule[4].family='ipv6'
firewall.@rule[4].target='ACCEPT'
firewall.@rule[5]=rule
firewall.@rule[5].name='Allow-ICMPv6-Input'
firewall.@rule[5].src='wan'
firewall.@rule[5].proto='icmp'
firewall.@rule[5].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type' 'router-solicitation' 'neighbour-solicitation' 'router-advertisement' 'neighbour-advertisement'
firewall.@rule[5].limit='1000/sec'
firewall.@rule[5].family='ipv6'
firewall.@rule[5].target='ACCEPT'
firewall.@rule[6]=rule
firewall.@rule[6].name='Allow-ICMPv6-Forward'
firewall.@rule[6].src='wan'
firewall.@rule[6].dest='*'
firewall.@rule[6].proto='icmp'
firewall.@rule[6].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type'
firewall.@rule[6].limit='1000/sec'
firewall.@rule[6].family='ipv6'
firewall.@rule[6].target='ACCEPT'
firewall.@rule[7]=rule
firewall.@rule[7].name='Allow-IPSec-ESP'
firewall.@rule[7].src='wan'
firewall.@rule[7].dest='lan'
firewall.@rule[7].proto='esp'
firewall.@rule[7].target='ACCEPT'
firewall.@rule[8]=rule
firewall.@rule[8].name='Allow-ISAKMP'
firewall.@rule[8].src='wan'
firewall.@rule[8].dest='lan'
firewall.@rule[8].dest_port='500'
firewall.@rule[8].proto='udp'
firewall.@rule[8].target='ACCEPT'
firewall.@include[0]=include
firewall.@include[0].path='/etc/firewall.user'
firewall.@rule[9]=rule
firewall.@rule[9].name='WKNDS after 10 PM'
firewall.@rule[9].proto='all'
firewall.@rule[9].weekdays='Sun Fri Sat'
firewall.@rule[9].stop_time='23:59:59'
firewall.@rule[9].target='REJECT'
firewall.@rule[9].start_date='2020-01-01'
firewall.@rule[9].src='lan'
firewall.@rule[9].dest='wan'
firewall.@rule[9].start_time='22:00:00'
firewall.@rule[10]=rule
firewall.@rule[10].enabled='1'
firewall.@rule[10].src='lan'
firewall.@rule[10].name='WeekDays'
firewall.@rule[10].proto='all'
firewall.@rule[10].target='DROP'
firewall.@rule[10].weekdays='Mon Tue Wed Thu'
firewall.@rule[10].stop_time='23:59:59'
firewall.@rule[10].start_date='2020-01-25'
firewall.@rule[10].start_time='21:00:00'
firewall.@rule[10].dest='wan'
dhcp.@dnsmasq[0]=dnsmasq
dhcp.@dnsmasq[0].domainneeded='1'
dhcp.@dnsmasq[0].localise_queries='1'
dhcp.@dnsmasq[0].rebind_protection='1'
dhcp.@dnsmasq[0].rebind_localhost='1'
dhcp.@dnsmasq[0].local='/lan/'
dhcp.@dnsmasq[0].domain='lan'
dhcp.@dnsmasq[0].expandhosts='1'
dhcp.@dnsmasq[0].authoritative='1'
dhcp.@dnsmasq[0].readethers='1'
dhcp.@dnsmasq[0].leasefile='/tmp/dhcp.leases'
dhcp.@dnsmasq[0].resolvfile='/tmp/resolv.conf.auto'
dhcp.@dnsmasq[0].nonwildcard='1'
dhcp.@dnsmasq[0].localservice='1'
dhcp.@dnsmasq[0].serversfile='/var/run/simple-adblock.servers'
dhcp.lan=dhcp
dhcp.lan.interface='lan'
dhcp.lan.start='100'
dhcp.lan.limit='150'
dhcp.lan.leasetime='12h'
dhcp.lan.dhcpv6='server'
dhcp.lan.ra='server'
dhcp.lan.ra_management='1'
dhcp.wan=dhcp
dhcp.wan.interface='wan'
dhcp.wan.ignore='1'
dhcp.odhcpd=odhcpd
dhcp.odhcpd.maindhcp='0'
dhcp.odhcpd.leasefile='/tmp/hosts/odhcpd'
dhcp.odhcpd.leasetrigger='/usr/sbin/odhcpd-update'
dhcp.odhcpd.loglevel='4'
dhcp.@host[0]=host
dhcp.@host[0].name='SpeeXI'
dhcp.@host[0].dns='1'
dhcp.@host[0].mac='84:AD:8D:AF:D0:A1'
dhcp.@host[0].ip='192.168.1.158'
dhcp.@host[0].leasetime='infinite'
dhcp.@host[0].duid='000100012247e144007326426498'
dhcp.@host[1]=host
dhcp.@host[1].name='MBP'
dhcp.@host[1].dns='1'
dhcp.@host[1].mac='00:26:08:E2:A7:1D'
dhcp.@host[1].ip='192.168.1.210'
dhcp.@host[1].leasetime='infinite'
dhcp.@host[1].duid='000100012247e1440056cd120708'
dhcp.@host[2]=host
dhcp.@host[2].name='SV-iPhone'
dhcp.@host[2].dns='1'
dhcp.@host[2].mac='00:56:CD:44:75:78'
dhcp.@host[2].ip='192.168.1.232'
dhcp.@host[2].leasetime='infinite'
dhcp.@host[2].duid='000100012247e1440056cd082279'
dhcp.@host[3]=host
dhcp.@host[3].name='sperikala00100'
dhcp.@host[3].dns='1'
dhcp.@host[3].mac='C6:18:AA:C3:3F:5B'
dhcp.@host[3].ip='192.168.1.173'
dhcp.@host[3].leasetime='infinite'
dhcp.@host[3].duid='0001000125743f0484ad8d072171'
dhcp.@host[4]=host
dhcp.@host[4].name='amazon-1bbc8eb98'
dhcp.@host[4].dns='1'
dhcp.@host[4].mac='18:74:2E:0D:72:A3'
dhcp.@host[4].ip='192.168.1.150'
dhcp.@host[4].leasetime='infinite'
dhcp.@host[4].duid='0001000125743f0484ad8dafaaa2'
dhcp.@host[5]=host
dhcp.@host[5].name='DESKTOP-3OJ0VE2'
dhcp.@host[5].dns='1'
dhcp.@host[5].mac='50:3E:AA:30:21:C5'
dhcp.@host[5].ip='192.168.1.249'
dhcp.@host[5].leasetime='infinite'
dhcp.@host[5].duid='0001000125743f0484ad8dafbbb3'
dhcp.@host[6]=host
dhcp.@host[6].name='VMB4000'
dhcp.@host[6].dns='1'
dhcp.@host[6].mac='9C:3D:CF:57:40:97'
dhcp.@host[6].ip='192.168.1.248'
dhcp.@host[6].leasetime='infinite'
dhcp.@host[6].duid='0001000125bd2f11d0abd5efbbb4'
# Generated by iptables-save v1.6.2 on Tue Jan 28 21:14:20 2020
*nat
:PREROUTING ACCEPT [4539:591940]
:INPUT ACCEPT [598:43871]
:OUTPUT ACCEPT [1054:78218]
:POSTROUTING ACCEPT [64:5716]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i eth0.2 -m comment --comment "!fw3" -j zone_wan_prerouting
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o eth0.2 -m comment --comment "!fw3" -j zone_wan_postrouting
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
COMMIT
# Completed on Tue Jan 28 21:14:20 2020
# Generated by iptables-save v1.6.2 on Tue Jan 28 21:14:20 2020
*mangle
:PREROUTING ACCEPT [7503:924492]
:INPUT ACCEPT [3562:376423]
:FORWARD ACCEPT [3379:411158]
:OUTPUT ACCEPT [3811:811596]
:POSTROUTING ACCEPT [3814:812580]
-A FORWARD -o eth0.2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Tue Jan 28 21:14:20 2020
# Generated by iptables-save v1.6.2 on Tue Jan 28 21:14:20 2020
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_DROP - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i eth0.2 -m comment --comment "!fw3" -j zone_wan_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i eth0.2 -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o eth0.2 -m comment --comment "!fw3" -j zone_wan_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m time --timestart 22:00:00 --timestop 23:59:59 --weekdays Fri,Sat,Sun --datestart 2020-01-01T00:00:00 --kerneltz -m comment --comment "!fw3: WKNDS after 10 PM" -j zone_wan_dest_REJECT
-A zone_lan_forward -m time --timestart 21:00:00 --timestop 23:59:59 --weekdays Mon,Tue,Wed,Thu --datestart 2020-01-25T00:00:00 --kerneltz -m comment --comment "!fw3: WeekDays" -j zone_wan_dest_DROP
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth0.2 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth0.2 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_DROP -o eth0.2 -m comment --comment "!fw3" -j DROP
-A zone_wan_dest_REJECT -o eth0.2 -m comment --comment "!fw3" -j reject
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i eth0.2 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Tue Jan 28 21:14:20 2020
# Generated by ip6tables-save v1.6.2 on Tue Jan 28 21:14:20 2020
*mangle
:PREROUTING ACCEPT [1993:241972]
:INPUT ACCEPT [585:54590]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1192:153739]
:POSTROUTING ACCEPT [1195:153891]
-A FORWARD -o eth0.2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Tue Jan 28 21:14:20 2020
# Generated by ip6tables-save v1.6.2 on Tue Jan 28 21:14:20 2020
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [18:1800]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_DROP - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i eth0.2 -m comment --comment "!fw3" -j zone_wan_input
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i eth0.2 -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o eth0.2 -m comment --comment "!fw3" -j zone_wan_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp6-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m time --timestart 22:00:00 --timestop 23:59:59 --weekdays Fri,Sat,Sun --datestart 2020-01-01T00:00:00 --kerneltz -m comment --comment "!fw3: WKNDS after 10 PM" -j zone_wan_dest_REJECT
-A zone_lan_forward -m time --timestart 21:00:00 --timestop 23:59:59 --weekdays Mon,Tue,Wed,Thu --datestart 2020-01-25T00:00:00 --kerneltz -m comment --comment "!fw3: WeekDays" -j zone_wan_dest_DROP
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth0.2 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth0.2 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_DROP -o eth0.2 -m comment --comment "!fw3" -j DROP
-A zone_wan_dest_REJECT -o eth0.2 -m comment --comment "!fw3" -j reject
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Forward" -j ACCEPT
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -s fc00::/6 -d fc00::/6 -p udp -m udp --dport 546 -m comment --comment "!fw3: Allow-DHCPv6" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 130/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 131/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 132/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 143/0 -m comment --comment "!fw3: Allow-MLD" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 133 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m limit --limit 1000/sec -m comment --comment "!fw3: Allow-ICMPv6-Input" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i eth0.2 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Tue Jan 28 21:14:20 2020
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
6: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
       valid_lft forever preferred_lft forever
8: eth0.2@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    inet 24.228.176.15/21 brd 24.228.183.255 scope global eth0.2
       valid_lft forever preferred_lft forever
default via 24.228.176.1 dev eth0.2  src 24.228.176.15
24.228.176.0/21 dev eth0.2 scope link  src 24.228.176.15
192.168.1.0/24 dev br-lan scope link  src 192.168.1.1
0:      from all lookup local
32766:  from all lookup main
32767:  from all lookup default
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1000
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::6eb0:ceff:fee2:6ac7/64 scope link
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::6eb0:ceff:fee2:6ac6/64 scope link
       valid_lft forever preferred_lft forever
6: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fd60:eb19:f655::1/60 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::6eb0:ceff:fee2:6ac6/64 scope link
       valid_lft forever preferred_lft forever
8: eth0.2@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::6eb0:ceff:fee2:6ac7/64 scope link
       valid_lft forever preferred_lft forever
9: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 fe80::203:7ff:fe12:3456/64 scope link
       valid_lft forever preferred_lft forever
fd60:eb19:f655::/64 dev br-lan  metric 1024
unreachable fd60:eb19:f655::/48 dev lo  metric 2147483647  error -113
fe80::/64 dev eth0  metric 256
fe80::/64 dev eth0.2  metric 256
fe80::/64 dev eth1  metric 256
fe80::/64 dev br-lan  metric 256
fe80::/64 dev wlan0  metric 256
anycast fd60:eb19:f655:: dev br-lan  metric 0
anycast fe80:: dev br-lan  metric 0
anycast fe80:: dev eth1  metric 0
anycast fe80:: dev eth0  metric 0
anycast fe80:: dev eth0.2  metric 0
anycast fe80:: dev wlan0  metric 0
ff00::/8 dev br-lan  metric 256
ff00::/8 dev eth0  metric 256
ff00::/8 dev eth0.2  metric 256
ff00::/8 dev eth1  metric 256
ff00::/8 dev wlan0  metric 256
0:      from all lookup local
32766:  from all lookup main
4200000001:     from all iif lo lookup unspec 12
4200000006:     from all iif br-lan lookup unspec 12
4200000008:     from all iif eth0.2 lookup unspec 12
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.

# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.
lrwxrwxrwx    1 root     root            16 Nov  5 09:12 /etc/resolv.conf -> /tmp/resolv.conf
-rw-r--r--    1 root     root            32 Jan 28 21:11 /tmp/resolv.conf
-rw-r--r--    1 root     root           132 Jan 28 21:11 /tmp/resolv.conf.auto
==> /etc/resolv.conf <==
search lan
nameserver 127.0.0.1

==> /tmp/resolv.conf <==
search lan
nameserver 127.0.0.1

==> /tmp/resolv.conf.auto <==
# Interface lan
nameserver 208.67.220.220
nameserver 208.67.222.222
# Interface wan
nameserver 65.19.96.252
nameserver 65.19.96.253
root@PARIS:~#

dlakelan · February 18, 2020, 6:53pm

that dump shows your device is online with an IPv4 address on WAN:

8: eth0.2@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    inet 24.228.176.15/21 brd 24.228.183.255 scope global eth0.2
       valid_lft forever preferred_lft forever
default via 24.228.176.1 dev eth0.2  src 24.228.176.15
24.228.176.0/21 dev eth0.2 scope link  src 24.228.176.15
192.168.1.0/24 dev br-lan scope link  src 192.168.1.1

bluspider · February 18, 2020, 6:56pm

Thank you so much, dlakelan ! Will try upgrade later today.

mk24 · February 18, 2020, 6:56pm

I see the wan has a public IP address and a default route, which is good. See if you can ping your ISP's router at 24.228.176.1. Also try pinging 8.8.8.8.

Do not do this. If you want to use a different nameserver than the ISP suggests via DHCP, configure that in the wan section.
If Internet access by numeric IP works, but not by name, the DNS is misconfigured.

dlakelan · February 18, 2020, 6:56pm

Well, don't thank me yet, are you able to actually do anything from your LAN?

bluspider · February 18, 2020, 6:59pm

That was for opendns. I configured it when I originally installed OpenWrt which seems to be working fine. I will remove it and try. thanks !

bluspider · February 18, 2020, 7:03pm

Nothing at this time. Only way I am getting internet is by connecting my laptop directly to the modem.

Even wired connection through the router is showing "no internet'. Same with wireless. " No Internet, Secured"

dlakelan · February 18, 2020, 7:05pm

Are you able to connect to the openwrt router and then have the router itself ping something? can you ping 8.8.8.8 from the lan (which wouldn't involve a DNS lookup)?

bluspider · February 18, 2020, 7:10pm

no response on ping 8.8.8.8

@mk24, I am able to ping IPS's router

root@PARIS:~# ping 24.228.176.1
PING 24.228.176.1 (24.228.176.1): 56 data bytes
64 bytes from 24.228.176.1: seq=0 ttl=255 time=8.544 ms
64 bytes from 24.228.176.1: seq=1 ttl=255 time=8.215 ms
64 bytes from 24.228.176.1: seq=2 ttl=255 time=7.368 ms
64 bytes from 24.228.176.1: seq=3 ttl=255 time=8.649 ms
64 bytes from 24.228.176.1: seq=4 ttl=255 time=7.335 ms
64 bytes from 24.228.176.1: seq=5 ttl=255 time=7.261 ms
64 bytes from 24.228.176.1: seq=6 ttl=255 time=8.054 ms
64 bytes from 24.228.176.1: seq=7 ttl=255 time=7.586 ms
64 bytes from 24.228.176.1: seq=8 ttl=255 time=8.882 ms
64 bytes from 24.228.176.1: seq=9 ttl=255 time=8.399 ms
64 bytes from 24.228.176.1: seq=10 ttl=255 time=8.850 ms
64 bytes from 24.228.176.1: seq=11 ttl=255 time=7.964 ms
64 bytes from 24.228.176.1: seq=12 ttl=255 time=10.258 ms
64 bytes from 24.228.176.1: seq=13 ttl=255 time=9.022 ms
64 bytes from 24.228.176.1: seq=14 ttl=255 time=8.231 ms
64 bytes from 24.228.176.1: seq=15 ttl=255 time=7.746 ms
64 bytes from 24.228.176.1: seq=16 ttl=255 time=7.346 ms
64 bytes from 24.228.176.1: seq=17 ttl=255 time=8.595 ms
64 bytes from 24.228.176.1: seq=18 ttl=255 time=9.473 ms
64 bytes from 24.228.176.1: seq=19 ttl=255 time=7.566 ms
64 bytes from 24.228.176.1: seq=20 ttl=255 time=8.387 ms
64 bytes from 24.228.176.1: seq=21 ttl=255 time=10.345 ms
64 bytes from 24.228.176.1: seq=22 ttl=255 time=7.485 ms
64 bytes from 24.228.176.1: seq=23 ttl=255 time=8.501 ms
^C
--- 24.228.176.1 ping statistics ---
24 packets transmitted, 24 packets received, 0% packet loss
round-trip min/avg/max = 7.261/8.335/10.345 ms
root@PARIS:~# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes